Privacy Policy

1. Who We Are

CardTrac ("we," "us," or "our") is a sports card inventory and portfolio management platform operated at cardtrac.io. If you have questions about this policy, contact us at hello@cardtrac.io.

2. What We Collect

We collect the following information when you use CardTrac:

• Account information: Your email address when you sign up.
• Card inventory data: Player names, product names, grades, purchase prices, sale prices, grading fees, purchase dates, notes, and any other details you enter for your cards.
• Photos: Card images you upload are stored in our cloud storage.
• Payment information: Subscription billing is handled entirely by Stripe. We never see or store your full credit card number.
• Usage data: Basic information about how you use the app, collected to improve the service.

3. How We Use Your Data

We use your data solely to provide and improve CardTrac:

• Authenticate your account and maintain your session
• Store and display your card inventory and portfolio data
• Calculate your profit/loss and portfolio metrics
• Process subscription payments via Stripe
• Send transactional emails (account confirmation, password reset)
• Improve the product based on usage patterns

We do not use your data for advertising. We do not sell or rent your data to any third party. We do not use your card inventory or financial data to make investment recommendations.

4. Third-Party Services

CardTrac uses the following third-party services to operate:

• Supabase (supabase.com) — Database and file storage. Your card data and photos are stored on Supabase servers located in the United States.
• Stripe (stripe.com) — Payment processing. Stripe handles all billing and stores your payment method. Stripe's privacy policy applies to payment data.
• Netlify (netlify.com) — Website hosting.

5. Data Retention

We retain your account and card data for as long as your account is active. If you cancel your subscription, your data remains accessible. If you delete your account, we permanently delete all associated data within 30 days.

6. Your Rights

You have the right to:

• Access all data we hold about you
• Export your card inventory at any time using the CSV Export feature
• Correct inaccurate data by editing your cards directly in the app
• Delete your account and all associated data by emailing hello@cardtrac.io
• Object to processing of your data where we rely on legitimate interests

If you are located in the European Union, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under CCPA including the right to know what personal information we collect and the right to opt out of sale (note: we do not sell personal information).

7. Security

We take reasonable measures to protect your data including encrypted connections (HTTPS), row-level security on the database ensuring users can only access their own data, and access controls on file storage. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Children

CardTrac is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top and notify users via email if changes are material. Continued use of CardTrac after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions, requests, or concerns:
Email: hello@cardtrac.io
Website: cardtrac.io