Privacy Policy

Who we are

CardTrack is an independent Pokémon card price guide and collection tracker. For any privacy question, or to exercise the rights below, email jd@cardtrack.com.

What we collect

• Account details — when you sign in, we receive a name, email address, avatar and a unique ID from your chosen login provider (e.g. Discord). We don't see or store your provider password.
• Your collection data — the cards, grades, prices paid, quantities, wishlist and watchlist items you choose to save.
• Comments — anything you post under articles, shown publicly with your display name.
• Email address for alerts — if you opt into price-drop alerts, so we can email you.
• Usage & device data — standard analytics such as pages visited, approximate location, browser and device type, collected via cookies to understand and improve the site.

How we use it

• To run your account and show your collection, wishlist and watchlist.
• To send price-drop alerts you've asked for, and essential service emails.
• To display your comments.
• To measure traffic, fix problems and improve the site.
• To keep the service secure and prevent abuse.

We do not sell your personal data. We only process it to provide the service, with your consent (e.g. analytics cookies and alert emails), or where we have a legitimate interest in running and securing the site.

The browser extension

The CardTrack browser extension is optional and covered by this policy. Most of it works without an account and without sending anything that identifies you. This section describes everything it collects, where that data goes, what is kept and what is stored on your own device.

What it reads and sends

• Listing details, on supported marketplace pages only — the listing's title, price, currency, condition and URL are sent to cardtrack.com so we can identify the card and show you what it is worth. The extension only runs on the marketplace listing pages named in its Chrome Web Store listing (eBay, TCGplayer, COMC, Cardmarket, Fanatics Collect, Mercari and Vinted). This request needs no account: we do not record it in our database and it is not linked to any account.
• Card searches you type — if the extension identifies the wrong card, or an auction lot has no readable name, you can type what the card actually is. That text is sent to cardtrack.com to return matching cards. It needs no account: we do not record it in our database and it is not linked to any account.
• Images you explicitly choose — on an eBay listing page, right-clicking a photo and choosing “Grade this card with CardTrack” sends that image to us to be graded. During a live auction scan, the extension captures the visible tab and crops it to the auction video, sending only that cropped frame. Both need you to be signed in and spend a scan credit. Nothing is captured unless you ask for it — there is no background or automatic capture.
• Your sign-in details — if you sign in through the extension, your email address and password are sent to cardtrack.com to authenticate you.
• Cards you add to your watchlist — the card's identifier, saved to your account.

What it does not do

• It does not collect your browsing history, and it does not read the pages you visit other than the marketplace listing pages listed above.
• The right-click grading option only appears on eBay listing pages, and acts only on the single image you right-click, when you choose it.
• It does not read form fields, cookies, passwords or payment details on the sites you visit.
• It does not track you across sites, show ads, or sell or share your data for advertising.

What is stored, and where

• On your device — the extension keeps your sign-in tokens and a few display preferences (such as your live-scan settings) in your browser's local extension storage. They stay on your device, and are removed when you sign out or uninstall the extension.
• On our servers — card valuations and card searches are answered as they arrive and are not written to any database or linked to your account. As with any website, our hosting provider keeps short-lived technical request logs for security and troubleshooting. When you scan a card, we keep the result against your account — the card we identified, its catalogue image, its estimated value at that moment and how confident the match was — so you can see your recent scans and so we can count your scan credits. We do not keep the photo or video frame you submitted.

Who it is shared with

Images you submit for grading are passed to Ximilar, our image-recognition provider, purely to identify and grade the card, and are not used for anything else. Everything else the extension sends is handled by the same providers that run the website, listed below. We do not sell this data.

Third parties we rely on

We use trusted providers to operate CardTrack. Each only receives the data needed for its job:

• Vercel — hosting and content delivery.
• Neon — our database (stores your account and collection data).
• Resend — sends alert and service emails.
• Login providers (e.g. Discord) — authenticate your sign-in.
• Ximilar — identifies and grades the card photos you submit to the scanner or the browser extension.
• Analytics — measures aggregate site usage.
• eBay & TCGplayer — when you click out to listings; some links are affiliate links, and those sites set their own cookies under their own privacy policies.

Cookies

We use a small number of cookies: essential ones to keep you signed in and the site working, and analytics cookies to understand usage. You can clear or block cookies in your browser; essential cookies are needed for account features to work.

How long we keep it

We keep account and collection data for as long as your account is active. If you delete your account, or ask us to, we delete your personal data (we may keep anonymised, non-identifying data). Alert emails stop as soon as you unsubscribe.

Your rights

Depending on where you live (including under UK and EU GDPR), you can ask us to access, correct, export or delete your personal data, and object to or restrict certain processing. To do any of these, email jd@cardtrack.comand we'll respond. You can also unsubscribe from alert emails at any time via the link in the email.

Children

CardTrack isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll remove it.

Changes

We may update this policy; the “last updated” date will change when we do. Significant changes will be made clear on the site. See also our Terms & Conditions.