Privacy Policy

1. What we collect

Information you give us:

• Account details: your email address, name, username and password. Passwords are handled by our authentication provider and we never see them in plain text. If you sign in with Google, we receive your name and email address from Google.
• Card photos you upload, front and back.
• Card details you enter or confirm: player, year, set, card number, parallel, serial number, grade and certification number.
• Collection records: when cards were added, and if you record them, sales (price, listing link, notes) and trades.
• Messages you send us.

Information collected automatically:

• Technical data: your IP address, browser type and the pages and API routes you request, recorded in server logs and used for security and rate limiting.
• Usage statistics, for every visitor: Umami, an open-source analytics tool we run on our own server, counts each page you visit. It records the page, the site that sent you there, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city), worked out from your IP address. It sets no cookies, stores nothing on your device, doesn't keep your IP address, and isn't linked to your account.
• Sign-in data: when you signed up and last signed in.
• On your device: your browser's local storage keeps your sign-in session and small preferences (for example, gallery layout and whether you've seen the welcome tour), and your answer to the analytics question below. None of these are advertising cookies, and we never use cookies to advertise to you.
• Analytics, only if you agree: if you choose “Allow” when we ask, Google Analytics sets cookies (named _ga) and records which pages you visit, roughly where you are in the world from your IP address, and what browser and device you use. If you choose “No thanks”, or if your browser sends a Global Privacy Control signal, Google Analytics isn't loaded and no analytics cookie is set. You can change your mind at any time on the Privacy Policy page, and turning it off deletes the cookies it set.

2. Photo metadata, including location

Photos taken on a phone often contain hidden information (EXIF metadata), which can include the date, the device, and the GPS location where the photo was taken. We remove this metadata from every photo as soon as you upload it, before the photo is stored or sent to any of our service providers, so the location where you took it is never kept, shown or shared. Photos uploaded before we introduced this have been cleaned the same way.

The one thing we keep is the photo's colour profile, which tells a screen how to display its colours accurately. It contains nothing about you or where the photo was taken.

3. How we use it, and our legal bases

If you're in the UK or EU, data protection law requires us to tell you the legal basis for each use:

• To provide the Service: running your account, storing and showing your collection, identifying cards from photos, reading serial and certification numbers, and estimating values. Basis: performing our contract with you (these Terms).
• To show your Stack to others according to the visibility you choose. Basis: our contract with you, and your choice of setting, which you can change at any time.
• To keep the Service secure and working: preventing abuse, rate limiting, and investigating problems. Basis: our legitimate interest in protecting the Service and its users.
• To count visits and see which pages are used, so we can improve the site (Umami). Basis: our legitimate interest in understanding how the site is used. We've limited it to what that needs: no cookies, nothing stored on your device, no link to your account, and nothing used for advertising. You can object at any time (see section 8).
• To understand in more detail how people use the site (Google Analytics). Basis: your consent, which you can withdraw at any time on this page.
• To contact you about your account, security or changes to our terms. Basis: our contract with you, and our legitimate interests.
• To keep prohibited content off the Service: every photo you upload is checked automatically for whether it shows a trading card and for content our Terms don't allow, and a photo the check flags is looked at by a StackChase administrator. Basis: our legitimate interest in keeping the Service safe and lawful, and our legal obligations where the law requires us to act on illegal content.
• To comply with the law. Basis: legal obligation.

4. Who can see your collection

Public: anyone can see your Stack, including photos, card details, values and your record of sold and traded cards, including sale prices. Public Stacks are listed in our sitemap for search engines, and our site explicitly allows AI systems to index them and use them for training.

Unlisted (the default): anyone with the link or who knows your username can see the same information, but we don't list it anywhere and ask search engines not to index it. Usernames can be guessed, so unlisted is not the same as private.

Private: only you can see your Stack. One limitation: photos you add after making a Stack private are currently stored at a web address that is long and unguessable, but not access-controlled. Anyone who obtained that exact address could open the photo.

Whatever your setting, a small number of StackChase administrators can see all accounts' profile details, email addresses and collections, to run and support the Service.

5. Who we share it with

We use the following service providers to run the Service. They process your data on our behalf, only to provide their service to us:

• Supabase: authentication, database and photo storage.
• Railway: hosting for our servers, including server logs and our Umami analytics server. Umami is open-source software we run ourselves, so the usage statistics it collects aren't sent to anyone else.
• Card Hedge: card identification and market pricing. Your photos, with their metadata already removed, are sent to Card Hedge when you upload a card or ask to re-identify one, and card details are sent when we look up prices.
• Google Cloud Vision: image analysis. Every photo you upload, with its metadata already removed, is sent to Google Cloud Vision to check whether it shows a trading card and whether it contains prohibited content, and to read serial and certification numbers printed on it. Google processes the photo to return the result.
• Google: if you choose to sign in with Google, and — only with your agreement — Google Analytics, which receives your IP address, the pages you view on this site and basic device information. We have not enabled Google Signals, advertising features or data sharing for advertising purposes.

We may also disclose data if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the Service (in which case we'll tell you first). We don't share your data with anyone else.

6. International transfers

We are based in the United States, and our service providers process data in the United States and possibly other countries. If you're in the UK or EU, this means your data is transferred outside your country. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, or the EU-US and UK-US Data Privacy Framework where a provider is certified.

7. How long we keep it

• Account data, photos and collection records: for as long as your account exists. When you delete a card, we delete its record straight away. Its photos are deleted at the same time for public and unlisted Stacks; for a private Stack they currently stay in storage until we remove them, which we will do on request or when you delete your account.
• When you ask us to delete your account, we delete your account and collection within 30 days. Copies in backups are overwritten in the normal course, after which they're gone.
• Server logs: kept for a limited period for security and troubleshooting, then deleted.
• Usage statistics (Umami): kept for as long as they're useful for seeing how the site is used. They aren't linked to your account.
• Cached market pricing is about cards in general, not about you, and may be kept longer.

8. Your rights

Wherever you are, you can see and correct your collection in the app, change your Stack's visibility, and download your collection as a spreadsheet from the Stack Portal.

If you're in the UK or EU, you also have the right to: access the personal data we hold about you; have it corrected; have it deleted; restrict or object to our processing of it; receive it in a portable format; and withdraw any consent you've given, at any time. You can also complain to your data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk); in the EU, it's the authority in your country.

If you live in a US state with a consumer privacy law, such as California, you may have similar rights to know, access, correct and delete your personal data, and not to be discriminated against for using them. We don't sell or share personal data for cross-context behavioural advertising.

To object to usage statistics, block the Umami script in your browser (most content blockers do). Because these statistics aren't linked to you, we can't look up or delete a particular person's page views; blocking the script stops any being collected.

To use any of these rights, including deleting your account, email us from the address on your account. We'll respond within one month, and may need to confirm it's really you first.

9. Security

We protect your data with measures including encrypted connections, database access controls, and restricted administrator access. No online service is completely secure, though, so please use a strong password that you don't use anywhere else.

10. Children

The Service isn't directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child under 13 (or under the age of digital consent in your country) has created an account, contact us and we'll delete it.

11. Changes to this policy

We'll update this policy when the Service changes, and change the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.

12. Contact

For privacy questions or to use your rights, email us at the address below.