Privacy Policy

Who is responsible

Card Trade Tracker LLC, operating CardTrackt in Connecticut, is responsible for the account and service data described here. Contact admin@cardtrackt.com for privacy requests. Mailing address: 938 White Plains Road, Suite 18, Trumbull, CT 06611, United States. This notice describes the website, Android app, and subscription billing.

Information collected

Account records include your email address, a display name derived from your email during signup, a password hash, identifiers, account timestamps, and the version and time of terms acceptance at signup. Authentication records can include session tokens, IP addresses, browser information, and security/rate-limit records. For website subscriptions, we store Stripe customer/subscription identifiers, subscription status, renewal/cancellation dates, recurring-billing consent records (the plan, price, currency, disclosure, and acceptance time), and billing-reminder records. Stripe handles the payment-card details and billing address you enter at checkout; CardTrackt does not receive full payment-card numbers through checkout. For Google Play subscriptions, we store the purchase token, product and plan identifiers, subscription status, automatic-renewal setting, paid-access expiry, test-purchase indicator, and last verification time with your CardTrackT account. These records let us verify purchases, restore access, and prevent the same purchase from unlocking another account. You supply card details, costs, estimates, asking prices, cash balances, trades, sales, purchases, show information, optional notes or trading-partner names, and your business name and logo. Hosting providers also process connection and operational information needed to serve the website. Avoid entering personal information about others unless necessary and authorized.

Why information is used

We use information to authenticate you, store and synchronize your records, calculate your requested totals, show your account branding, administer account access, trials, subscriptions, cancellations and refunds, send billing notices, respond to support and privacy requests, prevent abuse, troubleshoot failures, and meet legal obligations. The app does not currently include advertising or marketing analytics. We do not use personal data collected by this app to train our own large language models. Optional photo scanning, when connected, sends only the card or receipt photos you choose to OpenAI to suggest card details or expense amounts; it does not send your inventory or account email. We do not sell your personal information or use it for targeted advertising.

Cookies and browser storage

Essential authentication cookies keep you signed in; sessions currently expire after 30 days unless renewed or ended earlier. Browser local storage may contain records from the earlier browser-only version and an import-status marker. Those older records can remain after sign-out; on a shared device, use browser settings to remove them after making a backup. Downloaded backups and CSV files remain on your device until you delete them. Blocking necessary cookies may prevent login. The current app does not set advertising cookies.

Disclosures and service providers

We disclose information only as needed to operate, secure, and support the service; comply with law; protect rights and safety; or complete a business transfer subject to applicable safeguards and notice. Categories of recipients include hosting, database, security, email, payment, image-processing, and private administrative-reporting providers; professional advisers; authorities; and a successor in a merger, financing, or sale. We do not make account records public merely because the website has a public link.

Google Fonts receives standard web-request information, such as IP address and browser/request headers, when your browser requests fonts. A restricted Google spreadsheet is used for limited internal account administration. It receives account identifiers, names, email addresses, signup and verification information, and subscription administration information where applicable. It does not receive passwords, session tokens, inventory, cash, or expense records. Access is limited to Card Trade Tracker LLC and the service account used for synchronization. Stripe processes website checkout, recurring payments and refunds. We send Stripe your account email and internal account identifier; Stripe collects the payment and billing information you enter. CardTrackt retains the billing administration, consent and reminder records described above. See Stripe’s Privacy Policy for its handling of payment information.

Google processes Android subscription payments through Google Play. We send Google a hashed CardTrackT account identifier when a purchase is initiated and send the purchase token to verify and acknowledge that purchase. Google returns purchase verification information used to link paid access to your CardTrackT account; the stored fields are described above. CardTrackT does not receive full payment-card numbers through Google Play checkout. Google handles your payment and billing information under the Google Privacy Policy and Google Payments Privacy Notice.

Optional eBay links open a separate website to search sold listings. When you choose Check Sold Prices, the search includes the card name, year, set, grade, and any autographed or numbered designation you entered. It does not include your account email, account identifiers, cash, costs, notes, or full serial or certification numbers. eBay handles that visit under its own privacy policy. CardTrackt does not load eBay tracking scripts or automatically update your saved card value.

Optional card photo scanning

Scanning is available only when the operator connects the image-reading service. Selecting Read card details sends your chosen photos to OpenAI. The app resizes photos before sending, does not save them in your ledger or photo storage, and requests no stored API response. Provider security and abuse-monitoring retention may still apply; this is not a promise of zero retention. See OpenAI API data controls. Only suggestions you choose to use and save become card records. Scan usage counters limit requests. Scan only the card, avoiding faces, addresses, or other personal information in the background. Scanning is optional; manual entry remains available.

Retention and deletion

Records are kept while your account remains open and as needed to provide the service, resolve disputes, maintain security, or meet legal obligations. The app does not currently apply an automatic inactive-account deletion schedule. Deleting an inventory card hides it from inventory while retaining an archived record for transaction consistency; it is not account-level erasure. Deleted transactions may remain in exports you previously downloaded and in provider backups or logs under applicable retention processes. You can permanently delete your account through Account & support after confirming your current password, or contact us for assistance. This deletes live account and ledger records across all collections. Cancel any recurring subscription renewal first. Deleting your CardTrackT account does not cancel Google Play billing or delete payment records held by Google. Cancel Google Play renewals through Google Play before requesting account deletion. We will explain any lawful retention exceptions and applicable timing when responding; we do not promise instant removal from every backup.

Your choices and rights

Submit a privacy request, appeal, or account deletion request. Signed-in requests receive a reference and response deadline in Account & Support. Requests and responses are stored with your account and included in your data export.

You can edit records and branding, download your ledger using Export backup or inventory/profit CSV, and download account information through Account & support. To request access to account information, correction, deletion, an explanation of processing, or applicable privacy rights, contact admin@cardtrackt.com. We may need to verify identity in a proportionate way; do not email passwords. Rights and deadlines depend on the law applicable to you. If a request is denied, you may ask us to review the decision by replying with “Privacy appeal.” Where applicable you may complain to your state attorney general or other supervisory authority. Because we do not sell personal information or use targeted advertising, no such processing needs to be disabled for this release.

Security, locations, and children

We use HTTPS, hashed passwords, account authentication, and access controls, but no system is guaranteed secure. Service providers may process data in the United States and other locations; this release does not promise a particular data residency. CardTrackT is for people aged 13 and older and is not directed to children under 13. At sign-up, we ask for a date of birth solely to determine whether a person is at least 13; we do not store it as part of the account record. We do not knowingly allow a child under 13 to create an account. If we learn that an account belongs to a child under 13, we will disable the account and delete associated personal information, unless we obtain verifiable parental consent and have a lawful basis to retain it. A parent or guardian who believes a child under 13 supplied information can contact support for help. Accounts are private by default. We do not sell personal data, target advertisements, collect precise location, offer public messaging, or use engagement streaks. A parent or guardian can contact support for help with a teen account, subject to appropriate verification and applicable rights. Do not store payment-card numbers, bank credentials, government identification numbers, health information, or other sensitive personal information in notes.

Business users and updates

If you enter another person’s information for your business, you remain responsible for a lawful basis and required notices. This notice is not a substitute for a separately agreed data-processing contract where one is required. We will update this policy when practices materially change and provide any legally required notice or consent process.