Effective September 19, 2026 · Current release has no paid checkout.
Privacy Policy
Version September 19, 2026
Who is responsible
Card Trade Tracker LLC, operating CardTrackt in Connecticut, is responsible for the account and service data described here. Contact cardtradetracker@gmail.com for privacy requests. Mailing address: 16 Great Brook Rd, Trumbull, CT, United States. This notice describes the deployed tracker, not hypothetical future advertising or payment features.
Information collected
Account records include your email address, a display name derived from your email during signup, a password hash, identifiers, account timestamps, and the version and time of terms acceptance at signup. Authentication records can include session tokens, IP addresses, browser information, and security/rate-limit records. If billing is later connected, we will also store payment-provider customer/subscription identifiers, subscription status, and renewal/cancellation dates; full payment-card numbers will be handled by the payment provider. You supply card details, costs, estimates, asking prices, cash balances, trades, sales, purchases, show information, optional notes or trading-partner names, and your business name and logo. Hosting providers also process connection and operational information needed to serve the website. Avoid entering personal information about others unless necessary and authorized.
Why information is used
We use information to authenticate you, store and synchronize your records, calculate your requested totals, show your account branding, respond to support and privacy requests, prevent abuse, troubleshoot failures, and meet legal obligations. The app does not currently include advertising or marketing analytics. Optional photo scanning, when connected, sends only the card or receipt photos you choose to OpenAI to suggest card details or expense amounts; it does not send your inventory or account email. We do not sell your personal information or use it for targeted advertising.
Cookies and browser storage
Essential authentication cookies keep you signed in; sessions currently expire after 30 days unless renewed or ended earlier. Browser local storage may contain records from the earlier browser-only version and an import-status marker. Those older records can remain after sign-out; on a shared device, use browser settings to remove them after making a backup. Downloaded backups and CSV files remain on your device until you delete them. Blocking necessary cookies may prevent login. The current app does not set advertising cookies.
Disclosures and providers
Account and ledger information is processed by hosting and database providers to operate the service. Google Fonts receives normal web-request information when your browser requests our fonts. See the Data Processing and Vendor List for current services and their roles. We may disclose information when legally required, to protect rights or security, or during a business transfer subject to applicable safeguards and notice. We do not make your account records public merely because the website itself has a public link. No payment-card information is collected by this release.
Optional card photo scanning
Scanning is available only when the operator connects the image-reading service. Selecting Read card details sends your chosen photos to OpenAI. The app resizes photos before sending, does not save them in your ledger or photo storage, and requests no stored API response. Provider security and abuse-monitoring retention may still apply; this is not a promise of zero retention. See OpenAI API data controls. Only suggestions you choose to use and save become card records. Scan usage counters limit requests. Scan only the card, avoiding faces, addresses, or other personal information in the background. Scanning is optional; manual entry remains available.
Retention and deletion
Records are kept while your account remains open and as needed to provide the service, resolve disputes, maintain security, or meet legal obligations. The app does not currently apply an automatic inactive-account deletion schedule. Deleting an inventory card hides it from inventory while retaining an archived record for transaction consistency; it is not account-level erasure. Deleted transactions may remain in exports you previously downloaded and in provider backups or logs under applicable retention processes. You can permanently delete your account through Account & support after confirming your current password, or contact us for assistance. This deletes live account and ledger records across all collections. Cancel any recurring subscription renewal first. We will explain any lawful retention exceptions and applicable timing when responding; we do not promise instant removal from every backup.
Your choices and rights
You can edit records and branding, download your ledger using Export backup or inventory/profit CSV, and download account information through Account & support. To request access to account information, correction, deletion, an explanation of processing, or applicable privacy rights, contact cardtradetracker@gmail.com. We may need to verify identity in a proportionate way; do not email passwords. Rights and deadlines depend on the law applicable to you. If a request is denied, you may ask us to review the decision by replying with “Privacy appeal.” Where applicable you may complain to your state attorney general or other supervisory authority. Because we do not sell personal information or use targeted advertising, no such processing needs to be disabled for this release.
Security, locations, and children
We use HTTPS, hashed passwords, account authentication, and access controls, but no system is guaranteed secure. Service providers may process data in the United States and other locations; this release does not promise a particular data residency. The service is intended for adults and is not directed to children. Contact us if you believe a child has supplied personal information. Do not store payment-card numbers, bank credentials, government identification numbers, health information, or other sensitive personal information in notes.
Business users and updates
If you enter another person’s information for your business, you remain responsible for a lawful basis and required notices. This notice is not a substitute for a separately agreed data-processing contract where one is required. We will update this policy when practices materially change and provide any legally required notice or consent process.
Operated by Card Trade Tracker LLC · cardtradetracker@gmail.com
Google Sheets — private account reporting
We use a restricted Google spreadsheet to track account IDs, names, email addresses, signup dates, email-verification status, and subscription identifiers, status, cancellation flags, and dates for customer administration. Passwords, session tokens, customer inventories, and customer expense records are not exported to this report. Account deletion removes the account row on the next successful synchronization; Google may retain document history and backups under its retention practices. Access is restricted to the operator and the service account used for synchronization.