Privacy

What is stored on our servers

• Your account: the email address, display name and username on it, and the user ID from Sign in with Apple or Google. If you used Apple’s Hide My Email, what we hold is the private relay address, not your real one.
• The price and grading alerts you set — the card, the target price or grading threshold, and the direction — together with the push token needed to deliver them while the app is closed.
• A device push token, if you enabled notifications, stored with the device platform and time zone so a notification is not sent in the middle of your night.
• Feedback you send from the app: the category, the message, the app version, the account it came from (the user ID, and the username, display name or email on it), basic device context, and any image you attached. Images go to a private bucket, not a public URL.
• Whether a subscription is active. Nothing about how it was paid for.

What stays on your device

Your watchlist, your search history and your onboarding state are kept in the app’s own storage on your phone and are not uploaded. A consequence worth knowing: they do not follow you to a second device, and they go when you delete the app.

What is not collected

No precise location. No contacts, microphone, camera or health data. CardPulse does not browse your photo library — the only image that reaches us is one you attach to feedback yourself. No government identifiers. CardPulse does not track you across other apps or websites, carries no advertising SDK, and does not sell personal information. It is not directed to children under 13 and does not knowingly collect their information.

Who processes it

Apple

Sign in with Apple, App Store billing, and push notification delivery on iOS.

Google

Google Sign-In, Google Play billing, and Firebase Cloud Messaging for push notification delivery on Android.

Supabase

Authentication and database, US region. Holds the account record and the alerts and feedback described above. It does not receive your watchlist or search history.

RevenueCat

Subscription receipt validation. Receives the CardPulse account ID and the App Store or Google Play receipt. No name, no email.

Sentry

Crash and performance reporting. Receives error reports and device information, and the account email and username when you are signed in, so a report can be tied to an account.

Expo

The push service that carries a notification from our server to Apple or Google. It sees the device token and the message.

Vercel

Hosts the functions that fetch prices and run the alert checks.

Price sources

TCGplayer market prices; JustTCG for cards TCGplayer does not price; live eBay listings, which are asking prices rather than sold prices; and mycollectrics.com for the daily price leaderboard, the PSA 10 prices and population figures behind the grading verdict, and the eBay-derived listing and daily-sales aggregates behind market dynamics and recent sales. These are read-only: no account data is sent to them.

Each provider operates under its own privacy policy. Payment details are handled by Apple or Google and never reach our servers.

How long it is kept

Account data is kept for as long as the account exists. Deletion is immediate when you ask for it. Copies of deleted records can persist in the database provider’s encrypted backups until those backups rotate out of retention, and crash reports already sent to Sentry are held under Sentry’s own retention schedule. Daily card closing prices are kept indefinitely — they describe cards, carry no account identifier, and are what makes a price history possible.

Deleting it

Profile, then the ACCOUNT section, then Delete Account, inside the app. The account and the alerts and feedback stored against it are removed. Delete your CardPulse account sets out the steps, the email route if the app is already uninstalled, and exactly what remains.

Your rights

You can ask what is held about you, ask for it to be corrected, ask for a copy in a portable format, object to or restrict processing, and delete the account outright — the last of which is available in the app at any time and needs no request. For anything else, email hanwong118@gmail.com; requests are answered within 30 days. If you are in the EEA or UK, you can also complain to your local supervisory authority.

Contact

hanwong118@gmail.com is the only address that receives mail for CardPulse. Support, privacy questions and deletion requests all go there.