Privacy policy.

CardCat (“we”, “us”, “our”) operates the CardCat website and services. References to “you” include visitors, account holders, collectors, and sellers.

• Account and profile information: email address, username, display name, profile image, biography, and account settings.
• Collection and Market content: card details, photographs, pricing, listing information, sale records, receipts, messages, and other content you choose to submit.
• Billing information: Stripe processes payment details. CardCat receives subscription, customer, and billing status needed to provide paid access.
• Connected-service information: if eBay access is enabled for your account and you connect it, CardCat stores authorization details and data needed for the enabled eBay workflows.
• Technical and security information: IP address, browser and device information, request timestamps, error logs, and security events generated when you use the service.
• Support communications: information you include when contacting CardCat for help, privacy requests, or feedback.

• Provide authentication, catalogs, Personal Collection pages, Market listings, messages, sales records, subscriptions, and customer support.
• Protect CardCat, prevent fraud and abuse, troubleshoot errors, and maintain service reliability.
• Process subscriptions and communicate about your account, transactions, security, and material service changes.
• Understand and improve product performance using operational information. CardCat does not currently use advertising pixels or cross-site behavioral advertising.
• Comply with legal obligations and enforce CardCat’s Terms and policies.

CardCat discloses information only as needed to operate the service, complete a request you make, protect rights and safety, comply with law, or complete a business transfer subject to appropriate protections.

• Supabase: authentication, database, and file storage.
• Vercel: application hosting, delivery, and operational logs.
• Stripe: subscription checkout, billing, and payment status.
• Google reCAPTCHA: signup and sign-in abuse prevention. Google may receive browser and device information under its own privacy terms.
• eBay: only for accounts where eBay access is enabled and the account holder chooses to connect or use an enabled eBay workflow.

CardCat does not sell personal information and does not share personal information for cross-context behavioral advertising.

CardCat uses essential browser storage and similar technologies to keep you signed in, protect account sessions, remember service preferences, and support requested features. Supabase authentication tokens may be stored in your browser. Stripe and Google reCAPTCHA may use their own cookies or similar technologies when their services are loaded.

CardCat does not currently use Google Analytics, Meta Pixel, advertising cookies, or session-replay tracking. If that changes, this policy and any legally required choices will be updated before the new tracking is enabled.

We keep account and collection information while your account is active and as needed to provide the service. After a verified deletion request, we delete or de-identify information unless retention is reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, backup restoration cycles, or transaction records. Retention periods vary based on the type of information and why it is needed.

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls, encrypted connections, managed service providers, and restricted server-side credentials. No method of transmission or storage is completely secure.

You may request access to, correction of, or deletion of personal information associated with your CardCat account by emailing support@cardcat.io. We may need to verify your identity before completing a request. We will not discriminate against you for exercising applicable privacy rights.

You can manage public profile and Market visibility settings inside CardCat. You can also disconnect enabled third-party integrations through the available account controls.

Some browsers send “Do Not Track” signals. Because there is no uniform industry standard for those signals, CardCat does not currently change its essential service behavior in response to Do Not Track. CardCat does not currently use information for cross-site behavioral advertising.

Where legally required, CardCat treats a qualifying Global Privacy Control signal as a request to opt out of sale or sharing. CardCat does not currently sell or share personal information for cross-context behavioral advertising, so there is no sale or sharing to opt out of.

Third-party services such as Google reCAPTCHA may collect browser or device information across websites under their own policies. CardCat does not authorize those providers to use CardCat account content for advertising.

CardCat is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.

Information may be stored and processed in the United States and other countries where CardCat’s service providers operate. Data-protection laws may differ from those in your location.

We may update this policy as CardCat changes. The “Last updated” date will be revised when changes are posted. If a change materially affects how we use personal information, we will provide additional notice through the service, by email, or by another reasonable method before the change takes effect when required.

Questions or privacy requests should be sent to support@cardcat.io.