Privacy Policy

1. What we collect

Account details: your name, email address, and password. Passwords are stored hashed — we cannot read them.

Your selling data: the card photos you upload, the cards you match, the conditions, grades, and prices you set, your wishlist, and the status of each item (draft, listed, sold). This is the product — it is what the app stores so your inventory is there when you come back.

Basic technical logs: requests to our servers, with timestamps and IP addresses, kept for debugging and abuse prevention.

That is the list. There is no advertising, no analytics profile, and no tracking across other sites. The only cookie CardFlip sets is the session cookie that keeps you logged in.

2. How your data is used

To run the service: identifying the cards in your photos, quoting prices, generating listings, and keeping your ledger. Nothing else — we do not sell your data, share it with advertisers, or use it to build profiles.

When you use photo scanning, the card photo is sent to our AI image-reading provider (Anthropic) to read the card's name, number, and visible condition. Photos are sent for that reading only; under the provider's API terms they are not used to train their models.

Card names and numbers you search are matched against our own card catalogue, which is built from open catalogue sources (TCGdex and pokemontcg.io for Pokémon, Scryfall for Magic: The Gathering). Price data comes from public market sources (such as TCGplayer's published prices); your personal information is never sent to any of them.

3. Where it lives

CardFlip runs on Fly.io infrastructure in the United States, and your data is stored there. By using CardFlip you consent to your data being processed in the United States.

Your data is kept while your account exists. Delete your account (or ask us to) and your account details, photos, and ledger are removed from the live system; residual copies in server backups age out on their own schedule.

4. What we share, and with whom

Service providers only, and only what they need to do their job: hosting (Fly.io) and AI card reading (Anthropic), as described above. When eBay listing integration is connected, listing content will go to eBay under your own eBay account — at your explicit direction each time.

We would disclose data if legally required to. We have never been required to.

5. eBay data

CardFlip does not currently receive any data from eBay's APIs. When the eBay connection launches, CardFlip will store the authorization you grant and the listing and sale records needed to keep your ledger accurate — nothing more. That data is kept only while your eBay connection is active, is deleted when you disconnect eBay or delete your CardFlip account, and is handled in line with eBay's API License Agreement.

If eBay notifies us that an eBay account has been closed, any data tied to that account is deleted as well.

6. Your rights

You can see everything CardFlip holds about you — it is visible in the app itself. Email us to get a copy of your data, correct something, or delete your account entirely, and we will do it. If you are in a jurisdiction with formal data-protection rights (GDPR, CCPA, and similar), these are the same rights those laws describe, and they apply to every user regardless of location.

7. Children

CardFlip is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and it will be deleted.

8. Changes to this policy

If what we collect or how we use it ever changes, this page changes first and the effective date above moves. Material changes will be announced in the app before they take effect.

9. Contact

Privacy questions and data requests: support@superiormarketing.com.