Privacy policy
Last updated October 20, 2026. Operated by Forge Technologies, LLC ("we").
Short version
Grimoire keeps a ledger of the Magic cards you own. Without signing in, everything stays on your device. If you sign in, your collection and the card photos you take sync to our server so your own devices share them. We do not sell, rent or share your data, show ads, or track you across apps or sites.
What we collect, and why
- Google sign-in (only if you sign in): your verified email address and name from Google, to identify your account and match it against the invite list. We receive an identity token from Google; we never see your Google password and do not access your Gmail, contacts or files.
- Your collection: the cards you add, where you keep them, decks, counts and their history, so your devices stay in sync.
- Card photos: the photo the scanner takes of each card you add, as proof of the copy you hold. Photos are taken only of cards you scan and are only uploaded once the card is in your collection. They contain no location data.
- Device information: a random identifier for each installed app or browser, so the server can order changes from your devices.
- Server logs: the web server records IP addresses and request times for security and troubleshooting, kept for up to 14 days.
What stays on your device
Camera frames and text recognition run on your device; no camera frame leaves it. Without signing in, nothing is sent to us at all.
Other services the app talks to
- Scryfall (scryfall.com): the app downloads the card catalog, prices and card images from Scryfall. Your device contacts Scryfall directly, so Scryfall sees your IP address. We send Scryfall nothing about you.
- Google: for sign-in only, under Google's own privacy policy.
- Hosting: our server runs on a virtual machine rented from Vultr; encrypted backups may be stored with an object-storage provider.
How it is protected
All traffic uses TLS. Each account's data is stored in its own encrypted database, and photos are encrypted with that account's key. Access to your collection is limited to you and to people you explicitly share it with (read-only).
Keeping and deleting your data
We keep your account data while your account exists. You can export your collection at any time from the app. To delete your account and everything stored for it, use the delete option in the app or email support@forge.tech; we destroy the account's encryption key and files within 30 days, which makes any backup copies unreadable.
Children
Grimoire is not directed at children under 13, and we do not knowingly collect their data.
Changes
We will post changes here and update the date above; significant changes will be shown in the app.