Privacy Policy

Information we collect

Most of what we collect, you provide directly:

• Account information: the email address, User ID, name, and optional phone number and avatar you provide when you register.
• Your inventory data: the card details and photos you add to your own collection.
• Contact messages: the name, email, and message you submit through the "Contact Us" form.
• Payment information: if you make a donation or subscribe, Stripe processes and stores your payment details directly -- we never see or store your card number.

A smaller amount is collected automatically as part of running the site:

• Account activity: security-relevant events on your account (sign in, password changes, lockouts, etc.) are logged for support and security purposes.
• Standard server logs: like most websites, our hosting provider automatically logs basic request data (such as IP address and timestamp) for security and abuse prevention. We don't otherwise track your browsing activity.

How we use it

We use each type of data for a specific purpose, not just "to improve our services":

• Account information -- to create and manage your account, and to let you sign in.
• Inventory data -- to display and organize your own collection for you.
• Contact messages -- to respond to your question, bug report, or feedback.
• Payment information -- handled entirely by Stripe, to process your donation or subscription and issue refunds/receipts.
• Account activity and server logs -- to detect abuse, investigate account issues, and keep the site secure.
• Email address -- to send account-related email (welcome, security alerts, password changes) and, if you opt in, notifications about the app. We don't send marketing newsletters today; if that changes, it will be opt-in.

We don't sell your data, and we don't use any of it to train our own AI/ML models. (Photos you submit to the "Auto-identify" feature are sent to third-party identification services to process that one request -- see below for more on how that data is handled.)

Third-party services we use

To provide the app's features, some of your data is shared with:

• Automated card-identification services: if you use the "Auto-identify" feature, the photo you provide is sent to one or more third-party image-recognition and OCR services to help fill in card details. These photos are used only to process that request.
• eBay: if you choose to connect your own eBay seller account (a feature in progress), we use eBay's APIs on your behalf to help you list your cards, and store the access credentials needed to do so.
• Stripe: for processing donations and subscription payments.
• Resend: for delivering account-related emails.
• Supabase and Vercel: our database, file storage, authentication, and hosting providers.

Analytics and advertising

We do not use Google Analytics, Meta Pixel, or any other analytics or advertising tracking tool on this site. We don't run ads, and we don't share your activity with ad networks.

Cookies and local storage

We use one essential cookie to keep you signed in -- the site can't authenticate you without it, so there's no separate opt-out for it, but you can block or delete cookies at any time in your browser's settings (doing so will sign you out). We also save a few interface preferences -- like your light/dark theme choice and dismissed banners -- in your browser's local storage. That stays on your device only; it isn't sent to us or shared with anyone. See our Cookie Policy for the full list.

How we protect your information

• All traffic to and from TrackAndList is encrypted in transit (HTTPS/TLS).
• Your data is stored with reputable providers who encrypt it at rest.
• Passwords are hashed, not stored in plain text, and new passwords are checked against known-breached-password lists before they're accepted.
• Repeated failed sign-in attempts temporarily lock an account to slow down guessing attacks.
• Payment details are handled entirely by Stripe -- we never see or store your card number.
• Access to production systems and data is limited to the developer running the app.

No method of storing or transmitting data is 100% secure, but we follow standard practices to protect your information and update them as the app grows.

Your rights and data retention

You can:

• Access and correct most of your account information yourself, anytime, from your Profile page.
• Request a copy of the personal data we hold about you.
• Request deletion of your account and associated data.

For anything not available directly in Profile -- a copy of your data, or account deletion -- email support@trackandlist.com. We'll act on verified requests within 30 days, except where we're required to keep certain records longer (for example, payment records Stripe/tax law requires us to retain).

We keep your account data for as long as your account is active. If you connected a third-party account (such as eBay) and later close that account with its provider, we remove the data tied to it in accordance with that provider's own requirements.

Children's privacy

TrackAndList is not directed at children under 13, and we don't knowingly collect information from them.

Changes to this policy

As TrackAndList grows, this policy will be updated to reflect new features. We'll update the date at the top of this page when that happens.

Contact us

Questions about this policy? Use the "Contact Us" button at the bottom of any page, or email support@trackandlist.com.