Privacy Policy

Without an account, your collection, decks, storage boxes, and match life totals are stored only on the device. We do not receive them.

The app still downloads the on-device card-matching catalog from BuffBox so scanning can work offline. That download is not tied to an account. Card text, images, rulings, and prices are requested directly from Scryfall.

You sign in with a one-time code sent to your email. We store the email address, when it was verified, and any extra sign-in method you choose to turn on: an authenticator-app secret, passkeys, and hashed backup codes. We do not use account passwords. We do not send SMS codes.

Email codes are sent through Mailgun. Mailgun receives the email address and the message that contains the code. An older account may still have a phone number from before SMS sign-in was removed. That number is deleted with the account. An account that only has a phone number can no longer receive a code; email [email protected] and we will delete it.

Cloud sync runs when you are signed in and BuffBox Premium is active. It is not a separate switch. While Premium is active we store the collection so your other devices can restore it:

• cards you own, including the Scryfall id, name, set, collector number, image address, quantity, foil finish, condition, and notes;
• which storage box a card is in, and which deck it is sleeved in;
• your decks, deck entries, folders, tags, and share-link tokens;
• your storage boxes, including any label you type for where a box is kept.

That label is text you write, such as “closet shelf”. It is not a map location. We do not collect GPS data.

If Premium ends, the app stops syncing. Data already stored for the account stays until you delete the account.

Card identification uses Apple’s Vision framework and a catalog stored on the device. Camera frames and photos you select for identification are processed on the device and are never uploaded to us.

Also kept only on the device, unless a feature above says otherwise:

• match life totals and the cards you scan during a match;
• cached card images, prices, and rulings;
• the optional on-device AI model, after you download it from BuffBox, and the searches you run with it;
• NFC tags you write, which contain only a link that opens a deck or box inside the app.

The only images that leave the device are ones you deliberately upload as an avatar, a profile background, or custom sleeve art.

A backup you turn on with Apple, such as an iCloud device backup, can include the local database. That backup is between you and Apple. We do not receive it.

BuffBox asks for a permission only when a feature needs it. You can decline or revoke any of them in system settings. The prompts say:

• Camera: “BuffBox uses the camera to photograph Magic cards. On Mac that includes the built-in camera, USB webcams, and Continuity Camera.”
• Photo library: “Choose a photo of a Magic card to identify it, or pick an avatar and background for your profile.”
• NFC: “BuffBox uses NFC so a tag on a box or deck opens that pile.”

We use the information above to:

• authenticate you and keep you signed in;
• keep your profile and, while Premium is active, sync your collection between your devices;
• deliver the price alerts you create;
• verify your Premium subscription and unlock Premium features;
• translate a Premium search phrase into a card query when you use that feature;
• publish a deck list when you create a share link, and take it down when you revoke the link;
• answer support requests;
• keep the service secure and diagnose failures;
• see which parts of BuffBox people use, from the anonymous counts above; and
• comply with the law.

We do not use your information for advertising, and we do not build advertising profiles.

Each service receives only what it needs for its role.

• Apple handles In-App Purchase billing, delivers push notifications, and provides on-device Vision for card recognition. Vision runs on your device, so Apple does not receive your card images through BuffBox. Purchases are also covered by Apple’s privacy policy.
• Mailgun sends sign-in codes, support replies, and price-alert email. Mailgun receives the destination address and the message.
• Minio holds profile images, the optional on-device AI model files, and images published with a blog post. Profile images and model files are private to TimelyDevs and are not world-readable. Blog images are public.
• Scryfall supplies card names, text, images, set data, and market prices. The app calls Scryfall directly, so Scryfall receives the lookup and your IP address, and the app identifies itself as BuffBox. Scryfall does not receive your BuffBox account.
• OpenAI or Google Gemini receives a Premium search phrase only when you use cloud AI search and that provider is configured. They do not receive your collection.
• Card Kingdom and Cardmarket open only if you tap a buy link. The card name is in the address those sites receive. BuffBox does not send your account to them.

We do not sell your personal information, and we do not share it for anyone else’s marketing.

buffbox.app does not use advertising or analytics cookies. The pages are static. Inter is served by BuffBox from this website, so a page load does not contact Google for the typeface. Your color preference is stored in the browser on your device and is not sent to us. The contact form collects your name, email, organization if you give one, subject, message, and whether the enquiry is for business or compliance. We use that to reply and to keep a record of the request. The form uses Cloudflare Turnstile, which receives the check and your IP address. Staff who sign in receive a strictly necessary session cookie named bb_admin. The BuffBox API sets it, JavaScript on the page cannot read it, and it is removed when the session ends or you sign out.

The newsletter form collects an email address when someone asks to hear from BuffBox. We keep that address only to send marketing from BuffBox. We do not share it, and we do not use it for ads or profiles. Email [email protected] to be removed from the list.

Account records and synced collection data are stored in our application database. Profile images and the on-device model files are stored in Minio and are private to TimelyDevs. Traffic between the app and our API is encrypted in transit. Sign-in tokens stay in the device Keychain.

We keep account and collection data while the account exists. Support messages are kept long enough to handle the request and keep a record of it. The Premium search cache expires after 24 hours. Operational logs are kept briefly and then discarded. No system is perfectly secure.

Our infrastructure runs in the United States. If you use BuffBox from somewhere else, your information is processed in the United States.

• Use BuffBox without an account. Your collection does not reach us.
• Skip Premium. A signed-in account without Premium does not sync the collection.
• Sign out at any time. That clears sign-in tokens, the cached profile, and the push registration on that device. It does not delete the account or data already synced.
• Turn off notifications in system settings, or delete a price alert in the app.
• Turn off anonymous usage with Share anonymous usage in Settings. That stops future reports. It does not delete counts already stored, and it does not delete your account.
• Delete on-device downloads from Settings, including the card-matching catalog and the on-device AI model.
• Revoke a shared deck link in the app. The public page stops working.
• Access, correct, or delete your account. You can edit your profile in the app. Delete the account from Profile in the app, or on buffbox.app/delete. That removes the account, synced cards, decks, boxes, shared deck links, price alerts, push tokens, support messages, sign-in secrets, and profile images. A copy already on a device stays until you delete it in the app or delete the app. We keep an Apple billing record: the original transaction id, product, environment, and expiry, plus the time of deletion. That record has no name, email, or phone. Apple still holds the payment itself. To get a copy of your data, email [email protected]. We will act within 30 days.

Depending on where you live, you may also have the right to know what we hold, to correct or delete it, to receive a portable copy, and to not be treated differently for asking. We honor those requests regardless of where you live. We do not sell personal information or share it for cross-context advertising, so there is nothing of that kind to opt out of.