Privacy Policy

Last updated July 18, 2026

Cardboard Capital (“we,” “us”) makes an app and website for tracking Pokémon trading-card prices, cataloging your collection, and reading market analysis. This policy explains what we collect, why, and the choices you have. We collect only what the product needs to work.

Information we collect

• Account information. Your email address (used only to send a one-time sign-in code — we never store a password) and the handle you choose.
• Collection data. The cards you mark as owned, watched, or scanned, along with amounts you optionally enter (such as what you paid).
• Scan photos. When you scan a card, a compressed copy is saved on your device as a keepsake in your Card Dex. The cropped card image is also sent to our servers to identify it. By default we keep the crops that improve recognition — those the scanner could not identify confidently, plus a small sample of successful matches. What is kept is the card face alone, never your surroundings. Retained crops are stored privately, are never public, and are deleted automatically after 90 days. You can switch this off at any time under Settings → Data & privacy → Help improve scanning, which stops it immediately and deletes the crops we already hold.
• Location. If you grant permission, we record the approximate location where you scanned a card, so your Card Dex can note where you found it. Location is optional, captured only at scan time, and stored on your device. You can decline or revoke it at any time in iOS Settings.
• Usage signals. On-device activity (cards viewed, searches, questions asked) is used to personalize your experience. These signals stay on your device unless you enable personalization, and can be turned off in the app.

How we use it

• To sign you in and keep your collection synced across your devices.
• To show prices, market analysis, and personalized suggestions.
• To operate, secure, and improve the service.

We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.

How data is stored and shared

Account and collection data are stored on our infrastructure (Neon/Postgres) and transmitted over encrypted HTTPS. Sign-in emails are delivered by our email provider (Resend). Card price and image data come from public trading-card datasets. We share personal data only with these service providers as needed to run the app, or when required by law.

Your choices and rights

• Turn personalization and location off at any time in the app or iOS Settings.
• Delete individual scan photos from your Card Dex on device.
• Turn off “Help improve scanning” to stop us keeping scan crops and delete the ones we hold.
• Delete your account in the app at any time under Settings → Account → Delete account. That permanently removes your account and its server-side data, including every retained scan crop. You can also email us and we will do it for you.

Children

The app is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We may update this policy; material changes will be reflected by the date above.

Questions or data requests: support@cardboardcapital.net