Privacy Policy

What we collect

• Your email address and authentication identifiers (so you can sign in).
• Photos of cards you upload to identify or value.
• The cards, decks, and collection data you save.
• Scan history and quota usage.
• Your public profile — chosen username and optional bio.
• Community content you create — forum posts, replies, votes, reports, and card attachments.
• Direct messages you send or receive, including any card attachments and read receipts.
• A Stripe customer ID if you subscribe. We never see or store your card number — Stripe handles all payment details.

How we use it

• Run the app and identify the cards you scan.
• Sync and display your collection across devices.
• Process subscription payments and apply your quota.
• Show your public profile and community posts to other users.
• Deliver direct messages and notify you of new activity.
• Enforce our terms — investigate reports, moderate abusive content, and apply rate limits.
• Diagnose bugs and improve the service.

What is public vs private

• Public: your username, bio, forum posts and replies, votes, and card attachments you post to the forum.
• Between you and one other user: direct messages and their card attachments. CardStonks staff may access them when investigating reports or abuse.
• Private to you: your email, saved collection, decks, scan history, and billing details.

Third parties we share data with

• Lovable Cloud — hosting and database.
• Stripe — payments and subscriptions.
• Google — if you use Google Sign-In.
• Google Analytics — anonymous usage analytics (pageviews and product events) so we can improve the app.
• AI providers — uploaded card photos are sent to AI vision models to identify the card.
• Card data sources — Scryfall, pokemontcg.io, YGOPRODeck, and optcgapi.com supply card metadata and prices.

We do not sell your personal data to anyone.

Cookies and storage

We don't use tracking or advertising cookies. Your sign-in session is stored in your browser's local storage so you stay logged in.

Your rights

You can request a copy of your data or ask us to delete your account at any time by emailing the address below.

Crash & error reports

When the app crashes or hits an unexpected error, we automatically send an anonymous report to our support inbox so we can fix it. These reports include only:

• The error message and stack trace (automatically scrubbed for emails, tokens, and IDs).
• The route path where the error happened (no query parameters).
• Your browser and OS as reported by your browser's user-agent.
• The app version and the time the error occurred.

We do not include your user ID, email, IP address, cookies, session tokens, form inputs, collection data, card images, or any other personal information. Reports are deduplicated and rate-limited, used only for debugging, and not shared with third parties or used for analytics.

Children

CardStonks isn't intended for users under 13. If you believe a child has created an account, email us and we'll remove it.

Contact

Questions or requests: admin@cardstonks.app