Privacy Policy

1. Contact and scope

Privacy inquiries: cardcafeadmin@gmail.com; postal address: 5171 Cobalt Falls Bnd, Aiken, SC 29801. This policy describes personal information processed through our websites, grading features, valuation tools, creator programs and subscriptions. Other websites have separate policies.

2. Information collected

Depending on features used, we may collect: (a) account, contact and subscription information such as email, account identifiers and plan selection; (b) creator applications, payout details through Stripe Connect, referral codes and commission records; (c) feedback, support messages and correspondence; (d) usage events, device/browser characteristics, IP address, approximate location derived from IP, security logs and referral information; (e) card descriptions, certification numbers, photos and grading inputs when submitted to server-powered features; and (f) payment status, transaction identifiers and billing details from Stripe. We do not intentionally receive full payment card numbers if hosted checkout is used.

What the site collects today. If you join the Premium waitlist with consent: your email and plan choice. Creator Club applications: the details you submit. Feedback: your message, optional 1–5 rating, the page you were on, where your visit came from, and your email only if you give it. Anonymous usage events (tool steps, page, visit source and creator code — we do not store your IP address with them) and outbound link clicks (time, site, link position, search words and creator code). Premium accounts: a random account ID and a one-way fingerprint of your access key (we never store the key itself); from Stripe, your email address, customer ID, subscription status and renewal date — never your card number; your synced Collection Vault, saved grading analyses, saved submission plans, watchlist and price alerts, and (Rarivelle Pro) daily portfolio totals; and records of which version of our terms you accepted and when. Our host keeps standard request logs that include IP addresses.

3. Browser-local collections

Collection Vault, Grading Lab and Submission Planner records are stored in browser local storage. If you create a free account, turn on Vault cloud save or have Premium, a copy of your Vault (cards, prices you entered, notes, wanted list, set sizes and history) is also stored on our servers in your account so you can restore it and use it on your other devices; free accounts can store up to 500 KB. Accounts are optional. If you create a free account we store your email address and a one-way hash of your password (never the password itself) to sign you in, plus a recovery code hash as a backup sign-in; we don’t send you marketing at that address unless you separately agree. You can instead save with a recovery code only, with no email. If you create a share link for your Vault or a binder, anyone with that link can see the cards you chose to share (name, set, number, variant, grade or condition, quantity, and your estimated values only if you turn that on), never what you paid, cert numbers or notes, until you stop sharing. Share pages ask search engines not to index them. Without cloud save, clearing site data, changing devices or reinstalling a browser may permanently erase local records, so export backups. Browser-local does not mean every interaction is private: submitting photos, certification numbers or market queries may transmit related data as described below.

4. Photos and AI processing

For the Grade Check centering measurement, image processing occurs on-device. If you invoke the AI condition check or a slab scan, images and accompanying prompts are transmitted through our servers to Anthropic to generate an estimate or read a label. Anthropic states that it deletes API inputs and outputs within 30 days by default, and may keep them longer where needed to enforce its usage policy or where required by law. [Statement on whether Anthropic trains on our API data — to confirm] Do not upload images containing unnecessary personal information. We do not write uploaded images to storage; they are discarded after processing. We retain limited scan metadata (for AI checks: the side, estimated grade range and confidence; for slab scans: the grading company, grade, and whether the cert was found and priced) for [Scan Metadata Retention].

5. Pricing and verification services

We may send card-identifying fields (game, name, set, number, year, variant, grade) to PokemonPriceTracker, Scryfall, YGOPRODeck and, once connected, PriceCharting and SportsCardsPro to retrieve pricing information, including when Premium checks the cards on your watchlist. PSA certification queries send a certificate number to PSA’s Public API. A registry match is not physical authentication. We cache price results for up to 24 hours and certification results for up to 7 days. Third-party providers may separately process requests under their policies.

6. Uses and legal bases

We use information to deliver requested services, manage memberships, attribute and pay creator referrals, provide support, prevent fraud and abuse, secure systems, analyze product performance, satisfy legal obligations and—where consent or another lawful basis permits—send marketing.

7. Disclosures and service providers

Information may be shared with our hosting provider (Render), our AI provider (Anthropic), our payment processor (Stripe) and payout processor (Stripe Connect), the pricing and verification providers listed above, authorized legal advisers, regulators when required and successors in a legitimate business transaction. We do not currently use an analytics provider or an email delivery provider. We do not sell personal information for money.

8. Cookies and analytics

We use two first-party cookies: cc_ref, set only when you arrive through a Creator Club link, with a 30-day lifespan, so the creator gets credit; and cc_acct, set only when you create an account, sign in, start Premium checkout or turn on Vault cloud save, which keeps you signed in to your account. We do not use analytics cookies, advertising cookies, third-party tags or pixels on our pages; Stripe’s checkout and billing pages are run by Stripe under its own policies. The site also keeps your Vault, plans and preferences in your browser’s local storage, which you control. Browser controls may restrict functionality.

9. Retention and security

We keep data only as needed for the stated purposes and legal requirements. Current periods: waitlist [Waitlist Retention]; creator applications 12 months; feedback 12 months (both deleted automatically by our server); transactional and tax records 5 years; security logs kept by our host under its own policy [Host Log Retention]; uploaded images are not stored by us (see section 4); referral records 5 years; Premium account data (synced Vault, saved items, watchlist) while your account exists and [How soon account data is deleted after closing] after you ask us to close it; payment records are kept by Stripe under its policies. We use reasonable safeguards, but no transmission or storage is perfectly secure.

10. Your choices and rights

You may request access, correction, deletion, marketing opt-out or other rights where applicable by contacting cardcafeadmin@gmail.com. We may verify identity and retain data where legally permitted or required. We will respond within applicable deadlines. To close an account, use Delete account on your profile page (cancel any Premium subscription first in Manage billing); this deletes your cloud Vault copy and saved items.

11. Children and international users

Rarivelle is intended for [Audience]. We do not knowingly collect personal information from children under 13 without legally required parental consent.

12. Changes and contact

We may update this policy and will post the new effective date. Material changes will be communicated as required by law. Contact cardcafeadmin@gmail.com, 5171 Cobalt Falls Bnd, Aiken, SC 29801.