Tomebound legal

Account data

Sign-in is handled by Clerk. When you create or use an account, Tomebound receives the account identity Clerk provides, including your email address and authentication identifiers needed to connect your browser to your collection.

Collection data

Your collection data is stored with Cloudflare services, including D1 for sync data, R2 for snapshots and backups, and KV for share links and recovery. Cloudflare may process this data in US regions and on its global edge network so the app can sync and serve data reliably.

Connected apps and AI agents

When you connect an app or AI agent through Tomebound's MCP server, you direct Tomebound to share data from your account with that client. Read access (collection.read) lets it retrieve collection records, quantities, printings, locations, notes, tags, decks, history, and collection estimates through the available tools. Write access (collection.write) additionally lets it change your inventory, decks, and containers, or undo and restore changes. Access is limited to your account. OAuth defaults to read access; the client must explicitly request write access and you must approve it on Tomebound's consent page.

Results are sent to the platform you choose, such as OpenAI, Anthropic, Meta, or another agent provider. That platform's privacy policy, retention rules, and your settings with it govern its copies of the data, including any use for model training. Tomebound does not sell your data or use it to train AI models.

To stop an OAuth connection, open Settings → Connected apps in Tomebound and choose Revoke. This invalidates the connection's access and refresh tokens and removes its remembered approval. Revoke personal access tokens separately in Settings → Access tokens. Revoking access does not erase your collection or data already received by the other platform; request deletion of those copies from that platform.

Hosted chat and service providers

Tomebound's in-app chat sends your messages and the collection details needed to answer them to its AI provider. The configured hosted provider is Cloudflare Workers AI, running OpenAI's open-weight gpt-oss-120b model on Cloudflare. This route does not send those requests to OpenAI's API. The chat service also supports Groq, OpenAI, and Anthropic when enabled by the operator or used with a caller-supplied provider key; in those cases, that provider receives the messages and tool results.

Clerk provides authentication. Cloudflare hosts the app, API, collection storage, backups, and Workers AI. PostHog provides product analytics and session replay, as described below. Scryfall supplies card information, imagery, and pricing data; card lookups can send card names, identifiers, or search terms, and direct image requests expose normal connection information such as an IP address. Scryfall is a card data source, not an account or collection storage provider.

Retention and connected data

Tomebound keeps your account and saved collection to provide the service until you request deletion. Older scheduled backups are kept for 90 days; the latest verified backup is retained even if your collection has not changed for longer. MCP recovery snapshots expire after 30 days and may be pruned earlier according to the recovery policy. Revoking a connection does not delete collection history or recovery points.

OAuth access tokens expire after one hour. Refresh tokens expire after 30 days without rotation, and an OAuth grant expires 90 days after approval. Personal access tokens last until their selected expiry or revocation. These access limits do not determine how long an external AI platform keeps its conversations or tool results. Contact us below for account or data deletion requests.

Ads, sale, and analytics

Tomebound does not sell your data or run third-party ads. It uses PostHog Cloud US for anonymous product analytics so the site owner can understand which features are used and where the interface is confusing. Analytics requests are routed through the first-party domain t.bensonperry.com before PostHog processes them.

Analytics can include page views, button and link clicks, and browser and device details. The signed-in account surface is excluded from click capture. While analytics is on, Tomebound also records session replays of what the page shows and where you click, scroll, and type. Password fields and the sign-in and account areas are left out of replays. Analytics keeps the domain of the site that linked you to Tomebound and a link's utm_source tag, but not the full referring address or other campaign tags. Query strings are removed from captured URLs; console logs, network bodies, and performance capture are disabled. While analytics is on, a page error sends a short error report: the error's type, a trimmed message with URL query strings removed, and the file it came from. Tomebound does not send your Clerk account identity or email to PostHog and does not create a PostHog person profile.

This collection is on by default for the US service. You can turn analytics off for the current browser in Settings, which also stops session replay. Tomebound also honors supported Global Privacy Control and Do Not Track browser signals, and keeps analytics off when the browser blocks site data for Tomebound. PostHog stores its browser state in local storage rather than setting an analytics cookie. See PostHog's privacy notice for information about its processing.

Export and deletion

You can export your collection from the app; the help guide describes the export data workflow. You can permanently delete your account and its data from Settings → Delete account. Alternatively, email [email protected] with the account email you want deleted. A single pre-deletion safety backup is kept for 7 days and then deleted automatically.

Service terms

Tomebound is provided as-is, without warranty. It may change, break, lose availability, or produce incorrect estimates.

You retain ownership of your collection data. Tomebound needs permission to store, process, sync, back up, and display that data so the service can work.

Do not abuse the service, attack the app or its infrastructure, attempt to access another person's data, or use Tomebound for unlawful activity. Accounts may be suspended or removed for abuse.