Privacy Policy
Last updated: October 9, 2026
At Popfolio, we take your privacy seriously.
This policy explains what information is processed when you use the Popfolio app or visit our website, why it is used and how you can exercise your rights.
Popfolio is operated by One More Pixel, located at Avenue des Pléiades 53, box 7, 1200 Brussels, Belgium, and can be contacted at contact@numinam.com.
1. Who is responsible for your data
The data controller is One More Pixel (SComm), registered under number 0666.475.419, whose registered office is at Avenue des Pléiades 53, box 7, 1200 Brussels, Belgium.
For any question about this policy or your data, write to contact@numinam.com.
2. What information we process
Without an account
You can browse the catalog, look at the demo collection and use the scanner without signing in. In that case, what Popfolio keeps stays on your phone: the catalog database, your settings (language, theme, price market) and the demo collection. We receive no information about you, apart from the technical data described in section 2.7.
Your account
Adding Pops to a collection requires an account. Popfolio has no passwords: you sign in with Apple (on iPhone and iPad) or Google.
- Sign in with Apple gives us a unique identifier, an email address and, if you choose to share it, your name. If you choose “Hide My Email”, we only receive a private relay address created by Apple.
- Google Sign-In gives us a unique identifier, your email address, and the name and profile picture of your Google account.
This information is stored by our authentication service and shown to you in the app’s settings.
Your collection
Once you are signed in, your collection is stored on your phone and synchronized to our servers, so that it is backed up and available on your other devices. For each Pop, this includes:
- the catalog reference, name, number and series;
- the price you paid, whether it was a gift, the box condition and the purchase date;
- your personal note and the set it belongs to;
- your wishlist and your sets;
- the app version and the dates of the last synchronization.
Your collection is only accessible to your account. We also use collections in aggregate, without identifying anyone, to know which Pops are owned or wanted and to prioritize market checks and catalog improvements. When you are signed in, the app also reports which catalog entries are viewed; these counts are stored without any link to your account.
Your photos
You can photograph your Pops. Photos are compressed on your phone (WebP format, 3 MB maximum) and stored on our servers.
Each photo is stored at an unlisted public address: it is not listed or searchable anywhere, but anyone who has the exact link can view it. This address contains the technical identifier of your account, not your name or email.
Your contributions to the catalog
You can complete the shared catalog: add a photo, a barcode or a box number, propose a Pop that is missing, support someone else’s proposal, or confirm a contribution. Each contribution is linked to your account, to prevent abuse and to count confirmations.
- Collectors asked to confirm a contribution see its content (the photo, barcode or number), never your name or email.
- A contribution joins the shared catalog once it has been confirmed by other collectors who own the same Pop, and approved. It is then visible to all users. Approved photos are copied into the catalog without any link to your account.
Prices you report
If you share a Vinted listing with Popfolio and enter its price, we store that price, your account identifier and an irreversible fingerprint of the listing number. We do not keep the listing’s address or title.
Technical data
- Our servers receive your IP address and technical information about each request (date, time, type of request). These logs are kept for 30 days.
- App updates: Popfolio downloads its updates from Expo’s servers (EAS Update), which receive your IP address and your app and device versions.
- Catalog images: some images are loaded directly from funko.com, or through the image proxy images.weserv.nl. These services receive your IP address.
- Camera and text recognition: the barcode and the box number are read on your phone, by Apple Vision on iOS and Google ML Kit on Android. The camera image is not sent to us; only the photos you choose to save are. Google may collect usage metrics about ML Kit itself, under its own terms.
What we do not do
Popfolio contains no advertising, no advertising tracker, no analytics tool and no crash-reporting tool. We do not sell your data.
Purchases and Popfolio+
Popfolio+ is not on sale yet. This section will be completed before it launches, with the purchase information we receive and the providers involved.
Our website
This website is hosted by Vercel. It sets no cookies and uses no analytics. Vercel processes your IP address in its logs to deliver the pages and protect the site.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provide the app, your account, the backup and synchronization of your collection | Performance of the contract (these terms) |
| Store your photos and process your contributions | Performance of the contract |
| Moderate the shared catalog and prevent abuse | Legitimate interest: keeping the catalog reliable |
| Use collections and views in aggregate to prioritize market checks | Legitimate interest: improving the service |
| Keep server logs and secure the service | Legitimate interest: security |
| Answer your support requests | Performance of the contract, or legitimate interest |
| Comply with the law | Legal obligation |
Access to the camera and to your photo library relies on the permissions you grant in your phone’s settings. You can withdraw them at any time.
4. Who we share it with
We share data only with the service providers needed to run Popfolio, and never for advertising.
| Provider | Role | Data concerned |
|---|---|---|
| OVHcloud | Hosting of our database, authentication and files (self-managed Supabase) | Account, collection, photos, contributions, logs |
| Apple | Sign in with Apple, App Store distribution | Sign-in identifiers |
| Google Sign-In, Google Play distribution, ML Kit | Sign-in identifiers, usage metrics | |
| Expo (650 Industries, Inc.) | App updates (EAS Update) | IP address, app and device versions |
| Funko, images.weserv.nl | Display of catalog images | IP address |
| Vercel Inc. | Website hosting | IP address |
Market values are computed from public eBay listing data. No personal data is sent to eBay.
5. How long we keep it
- Account, collection, photos: until you delete your account.
- Contributions and confirmations: deleted with your account. Content already approved in the shared catalog stays, without any link to you.
- Proposals of new Pops: the proposal stays in the catalog, but your name is removed from it.
- Aggregated view counts: kept, as they identify no one.
- Server logs: 30 days.
- Support emails: 3 years after the last exchange.
6. International transfers
Our servers are located in France. Apple, Google, Expo and Vercel are based in the United States. When these providers process data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework for certified providers and, failing that, the European Commission’s standard contractual clauses.
7. Security
All exchanges between the app and our servers are encrypted (HTTPS). Database rules restrict access to your collection to your account alone. Popfolio stores no password, since you sign in with Apple or Google. Photos are stored at addresses that cannot be guessed.
No system is perfectly secure. If a breach affects your data, we will inform you and the competent authority as required by law.
8. Your rights
Under the GDPR, you can:
- access your data and get a copy of it;
- correct it;
- delete it;
- object to its processing, or ask for it to be restricted;
- receive it in a structured format, to move it elsewhere (portability).
To exercise these rights, write to contact@numinam.com from the email address of your account. We answer within one month.
You can also lodge a complaint with a data protection authority, in particular the Belgian Data Protection Authority (APD), or the CNIL if you live in France.
Popfolio is not intended for children under 16 years old.
9. Deleting your account
You can delete your account at any time in the app: Settings → Account → Delete my account. The account deletion page details what is deleted and what is kept.
10. Changes to this policy
We may update this policy when the app changes. The date at the top of the page shows the current version. If a change significantly affects how your data is used, we will tell you in the app.
11. Contact
One More Pixel, Avenue des Pléiades 53, box 7, 1200 Brussels, Belgium. Email: contact@numinam.com.