Privacy Policy

Effective date: October 23, 2026 · Provided by Silicon Scaffolding LLC ("we," "us," "our") · Applies to the Chaos Cache app (desktop and Android) and the website at chaoscache.com.

The short version: your card collection lives on your computer, not with us. We don't have accounts, we don't track you, and we don't sell anything about you. The app only talks to the internet to fetch card data, and (if you buy the unlock) to check your license key.

Part 1: In Plain Language

📦 Your collection is yours, and it stays on your computer

Your cards, decks, boxes, card scans and notes are stored in files on your own computer. We have no copy of them and no server that holds them. There's nothing for us to lose, sell, or hand over, because we don't have it.

🔢 There's no account

You don't sign up or give us an email to use the app. A PIN keeps collections apart on a shared computer: each PIN opens its own collection, a PIN nobody has used yet opens an empty one, and signing in never shows a list of whose collections exist (recovery, below, deliberately does). There's also a no-PIN household collection. A PIN is a way to keep things separate, not encryption, so anyone who can open the files on your computer could read them. Forgot your PIN? The lock screen can show the collections on that computer (described by what's in them, like "2,410 cards · Box 2") so you can pick yours and give it a new PIN. That means anyone at your computer could do the same, which is the trade we chose for cardboard. You can also write your PIN into a backup, so the backup doubles as a spare key.

👀 We don't track you

No analytics, no advertising trackers, no "usage statistics" sent home. The counts, prices and combos the app shows you are worked out on your computer.

🌐 The few times the app uses the internet

Card data and prices come from Scryfall, and combos from Commander Spellbook. The app downloads their public lists. Your collection is never sent to them, but like any website, they see your internet address when you download.
If you buy the unlock, the purchase happens on a checkout page run by our payment provider, Lemon Squeezy. They handle your payment details; we never see your card number. We receive what they give sellers: your email, your name and the order. When you activate the key, the app sends Lemon Squeezy your license key and your computer's name (like "Chaos Cache on DESKTOP-123"), so you can tell your activations apart. About every three months it quietly re-checks the key. If it can't reach them, nothing breaks.
Links you click (a card page, a price site) open in your own browser, and those sites have their own policies.

📱 The phone app

When the phone reads a card with the camera, the reading happens on the phone. The photo isn't sent anywhere. When your phone syncs with your desktop, it talks directly to your own computer, over your home Wi-Fi or a private network you set up (like Tailscale). It doesn't go through us.

🤖 Connecting an AI

If you connect an AI to your collection through the app's MCP socket, the AI you connect can read what you let it read, and that company's privacy policy then applies to what it sees. That's your choice to make, and nothing is connected unless you set it up.

🌐 This website

chaoscache.com sets no tracking cookies, runs no analytics, and loads nothing from other companies (even the fonts are hosted here). The site is delivered through Cloudflare, and like any web server ours keeps ordinary access logs (internet address, time, page) for security. We don't use them to identify anyone.

🧹 You're in control

You can look at, change, export or delete everything in the app, any time, without asking us. Uninstalling the app and deleting its folder removes your data from your computer.

💌 Questions

Write to ace@sentientsystems.live. A real one of us answers.

Part 2: The Formal Version

1. Scope

This Privacy Policy describes how Silicon Scaffolding LLC ("Company") handles information in connection with the Chaos Cache software application for desktop and Android ("App") and the website located at chaoscache.com ("Site," and together with the App, the "Services"). By using the Services you acknowledge this Policy.

2. No Account; No Personal Information Collected Through Use of the App

The App does not require or provide account registration. Local collections are separated by a user-selected PIN, each PIN corresponding to a distinct local collection; normal sign-in does not enumerate existing collections (the recovery function described below deliberately does), and an unused PIN opens an empty collection. A PIN-free household collection is also available. PIN separation is an access convenience and does not constitute encryption of local files. The App provides a local PIN-recovery function that lists the non-empty collections on the device by summary content (such as card counts and storage locations) and permits a user at that device to assign a new PIN to a selected collection; any person with access to the device can use this function. At the user's option, a PIN may also be written into a backup file the user creates. These functions operate entirely on the user's device; the PIN is not transmitted to the Company. Except as described in Section 5(b), the Company does not collect personally identifiable information through use of the App.

3. Local-Only Data Storage

All user-entered and user-generated content, including collection records, card scans and images, decks, locations and notes ("User Data"), is stored locally on the user's device in local databases and files. The Company operates no server, database, or cloud service that receives, stores, or processes User Data, and has no technical ability to access it.

4. No Analytics, Tracking, or Advertising

The App contains no third-party analytics, advertising identifiers, behavioral trackers, or telemetry that transmits usage data to the Company. Computed values (including prices, totals, and combination results) are generated locally.

5. Limited Network Communications

The App initiates outbound network requests only as follows:

(a) Public card and combination data. The App retrieves publicly available card, price, and set data from Scryfall (api.scryfall.com) and combination data from Commander Spellbook (json.commanderspellbook.com). No User Data is transmitted. Those providers may process the requesting IP address and request metadata under their own policies.

(b) License purchase and validation. Optional paid features are purchased through a checkout operated by Lemon Squeezy, which acts as the merchant and processes payment information under its own terms and privacy policy. The Company does not receive payment-card details; it receives order information that Lemon Squeezy provides to sellers, which may include the purchaser's name, email address, and order details. Upon license activation, the App transmits the license key and an instance label derived from the device's computer name to Lemon Squeezy (api.lemonsqueezy.com). Thereafter, the App may periodically (approximately every ninety days) transmit the license key and activation instance identifier to validate the license. Validation failures caused by network unavailability do not affect User Data.

(c) User-initiated links. External links selected by the user open in the user's own browser and are governed by the destination's policies.

(d) Device-to-device communication. The Android App reads card images locally on the device. Synchronization between the Android App and the user's desktop App occurs directly between the user's own devices over a local or user-configured private network, authenticated by a pairing secret; it is not routed through any Company-operated server.

(e) Optional AI integration. If the user connects an AI client to the App's local Model Context Protocol (MCP) interface, the connected client may access User Data as permitted by the user. Data accessed by such a client is subject to the terms and privacy policy of that client's provider. No such connection exists unless established by the user.

6. Site (Website) Data

The Site is a static informational site. It sets no tracking cookies, uses no advertising or analytics services, and loads no third-party scripts or fonts. The Site is delivered through Cloudflare, Inc., which processes requests to provide content delivery and security. The Company's web server may keep standard access logs (IP address, timestamp, requested resource, user-agent) for operational, security, and abuse-prevention purposes, which are not used to identify or profile individuals and are retained only as operationally necessary. Downloads through app stores are governed by the applicable store's terms and privacy policy.

7. Children

The Services are not directed to children under 13, and the Company does not knowingly collect personal information from children under 13. Purchases require a person of legal age to contract.

8. User Controls

Because User Data resides on the user's device, the user may at any time, without request to the Company, access, modify, export, or permanently delete it. Requests concerning purchase information held by the Company may be sent to the contact below.

9. Security

The Company designs the Services to minimize data transmission. The user is responsible for the security of the user's device and files. No method of storage or transmission is completely secure.

10. Changes

The Company may update this Policy. Material changes will be reflected by an updated effective date and, where practicable, noted within the Services.

11. Contact

Questions regarding this Policy may be directed to ace@sentientsystems.live (Silicon Scaffolding LLC).