Privacy Policy

Last updated: October 1, 2026

1. Information We Collect

We collect information you provide directly and information generated by your use of the app:

• Account information — email address and password (stored securely via Supabase Auth)
• Collection data — cards you add, scan images, pricing history, wishlists, and grading submissions
• Camera usage — photos captured during card scanning are uploaded to process your request and stored in your account; we use them only to provide the Service and, as described in Section 6, to keep a reference photo of the card itself
• Precise location — if you enable the “card shops/shows near me” feature, we collect your device’s precise geolocation (GPS coordinates) to find nearby shops and shows. We collect this only when you use the feature and with your permission, which you can grant or revoke at any time in your device settings.
• Purchase information — subscription tier and scan pack purchases are processed by Apple or Google; we receive only confirmation of your entitlements via RevenueCat, not your payment details
• eBay connection data — if you connect your eBay seller account via OAuth (Collector and Pro tiers), we securely store your eBay OAuth access and refresh tokens in our database. We access your eBay seller identity (username) solely to confirm the connection and create listings on your behalf. We do not store your eBay password or payment details.
• Usage analytics — event data (features used, screens visited) collected via PostHog and associated with your account ID to help us improve the app
• Crash reports — error data collected via Sentry when the app crashes, including device type and OS version, to help us fix bugs
• Email signups — if you submit your email on our website, we store it to send product updates

2. How We Use Your Information

• Provide, operate, and improve The Card Ledger app and services
• Process AI card scanning and pricing requests on your behalf
• Manage your subscription and scan quota
• Send push notifications you have opted into (price alerts, feature updates)
• Respond to support requests
• Detect and prevent fraud or abuse
• Analyze usage patterns, which are linked to your account ID, to improve features

We do not sell your personal information to third parties.

We may disclose your personal information without further notice only in the limited circumstances necessary to operate lawfully: (i) to comply with applicable law, legal process, or enforceable governmental or regulatory requests; (ii) to enforce our terms of service, or to detect, prevent, or address fraud, security, or technical issues; (iii) to protect the rights, property, or safety of our users, the public, or The Card Ledger; and (iv) in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our assets, in which case we will require the recipient to honor the commitments in this policy and will notify you of any resulting change in control or applicable privacy policy.

3. Third-Party Services

We use the following third-party services to operate the app. Each has its own privacy policy:

• Supabase — database, authentication, and file storage (supabase.com/privacy)
• RevenueCat — subscription and in-app purchase management (revenuecat.com/privacy)
• Google Gemini / OpenAI — AI models used to analyze card images and generate pricing; card images and metadata are sent to these services to process your scan requests
• Google Places API — when you use the “card shops/shows near me” feature, we send your precise coordinates to Google’s Places API to retrieve nearby card shops and shows. Google processes this data under its own privacy policy (policies.google.com/privacy).
• SportsCardsPro — to identify a card, we send card details (player, set, card number) to the SportsCardsPro API to retrieve its canonical set, year, and market pricing. No card images or personal information are sent. We cite SportsCardsPro with a linkback wherever their data appears. See SportsCardsPro's Terms.
• PostHog — product analytics linked to your account ID (posthog.com/privacy)
• Sentry — crash and error reporting (sentry.io/privacy)
• eBay — when you connect your eBay account (Collector and Pro tiers), we use eBay's OAuth 2.0 API to authenticate you and create listings on your behalf. Your eBay tokens are stored in our secure database and used only to fulfill listing requests you initiate in the app. See eBay's Privacy Notice.
• Apple / Google — in-app purchases and push notifications are handled through their respective platforms
• Affiliate partners — some links to external marketplaces (Amazon, eBay, TCGPlayer, and grading services) are affiliate links provided through programs such as the Amazon Associates Program, eBay Partner Network, and Impact. When you click these links, the partner may set cookies or receive a referral identifier to attribute any resulting purchase to us.

Affiliate disclosure. The Card Ledger participates in affiliate programs. Some links in the app and on this website are affiliate links, meaning we may earn a commission if you make a purchase through them — at no additional cost to you. As an Amazon Associate, The Card Ledger earns from qualifying purchases. Affiliate relationships never influence the market values, comparable sales, or pricing data we show you; those are derived from real sold-listing data independently of any commission.

4. Cookies and Tracking Technologies

On our website and within the app, we and our partners use cookies, SDKs, and similar technologies to keep you signed in, remember your preferences, measure product usage through PostHog, and, for affiliate links, attribute qualifying purchases to us through a referral identifier or partner-set cookie. These technologies are limited to the purposes described in this policy. You can control cookies through your browser or device settings, opt out of non-essential analytics where offered, and manage app permissions (such as camera and notifications) at any time in your device settings. Some browsers offer a "Do Not Track" signal; because there is no common industry standard for how to respond to it, we do not currently take action in response to Do Not Track signals, but we honor recognized opt-out preference signals as described in Section 10.

