Privacy Policy

Updated on Friday, August 14th, 2026.

BuffBox is made by TimelyDevs ("TimelyDevs", "we", "us"). This policy explains what information the BuffBox app, the BuffBox API, and buffbox.app collect, how we use it, and the choices you have.

The short version

You can use BuffBox without an account. Your collection and decks stay on your device.
Card scanning happens entirely on your device. We never receive photos of your cards.
We do not use analytics, advertising, or tracking software of any kind.
We do not sell or share your personal information.

Using BuffBox without an account

BuffBox works without signing in. In this mode your collection, decks, storage boxes, and scan history are stored only on your device, and we do not receive them. Card lookups still reach Scryfall directly from your device, as described under Third-party services below.

Information we collect

When you create an account

You sign in through Amazon Cognito, our identity provider. We receive from Cognito a unique subject identifier, your email address, and your name if your account has one. We do not receive or store your password.

Profile information you provide

Your display name, gamertag, and any avatar image, profile background image, or custom card sleeve art you upload.

Collection data you choose to sync

If you enable cloud sync, we store the collection you have built so we can restore it on your other devices: the cards you own and their quantities, conditions, finishes, and notes; your decks and deck entries; and your storage boxes, including any label you type for where a box is kept. That label is free text you write yourself, such as "closet shelf". It is not a geographic location and we do not collect GPS data.

Features you actively use

Price alerts. The card, finish, and price threshold for each alert you create.
Push notifications. A device token from Apple so we can deliver price alert notifications. We collect this only after you enable notifications.
Premium AI search. The search phrase you type is sent to our API to be translated into a structured query. Your card images are never sent.
Shared decks. If you publish a deck to a shareable link, we store that deck list so the link can be viewed.
Support requests. The subject and message you submit through the in-app support form, along with the email address on your account so we can reply.

Subscription status

If you subscribe to BuffBox Premium, Apple processes the payment and we receive a signed receipt from Apple confirming that your subscription is active, along with the product you purchased and its renewal or expiration date. We never receive your payment card number, billing address, or other payment details.

Basic technical information

Our servers process the ordinary information required to answer a request, such as your IP address, the request path, and timestamps, and keep short-lived operational logs for security and debugging.

What stays on your device

Card identification runs entirely on your device using Apple's Vision framework and a local image-matching catalog. Camera frames and photos you select for card identification are processed on device and are never uploaded to us. We do not receive, store, or have any way to see them.

The only images that leave your device are ones you deliberately upload as a profile avatar, a profile background, or custom sleeve art.

The optional on-device AI search model is downloaded to your device and runs locally. We do not receive the text you search when you use the on-device model.

What we do not collect

No analytics, product measurement, crash reporting, or session recording software.
No advertising, ad networks, or advertising identifiers, and no cross-app or cross-site tracking. We do not ask for App Tracking Transparency permission because we do not track you.
No precise or approximate geographic location.
No contacts, calendars, microphone recordings, or health and fitness data.
No photos of your cards or your camera roll.

Device permissions

BuffBox asks for a permission only when a feature needs it, and you can decline or revoke any of them in your device settings. The prompts you see say:

Camera: "BuffBox uses the camera to photograph Magic cards. On Mac that includes the built-in camera, USB webcams, and Continuity Camera."
Photo library: "Choose a photo of a Magic card to identify it, or pick an avatar and background for your profile."
NFC: "BuffBox uses NFC so a tag on a box or deck opens that pile."

NFC tags written by BuffBox contain only a link back to a deck or box inside the app.

How we use information

We use the information above to:

authenticate you and keep you signed in;
maintain your profile and sync your collection between your devices;
look up card details and market prices, and send the price alerts you request;
verify your Premium subscription and unlock Premium features;
answer your support requests;
keep the service secure, prevent abuse, and diagnose problems; and
comply with our legal obligations.

We do not use your information for advertising, and we do not build advertising or behavioral profiles.

Third-party services

BuffBox relies on a small number of services. Each receives only what it needs for its role.

Service	Role	What it receives
Apple	In-App Purchase, push notification delivery, on-device Vision framework	Your purchase, handled under Apple's own privacy policy; notification payloads for delivery. Vision runs on your device.
Amazon Web Services (Cognito)	Sign-in and account credentials	Your sign-in credentials and the email address on your account
S3-compatible object storage	Hosting profile images	Avatar, background, and sleeve art images you upload
Scryfall	Card names, text, images, and set data	Requested directly from your device. Scryfall receives the lookup request and your IP address, and BuffBox identifies itself in the request. Scryfall does not receive your account identity.
TCGPlayer	Buy links and Premium market prices	Opening a buy link takes you to TCGPlayer's own site under their policies. Premium price data reaches you through our API, which does not send TCGPlayer your identity.
Hugging Face	Hosting the optional on-device AI model	A download request, only if you choose to download the model

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising.

Storage, security, and retention

Account records and synced collection data are stored in our application database. Profile images are stored in S3-compatible object storage. Traffic between the app and our API is encrypted in transit, and your sign-in tokens are stored in the operating system Keychain on your device.

We keep your account and collection data for as long as your account is active. Support messages are kept as long as needed to resolve your request and keep a record of it. Operational server logs are kept for a short period and then discarded. No system is perfectly secure, so we cannot guarantee absolute security.

Our infrastructure is operated in the United States. If you use BuffBox from outside the United States, your information will be transferred to and processed there.

Your choices and rights

Use BuffBox without an account. Nothing about your collection reaches us.
Sign out at any time. This clears your sign-in tokens, your locally cached profile, and your push notification registration from the device. It does not delete your account or the data you have synced.
Turn off notifications in your device settings, or delete individual price alerts in the app.
Delete on-device data. You can delete the downloaded card-matching catalog and the on-device AI model from Settings inside the app.
Access, correct, or delete your account and data. You can edit your profile in the app. To get a copy of your data or to delete your account and everything synced with it, email [email protected] and we will act on your request within 30 days.

BuffBox does not currently offer a one-tap account deletion button inside the app; email us and we will handle it for you.

Depending on where you live, you may have additional rights, such as the right to know what personal information we hold, to have it corrected or deleted, to receive a portable copy, and to not be discriminated against for exercising those rights. We honor these requests regardless of where you live. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

Children

BuffBox is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

Changes to this policy

We may update this policy. When we make a material change we publish a new version and, the next time you open the app, ask you to review and accept it before continuing to use account features. The version number and effective date at the top of this document tell you which version you are reading.

Contact

TimelyDevs
[email protected]

Magic: The Gathering is a trademark of Wizards of the Coast LLC. BuffBox is unofficial Fan Content permitted under the Fan Content Policy. Not approved/endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast.