Privacy Policy

1. Contact and scope

Privacy inquiries: cardcafeadmin@gmail.com; postal address: 5171 Cobalt Falls Bnd, Aiken, SC 29801. This policy describes personal information processed through our websites, grading features, valuation tools, creator programs and subscriptions. Other websites have separate policies.

2. Information collected

Depending on features used, we may collect: (a) account, contact and subscription information such as email, account identifiers and plan selection; (b) creator applications, payout details through Stripe Connect, referral codes and commission records; (c) feedback, support messages and correspondence; (d) usage events, device/browser characteristics, IP address, approximate location derived from IP, security logs and referral information; (e) card descriptions, certification numbers, photos and grading inputs when submitted to server-powered features; and (f) payment status, transaction identifiers and billing details from Stripe. We do not intentionally receive full payment card numbers if hosted checkout is used.

What the site collects today. Card Café has no user accounts and no payments yet. Today we receive: your email and plan choice if you join the Premium waitlist with consent; the details you submit in a Creator Club application; feedback you send (message, optional 1–5 rating, the page you were on, where your visit came from, and your email only if you give it); anonymous usage events (tool steps, page, visit source and creator code — we do not store your IP address with them); and outbound link clicks (time, site, link position, search words and creator code). Our host keeps standard request logs that include IP addresses.

3. Browser-local collections

Collection Vault, Grading Lab and Submission Planner records are stored in browser local storage rather than our account database. Clearing site data, changing devices or reinstalling a browser may permanently erase local records. Users should export backups when supported. Browser-local does not mean every interaction is private: submitting photos, certification numbers or market queries may transmit related data as described below.

4. Photos and AI processing

For the Grade Check centering measurement, image processing occurs on-device. If you invoke the AI condition check or a slab scan, images and accompanying prompts are transmitted through our servers to Anthropic to generate an estimate or read a label. Anthropic states that it deletes API inputs and outputs within 30 days by default, and may keep them longer where needed to enforce its usage policy or where required by law. [Statement on whether Anthropic trains on our API data — to confirm] Do not upload images containing unnecessary personal information. We do not write uploaded images to storage; they are discarded after processing. We retain limited scan metadata (for AI checks: the side, estimated grade range and confidence; for slab scans: the grading company, grade, and whether the cert was found and priced) for [Scan Metadata Retention].

5. Pricing and verification services

We may send card-identifying fields (game, name, set, number, year, variant, grade) to PokemonPriceTracker, Scryfall, YGOPRODeck and, once connected, PriceCharting and SportsCardsPro to retrieve pricing information. PSA certification queries send a certificate number to PSA’s Public API. A registry match is not physical authentication. We cache price results for up to 24 hours and certification results for up to 7 days. Third-party providers may separately process requests under their policies.

6. Uses and legal bases

We use information to deliver requested services, manage memberships, attribute and pay creator referrals, provide support, prevent fraud and abuse, secure systems, analyze product performance, satisfy legal obligations and—where consent or another lawful basis permits—send marketing.

7. Disclosures and service providers

Information may be shared with our hosting provider (Render), our AI provider (Anthropic), payment and payout processors (Stripe, Stripe Connect), the pricing and verification providers listed above, authorized legal advisers, regulators when required and successors in a legitimate business transaction. We do not currently use an analytics provider or an email delivery provider. We do not sell personal information for money.

8. Cookies and analytics

We use one first-party referral cookie, cc_ref, set only when you arrive through a Creator Club link, with a 30-day lifespan, so the creator gets credit. We do not use analytics cookies, advertising cookies, third-party tags or pixels. The site also keeps your Vault, plans and preferences in your browser’s local storage, which you control. Browser controls may restrict functionality.

9. Retention and security

We keep data only as needed for the stated purposes and legal requirements. Current periods: waitlist [Waitlist Retention]; creator applications 12 months; feedback 12 months (both deleted automatically by our server); transactional and tax records 5 years; security logs kept by our host under its own policy [Host Log Retention]; uploaded images are not stored by us (see section 4); referral records 5 years. We use reasonable safeguards, but no transmission or storage is perfectly secure.

10. Your choices and rights

You may request access, correction, deletion, marketing opt-out or other rights where applicable by contacting cardcafeadmin@gmail.com. We may verify identity and retain data where legally permitted or required. We will respond within applicable deadlines.

11. Children and international users

Card Café is intended for [Audience]. We do not knowingly collect personal information from children under 13 without legally required parental consent.

12. Changes and contact

We may update this policy and will post the new effective date. Material changes will be communicated as required by law. Contact cardcafeadmin@gmail.com, 5171 Cobalt Falls Bnd, Aiken, SC 29801.