1. Who we are

CardVaulty ("we", "us") operates the website at cardvaulty.com. If you have any questions about this policy or your data, contact us at hello@cardvaulty.com.

2. What we collect

Account data: email address, display name, and (for social sign-in) any name/avatar provided by your OAuth provider.
Collection data: the cards, wishlist items, folders, notes, price alerts and set-tracking rows you create.
Card photos: if you upload or capture a card image, the photo is stored inline with the vault entry until you delete it. You can disable saving photos in your account settings — new scans will then only use the image temporarily for recognition.
Usage & diagnostics: basic log data (IP address, timestamps, browser/user-agent) used to keep the service running and detect abuse.

3. What we do NOT collect

We do not sell your data. We do not use behavioural advertising trackers. We do not read the contents of card photos beyond running them through our card-recognition pipeline.

4. How we use your data

To provide the core features of your CardVaulty account: vault, wishlist, alerts, scans and insights.
To send transactional emails (sign-in confirmations, password resets, price alerts).
To send you optional product updates or the weekly digest only if you opt in.
To detect and prevent abuse, spam and fraud.

5. Third parties we rely on

Supabase (database, authentication, storage).
Google Gemini (image recognition on the scanner — photos are sent for OCR and returned metadata only).
Pokémon TCG API and JustTCG (official card metadata and market price signals).
eBay Browse API (live listing lookups for the Deals module).

Each provider processes only what is necessary to deliver the corresponding feature.

6. Legal basis (UK/EU users)

We process account and collection data under contract (necessary to provide the service you asked for), diagnostics under legitimate interests (keeping the service secure and functional), and marketing emails only under consent.

7. Your rights

You can, at any time, from your Account page:

Export your vault, wishlist and alerts as CSV or JSON.
Update your notification and privacy preferences.
Delete individual cards, wishlist items and alerts.
Permanently delete your account and all associated data.

You also have the right to lodge a complaint with your local data-protection authority (e.g. the ICO in the UK).

8. Data retention

We keep your data until you delete it or delete your account. Account deletion is immediate and cascades to all owned rows (cards, wishlist, alerts, snapshots, settings, badges, set tracking). Backups may retain a copy for up to 30 days before being overwritten.

9. Children

CardVaulty is not directed at children under 13. If you believe a child has provided personal information without a parent's consent, contact us and we will remove it.

10. Changes to this policy

We will update this page and change the "Last updated" date at the top when material changes are made.