Privacy Policy

1. Introduction

CardHavok LLC ("we," "our," or "us") operates this service and is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our website and services. This policy applies to users in the United States. By using our service, you consent to the practices described here.

2. Information We Collect

We collect information you provide and data generated by your use of the service:

• Account data: Email address, name (if provided), and a hashed password when you register.
• Profile data: Optional public profile URL (slug) you set for your collection page.
• Collection & activity: Cards you add to your collection, search history (count and usage for limits), card views/searches, achievement progress, and feedback you submit (e.g., data accuracy).
• Payment: Subscription and billing are handled by Stripe. We store Stripe customer and subscription identifiers; we do not store your full payment card details. Stripe's privacy policy applies to payment data: Stripe Privacy Policy.
• Technical: Session cookies for authentication, and standard server logs (e.g., IP, browser, timestamps) for security and operations.

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the service (e.g., card search, pricing, insights, collection, profile, achievements).
• Process subscriptions and enforce tier limits (e.g., usage limits, export access).
• Display your public profile and collection to other users when you set a profile URL; show like counts and who liked your profile as part of the service.
• Use feedback you provide to improve data quality and product.
• Comply with legal obligations, protect our rights, and ensure security.

4. Sharing and Disclosure

We do not sell your personal information. We may share data only as follows:

• Stripe: Payment processing; identifiers and transaction data as needed. Subject to Stripe's privacy policy.
• Service providers: Hosting, database, and infrastructure necessary to run the service, under contractual confidentiality.
• Legal: When required by law, court order, or to protect our or others' rights and safety.
• Public profile: If you set a profile URL, your display name, profile slug, collection (including trophies), and like count are visible to other users.

4A. Third-Party Data Sources

To provide card data, prices, and insights we use data from third-party APIs and services. We do not control these providers; their own privacy and terms apply to their collection and use of data. We receive and display data from:

• TCGdex / Pokémon TCG: Card information and images.
• PriceCharting: Price and sales data; use subject to PriceCharting terms.
• eBay: Listing and completed-sale data via eBay APIs; subject to eBay Privacy Notice and API terms.
• PSA / grading services: Certification or population data where used for informational display.

We do not pass your personal information to these data providers for their marketing. API keys and tokens we use to access these services are stored securely and not shared with users.

5. Data Retention

We retain account and activity data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we must retain data for legal, security, or dispute resolution purposes.

6. Security

We use industry-standard measures to protect your data (e.g., hashed passwords, HTTPS, secure storage). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Your Rights (U.S. and California)

Depending on where you live, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information (subject to legal exceptions). You may also delete your account to remove your data.
• Portability: Request your data in a portable format where technically feasible.
• Opt-out of sale: We do not sell personal information; no opt-out is required.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us using the information at the end of this policy. We may verify your identity before fulfilling requests. California residents may designate an authorized agent to submit requests on their behalf.

8. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

9. Cookies and Similar Technologies

We use session cookies necessary for authentication and secure use of the service. These are essential and do not require separate consent. We do not use third-party advertising or tracking cookies for targeted ads on this service.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. Continued use of the service after changes constitutes acceptance. For material changes, we may provide additional notice (e.g., email or in-app).

11. Contact Us

For privacy-related requests, questions, or to exercise your rights, contact us at: support@cardhavok.com. For general support, use the contact method provided in the app or on the website.