5. eBay Integration

Collector and Pro subscribers may connect their eBay seller account to The Card Ledger to create listings directly from the app. When you connect your eBay account:

• We initiate an OAuth 2.0 authentication flow with eBay. You log in directly on eBay's website — we never see or store your eBay password.
• Upon successful authentication, eBay grants us access and refresh tokens, which are stored securely in our database, encrypted at rest.
• We use these tokens only to perform actions you explicitly request within the app (creating listings, checking connection status).
• We access limited eBay seller data — your eBay username and business policies — used solely to configure and create listings.
• You may disconnect your eBay account at any time from within the app. Disconnecting revokes our access and removes your tokens from our database.
• If you close your eBay account, eBay notifies us via a secure webhook and we automatically delete your stored tokens.

We do not share your eBay tokens or seller data with any third party other than eBay's own API services.

6. Data Retention

We retain your account and collection data for as long as your account is active. You may delete your account at any time from the app (Profile → Settings → Delete Account), which permanently removes all your data from our systems within 30 days.

Crash reports are retained for up to 90 days. Usage analytics associated with your account ID are retained for the life of your account and deleted when you delete your account; aggregated usage data that no longer identifies you may be retained for longer.

We keep de-identified card information after you delete a card or your account: a card's identity (such as player, year, set, card number, parallel and grade), its market prices and price history, and corrections to how the app identified it. It does not include anything personal, is not linked to you or your account, and is used only to improve card identification and pricing. We may also keep one photo of the front and back of the card itself, stored separately from your account and not linked to you, to help identify the same card in future scans. A reference photo carries no location, device or date information.

7. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data
• Portability — request your collection data in a portable format
• Opt-out — opt out of marketing emails at any time via the unsubscribe link

To exercise any of these rights, contact us at contact@thecardledgerapp.com. If we decline your request, you may appeal that decision by replying to our response; we will inform you in writing of the outcome of the appeal and, where applicable, of how to lodge a complaint with your data-protection authority.

8. Children's Privacy

The Card Ledger is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. We do not knowingly process the personal information of any user under 18 for targeted advertising or for sale.

9. Your Rights in the EEA, UK & Switzerland (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, The Card Ledger, operated by The Card Ledger LLC, a Texas limited liability company, is the data controller of your personal data. Our legal bases for processing are:

• Performance of a contract — to provide the core features you request (account, collection, scanning, pricing).
• Legitimate interests — to operate, secure, and improve the Service (e.g. crash reporting, abuse prevention), balanced against your rights.
• Consent — for optional marketing emails, which you may withdraw at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

In addition to the rights in Section 7, you may restrict or object to processing, withdraw consent at any time, and lodge a complaint with your local data-protection authority. We do not carry out automated decision-making that produces legal effects concerning you.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights.

We do not sell or share your personal information (as "sell" and "share" are defined under the CCPA/CPRA), and we do not use sensitive personal information beyond providing the Service. Your precise geolocation is “sensitive personal information” under the CPRA; we collect and use it only to provide the “card shops/shows near me” feature when you enable it, and not for any other purpose, so no right to limit its use applies beyond that. Because we do not sell or share personal information, there is nothing to opt out of; however, where your browser or device sends a recognized opt-out preference signal (such as Global Privacy Control), we treat it as a valid request and will not sell or share your personal information. The categories we collect (identifiers such as your email; commercial information such as your collection and purchases; photos you upload; precise geolocation when you use the nearby-shops feature; and usage/device data) are described in Section 1 and used for the purposes in Section 2.

To exercise your California rights, contact us at contact@thecardledgerapp.com. You may use an authorized agent to submit a request on your behalf.

11. International Data Transfers

We operate from the United States, and our service providers (including Supabase, Google, and RevenueCat) may process and store your data in the United States and other countries. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum to those clauses, as applicable. By using the Service, you understand your data may be processed in countries whose data-protection laws differ from those where you live.

12. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), row-level security on our database, and secure credential management. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach that compromises your personal data, we will notify you and the relevant supervisory or regulatory authorities without undue delay as required by applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, where appropriate, by sending an in-app notification. Where a change materially affects your rights or how we use personal data we previously collected, we will provide prominent notice and, where required by law, obtain your consent before applying the change to that data. Your continued use of the app after a change takes effect constitutes acceptance of the updated policy to the extent permitted by law.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: contact@thecardledgerapp.com
• Website: thecardledgerapp.com