Privacy Policy

• Account details: your email address and sign-in method (email/password or Google, GitHub or Discord sign-in), handled by Supabase Auth.
• Your collection: the cards and sets you add, quantities, condition, purchase prices you enter, decks, wishlist, price alerts, notification settings, and the history we record from them (for example value snapshots).
• Profile content you choose to add, such as an avatar or cover image.
• Billing records: Stripe customer and subscription identifiers, plan, status and renewal dates. We do not receive or store your full card number.
• Photos you scan (Pro): the image is sent to an AI provider to recognise cards or LEGO boxes. We do not save scan photos to our own file storage. We do keep the scan results you confirm and a usage count so the scan allowance can be enforced.
• Deck text: when you ask for AI deck suggestions, the deck list is sent to an AI provider.
• Support messages you send us by email.

Diagnostics and usage analytics (such as errors, performance, which features are used and page navigation) are optional and are sent only if you accept them in the consent banner. Your choice is stored in your browser under the key cardworth_telemetry_consent_v2. If you decline, optional analytics are not sent, and you can change your mind later. These events do not include your collection contents or payment details.

Some data is needed to run the service and is not optional: sign-in sessions, security and rate-limit records, billing events and fulfilment, and error handling on the server. We also set a short-lived first-party cookie to remember where you were going if you were asked to sign in, and, when you arrive from a campaign link, a first-party cookie that records the campaign (source, medium, campaign) so we can tell which links lead to sign-ups. The site also uses Vercel Speed Insights for page-performance metrics.

We use these providers to run CardWorth:

• Supabase: database, authentication and file storage (including stored PDF reports).
• Vercel: hosting and performance metrics.
• Stripe: payments and subscriptions.
• Anthropic and OpenAI: AI processing of scan photos (Anthropic) and deck text (OpenAI).
• Resend: win-back email. Price-alert email is sent through a separately configured email (SMTP) provider. (Owner: name that provider here.)
• Microsoft Azure Content Safety: automated moderation of avatar and cover image uploads.
• Price and catalog data sources: pokemontcg.io (with TCGplayer market data), BrickLink, Rebrickable and image/logo hosts. We send them catalog lookups, not your personal data.

Provider terms and retention settings apply to the data they process. (Owner: confirm each provider’s data-retention and training settings and update this list when providers change.)

• Collection and account data is kept while your account exists, or until you delete it as described below.
• PDF inventory reports are stored temporarily and removed automatically after 7 days.
• Billing records are kept as long as needed for accounting and to handle disputes.
• Server logs and security records are kept for a limited time for reliability and abuse prevention. (Owner: state the exact period.)

These are different things:

• Delete All Data (in Settings) permanently removes your holdings, decks' cards, personal price estimates, value snapshots, ownership history, import history and stored reports. It does not delete your account or profile, your subscription or entitlement, sharing links or notification settings.
• Closing your account is handled by request. The Delete Account button in Settings removes your collection data and cancels your subscription, but it does not by itself erase your sign-in record or billing records. To have the account closed, email support@cardworth.app from the address on your account. Some billing records may be kept as described above.
• Export your data: CSV and JSON exports are free, including after you cancel.

A collection is private unless you create a share link. Anyone with the link can see the summary that page shows, and you can turn the link off in the share settings. Values are estimates, not guaranteed sale prices, and each shows when it was last updated.

You can change diagnostics consent in the app, export your data, delete your collection data, and ask us to correct or delete your account information. Email support@cardworth.app. We aim to reply within a few business days. (Owner: confirm the response time and any region-specific rights language before publication.)

CardWorth is not intended for children under 13 and we do not knowingly collect their data.

When this policy changes we update the version and date above. See also the terms of service and the support page.