LoreboxPrivacy Policy
Effective date: June 16, 2026 • Last updated: June 16, 2026
Summary: Your collection lives on your own computer. Lorebox has no servers and collects no analytics. Card images and card names are sent to third-party services only to identify and price cards, using API keys you supply. We do not sell or share your data.
1. Information stored on your device
All of the following is stored locally on your computer (under %APPDATA%\Lorebox)
and is never transmitted to the developer:
- Collection data — card names, sets, numbers, grades, condition scores, estimated values, purchase prices, quantities, and notes.
- Card scan images — the front/back images you scan or import.
- Settings — your preferences, including watch-folder configuration.
- API keys — your Anthropic and eBay credentials, stored encrypted.
- Security data — any master password is stored only as a salted PBKDF2-SHA256 hash; any two-factor secret is encrypted; recovery codes are hashed. None are reversible.
2. Information sent to third parties
Lorebox sends data to these services only to identify and value cards, and only when you use those features. Because you provide your own API keys, this activity occurs under your own accounts and is governed by their privacy policies.
| Service | What is sent | Purpose |
|---|---|---|
| Anthropic (Claude API) | Images of your cards | Identify name, set, number, year, game |
| eBay (Browse API) | Card name / keywords | Current market prices |
| Scryfall | Card name (Magic cards) | Magic: The Gathering prices |
Anthropic states that inputs submitted through its API are not used to train its models. No payment information, account credentials, or personal identifiers are sent to these services by Lorebox — only card images and card names.
3. Biometric authentication (Windows Hello)
If you enable Windows Hello sign-in, your fingerprint/face data is handled entirely by Windows and never leaves your device. Lorebox only receives a success/failure result and never sees or stores biometric data.
4. Analytics and tracking
Lorebox contains no analytics, telemetry, advertising, or tracking. The developer collects no usage data and operates no server that receives your information.
5. Data sharing and sale
We do not sell, rent, or share your data. The only outbound data is the card images and card names you send to the third-party services above.
6. Children's privacy & parental involvement
Lorebox is not directed to children under 13 and does not knowingly collect personal information from them. Because the app stores a collection locally and opens without a login by default, we encourage a parent or guardian to be involved when the collector is under 16 — setting up the app alongside them and approving its use without a login. A one-time notice to this effect is shown on first launch.
7. Estimates are not guarantees
Estimated values and condition grades are automated and approximate. They are not guaranteed sale prices, professional appraisals, or a substitute for a professional grading service, and should not be relied upon for buying, selling, or insurance decisions.
8. Your choices and control
- Use Lorebox without API keys — identification and valuation are simply disabled.
- Remove or change your API keys at any time in Settings.
- Delete individual cards, or your entire local database, from within the app.
- Uninstalling and deleting
%APPDATA%\Loreboxremoves all local data.
9. Changes to this policy
We may update this policy as the app evolves; material changes update the "Last updated" date above.
10. Contact
Questions about this policy? Contact us at contact@loreboxapp.dev.
Lorebox is an independent application and is not affiliated with, endorsed by, or sponsored by Anthropic, eBay, Scryfall, The Topps Company, Wizards of the Coast, or any trading card manufacturer.