Last updated: June 29, 2026
This Privacy Policy explains how CardVault (“CardVault,” “we,” “us,” or “our”) collects, uses, and protects your information when you use mycardvault.app (the “Service”). CardVault is operated by Dan, an individual.
Account information. When you sign in with Google, we receive your name, email address, and Google account ID through Google OAuth, via Supabase Auth.
Card images and collection data. Photos of cards you scan, and the information you save about them — player names, sets, years, condition notes, purchase prices, values, sale history, tags, and similar details you enter or that our AI generates from your images.
Usage data. We log scan attempts (success/failure, timestamps) to manage subscription limits and for cost visibility on our end. We don't log the content of what you scan beyond what's saved to your collection.
Billing information. If you subscribe to a paid plan, Stripe processes your payment and collects your payment card details directly. We receive and store your Stripe customer ID, subscription ID, and subscription status — we do not receive or store your full card number or other sensitive payment details.
Backups. We generate periodic backups of your collection data (as CSV files, including links to your card images) for disaster-recovery purposes, stored in a private storage bucket only accessible to you and to us for backup/restore operations.
We use your information to:
We do not sell your personal information. We do not use your card images or collection data to train AI models beyond the immediate processing needed to analyze the specific card you submitted (see Section 3 for how this works with our AI provider).
We share data with the following third-party services as part of operating CardVault. Each acts as a data processor on our behalf, under their own privacy and security practices:
| Service | What they receive | Purpose |
|---|---|---|
| Supabase | Account info, collection data, card images, backups | Database, authentication, file storage |
| Vercel | Request data needed to serve the app | Hosting |
| Anthropic | Card images you submit for analysis | AI-powered card identification and listing generation |
| RapidAPI / data provider | Search terms derived from your card data | eBay sale price lookups |
| Stripe | Your email, billing details, payment card info | Subscription billing and payment processing |
| OAuth sign-in data | Authentication |
We don't control these providers' own data practices beyond what we configure; we encourage you to review their respective privacy policies if you want more detail (for example, Anthropic's and Stripe's privacy policies).
We retain your account and collection data for as long as your account is active. If you delete your account, we'll delete your collection data and card images within a reasonable period, except where we're required to retain billing records for legal or tax purposes (typically retained by Stripe, not us directly).
Backup files are automatically deleted after 30 days on a rolling basis.
We use industry-standard practices to protect your data, including Row Level Security on our database (ensuring your data is only accessible to your own account) and encrypted connections (HTTPS) throughout the Service. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable steps to protect your information.
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing (for example, under the GDPR if you're in the EU/UK, or the CCPA if you're a California resident).
You can already do most of this yourself within the Service — editing or deleting individual cards, exporting your data via the backup/export feature, or deleting your account entirely. For anything else, or if you have questions about your rights, contact us at privacy@mycardvault.appand we'll do our best to help, regardless of where you're located.
CardVault uses essential cookies needed for authentication (managed by Supabase Auth) to keep you signed in. We don't currently use third-party advertising or tracking cookies.
CardVault is not intended for use by anyone under 18. We don't knowingly collect information from children. If you believe a child has used the Service, contact us and we'll address it.
CardVault is operated from the United States, and your data is processed and stored using infrastructure that may be located in the United States or other countries depending on our service providers' data center locations. By using the Service, you understand your information may be transferred to and processed in countries other than your own.
We may update this Privacy Policy from time to time. If we make material changes, we'll provide notice before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.
Questions about this Privacy Policy or your data? Reach us at privacy@mycardvault.app.