Holomint Privacy Policy

Version 1.1 · Effective July 17, 2026

This Privacy Policy explains how Optume Ventures LLC ("Optume," "we," "us") handles information in connection with Holomint at holomint.app and related applications (the "Service").

Holomint is privacy-first by design: your collection, portfolio, tracked cards, cost basis, and settings are stored locally on your own device and are never sent to us. We cannot see them. This policy describes the limited information that is nonetheless involved in operating the Service and in billing for Holomint Pro.

1. The short version

No account required. No login, name, or email is needed to use Holomint's free tier.
Your collection data stays on your device, in your browser's local storage. We do not receive it, store it, or have any ability to read it.
If you subscribe to Pro, a random per-installation identifier is stored with your license key to enforce the device limit (see Section 3). You can view and release your devices in the app.
We do not use advertising, and we do not use cross-site tracking. The only usage metric we keep is an anonymous, aggregated count of whether alerts lead to purchases (see Section 3); it is not tied to you.
We never see your card number. Holomint Pro payments are handled by a third-party payment provider acting as merchant of record.
We do not sell your personal information.
Loading the Service and card images necessarily reveals your device's IP address to our hosting/CDN providers and to third-party image hosts, as with any website.

2. Information stored on your device (not collected by us)

The following is stored in your browser's local storage, on your device only: - your tracked cards, collection, and portfolio; - purchase prices / cost basis you enter; - fee, channel, and currency settings; - cached price and live-drop data; - your Holomint Pro license key, if you have one.

This data is not transmitted to Optume. You can delete it at any time from within Holomint, or by clearing your browser's site data for holomint.app. Because it lives only on your device, we cannot recover it for you if you lose it, so please back it up.

3. Information we or our providers process

Technical/hosting logs. Holomint is delivered via GitHub Pages and Cloudflare. These providers automatically log standard technical data (IP address, browser and device type, timestamps) for delivery, security, and abuse prevention. This is standard for essentially every website. We do not use these logs to build profiles.
Live drops feed. Holomint retrieves publicly available restock/drop information from our Cloudflare-hosted server component. This is a one-way retrieval of public data. We do not send your collection, portfolio, or personal data to that server.
Anonymous product metrics. When you mark whether an alert led to a purchase, we keep an anonymous, aggregated count (for example, how many alerts across all users resulted in a purchase on a given day) to measure whether the product is useful. These counts are not linked to you, your device, your license key, or your identity, and we do not build any individual profile from them. (This is separate from the device-seat identifier described below, which exists only to enforce the Pro device limit.) Your own running total is calculated on your device, not by us.
Pro device seats. If you use Holomint Pro, your subscription may be used on a limited number of devices at a time (see the Terms). To enforce that limit, the app creates a random identifier for that installation (not for you) and sends it to our server alongside your license key. We store that identifier and the date it was last used, associated with your license key. We use it only to count and enforce device seats, and to show you your own devices in the app so you can release one. It is not linked to your browsing, your location, or your collection, and it is not used for advertising, profiling, or analytics. You can release a seat at any time in the app under Settings, Manage devices, which deletes that identifier immediately. Seats not used for 45 days are deleted automatically.
Third-party card data and images. Prices and images are sourced from third parties (including TCGplayer data via TCGcsv). When images load, your browser requests them from third-party servers, which will receive your IP address and standard request data. Their content is governed by their own terms and privacy policies.
Support communications. If you email us, we receive your email address and message, and use them only to respond.

4. Holomint Pro: payment and subscription data

Holomint Pro is a recurring monthly subscription. Payments are processed by Polar (the "Payment Processor"), which acts as the merchant of record. - You provide payment details directly to the Payment Processor. Optume does not collect, receive, or store your full payment card number. - The Payment Processor handles billing, recurring charges, payment security, and applicable sales tax/VAT. - We receive limited order and subscription information, such as: the email address you provide at checkout, confirmation that a purchase or renewal occurred, subscription status (active / cancelled / lapsed), the license key issued to you, and country/region for tax purposes. - We use this to deliver and validate your license, provide support, honor cancellations and refunds, and keep required business and tax records. - The Payment Processor's own privacy policy also applies: https://polar.sh/legal/privacy.

5. Cookies and local storage

Holomint uses your browser's local storage for functional purposes only, to save your collection, settings, and license so the app works. This is necessary/functional storage, not advertising or cross-site tracking, and Holomint does not set advertising or tracking cookies.

Verified: as of this version, Holomint's source contains no analytics, no advertising, no tracking pixels, and no third-party tracking scripts of any kind. (Confirmed by scanning the application source, not merely assumed.)

If any analytics is ever added, including self-hosted or "privacy-friendly" analytics, this policy must be updated before it ships, and users in the EU/UK will likely require a consent mechanism. See COMPLIANCE_MAINTENANCE.md.

6. Third parties we rely on (sub-processors)

When you use Holomint, your browser contacts the following third parties. Each receives, at minimum, your IP address and standard request information. This is inherent to how the web works.

Provider	Purpose	What it receives
GitHub (GitHub Pages)	Website hosting	IP address, request data
Cloudflare	CDN, DNS, and our drops-feed server	IP address, request data

Fonts are self-hosted. The typefaces Holomint uses are served from holomint.app itself. Your IP address is not sent to Google or any font network to render this app.

The card scanner is self-hosted too. The OCR engine, its worker, and its language data are all served from holomint.app. Nothing about the scanner, including the fact that you used it, is sent to any third-party CDN.

The card scanner runs entirely on your device. It uses on-device optical character recognition. Photos and camera frames are never uploaded, transmitted, or sent to us or to any third party. The OCR engine, its worker, and its language data are all served from holomint.app itself, so not even the fact that you used the scanner is shared with a third-party CDN. (If we ever change this, for example by adding a cloud image-recognition service, we will update this policy and tell you before it ships.)

7. Legal bases (EEA/UK users)

Where the GDPR applies, we process the limited data described above on the basis of: contract (to provide and bill for Holomint Pro), legitimate interests (to secure and operate the Service and prevent abuse), and legal obligation (to keep tax and transaction records).

8. Your rights and choices

Because your substantive data lives on your own device, you already have direct control: view, edit, export, or delete it in Holomint at any time.

For the limited data we or our providers hold (support emails, subscription/order records), depending on where you live you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent, for example under the EU/UK GDPR or the California Consumer Privacy Act (CCPA/CPRA). We do not sell or share your personal information for cross-context behavioral advertising. You will not be discriminated against for exercising these rights.

If you are a Holomint Pro subscriber, Polar's customer portal also lets you download a complete export of your personal data, subscriptions, and orders in one click.

To make any other request, email mmmilliard@optumeventures.com. We may need to verify your request (for example, by matching the email used at checkout).

9. Children's privacy

Holomint is a tool for collectors, investors, and sellers and is not directed to children under 13 (or under 16 where that is the applicable age). We do not knowingly collect personal information from children. Because a push subscription is the only thing we store that identifies a device, Holomint asks for your year of birth before enabling alerts and will not register a device for anyone under 13. Every other feature runs entirely on your own device and stores nothing with us. Holomint Pro may only be purchased by adults (18+). If you believe a child has provided us personal information, contact mmmilliard@optumeventures.com and we will delete it.

10. Retention and security

Data on your device persists until you delete it. Nothing below is kept indefinitely, and each item is held only for as long as the purpose it was collected for requires.

Push subscription (needed to send you an alert): until you turn alerts off, until your push provider reports the address as gone, or after seven days if it has never successfully delivered.
Pro device seat (needed to enforce the seat limit): 45 days after that device was last used, immediately when you release it in the app, or when a newer device takes its place.
Acceptance record (proof of which Terms you agreed to, and when): three years from the date recorded, to cover payment dispute and regulatory periods.
Delivery log (why an alert was or was not sent): 24 hours.
Abuse counters (a one-way hash of your IP, used to rate limit): two hours.
Licence sharing counter (how often a key changed devices): 90 days.
Price and lookup caches: 48 hours. These describe cards, not people.

To have your records removed sooner, turn alerts off in the app, which deletes the subscription immediately, and email us to remove any acceptance record. Data held by our providers (hosting logs, subscription and tax records) is retained per their policies and as long as needed for business, security, accounting, and legal purposes. We use HTTPS in transit. No system is perfectly secure; the local-first design substantially limits what is at risk, but we cannot guarantee absolute security.

11. International transfers

We operate from the United States and use providers that process data in the United States and elsewhere. If you use the Service from outside the U.S., the limited technical and billing data described above may be processed in the U.S.

12. Changes to this policy

We may update this policy. Material changes will be reflected in the version and date above and, where appropriate, by additional notice (email and/or in-app).

13. Contact

Optume Ventures LLC Pennsylvania, United States mmmilliard@optumeventures.com