Privacy Policy
This policy explains what Cardra collects, why, who we share it with, and how to get your data deleted. Cardra is operated by Cardra LLC, Arizona, United States. It covers the Cardra mobile app and cardratcg.com.
The short version. We collect the email you sign up with, the cards you add, and basic technical information needed to run the app and fix crashes. Photos you scan are sent to Google to read the text on the card and are not stored by us. We don't sell your data, we don't show ads, and you can delete your account from inside the app at any time.
1. Information we collect
Information you give us
- Account: your email address and password. If you sign in with Google or Apple, we receive your email address and name from them instead of a password. Apple may give you a private relay address rather than your real one.
- Profile: an optional username and display name.
- Your collection: the cards you add, plus portfolios, quantities, the printing you own, condition, and any grading details you record.
- Support and feedback: anything you send us by email or through the in-app feedback form.
Information created when you scan a card
- The photo: when you scan, the image is sent to Google Cloud Vision to read the text on the card. Cardra does not store your photos, and Google processes them for us as a service provider.
- Scan records: we keep the text read from the card, which card it matched, and basic capture details such as image dimensions and the detected language. This is linked to your account and is how we find and fix scanning problems.
- Corrections: if you fix or delete a wrongly matched card, we record that, so we can measure how often scanning gets it wrong.
Purchases
Subscriptions are sold through the App Store and Google Play. We never see or store your card number or payment details. We receive whether your subscription is active and when it expires, through RevenueCat, which manages subscriptions for us.
Collected automatically
- Technical data: IP address, device type and operating system, app version, and timestamps of requests. These come with any internet request and are used to run and secure the service.
- Crash and error reports: when something breaks, a report is sent to Sentry that includes the error, device details, and your account ID (not your email address) so we can tell whether a problem affects one person or everyone.
- Usage analytics: if analytics is enabled in a build, anonymous-ish event data (such as "a scan completed") is sent to PostHog along with your account ID. We do not use this for advertising.
Cookies
The Cardra app does not use cookies or advertising trackers. On cardratcg.com we use Cloudflare, which may set a security cookie and collect aggregate, cookie-free visit statistics. We run no advertising and no cross-site tracking.
2. Why we use it
- To run the service: create your account, store your collection, identify scanned cards, show prices, and send your CSV exports.
- To handle subscriptions: tell whether your account is free or Pro and apply the free-tier limit.
- To fix and improve things: diagnose crashes, measure how often scanning misidentifies cards, and improve matching.
- To communicate: password resets, email confirmation, and replies to your support messages. We do not send marketing email.
- To keep it secure: detect abuse, enforce rate limits, and prevent fraud.
- To meet legal obligations where they apply.
If you are in the UK or another region with similar laws, our legal bases are: performing our contract with you (running the app and your subscription), our legitimate interests (security, fixing bugs, improving matching), your consent (camera access, which you can withdraw in your device settings), and legal obligations.
3. Who we share it with
We do not sell your personal information, and we do not share it for advertising. We use these service providers to run Cardra:
| Provider | What it handles |
|---|---|
| Supabase (AWS, United States) | Your account, collection, scan records; database and hosting |
| Google Cloud Vision | Reads the text on cards you scan; images are not stored by Cardra |
| Apple, Google | Sell and manage subscriptions; sign-in if you use it |
| RevenueCat | Tracks subscription status (no payment details) |
| Resend | Sends password reset, confirmation and export emails |
| Sentry | Crash and error reports, including your account ID |
| PostHog | Product analytics, where enabled |
| Cloudflare | Serves cardratcg.com and protects it from abuse |
We may also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the business. If that ever happens, we'll say so here.
Card names, images and prices shown in the app come from public card databases and market data. That content is not your personal information.
4. Where your data is stored
Cardra's database and files are hosted in the United States (AWS us-east-1). Our service providers may process data in other countries. If you use Cardra from outside the United States, your information will be transferred to and stored there, where privacy laws may differ from your own.
5. How long we keep it
- Account and collection data: until you delete your account.
- Scan records and feedback: kept after account deletion, but with the link to you removed, so they remain useful for measuring scan quality without identifying anyone.
- Crash reports and server logs: kept for a limited period according to our providers' retention settings, typically weeks to months.
- Records we must keep by law (for example, tax records for purchases) are kept as long as required.
6. Your choices and rights
- Delete your account: in the app, go to Profile → Delete account. This permanently deletes your account, collection and portfolios. See cardratcg.com/delete for details, or email us and we'll do it for you.
- Export your collection: Profile → Export sends a CSV of your collection to your email address.
- Correct your information: edit your username and display name in the app; email us for anything else.
- Camera access: granted when you first scan, and removable at any time in your device settings. Cardra only uses the camera while you're on the scan screen.
- Access a copy of your data, or object to processing: email us and we'll respond.
Depending on where you live (for example California, other US states, or the UK), you may have additional rights to access, correct, delete, or port your information, and not to be discriminated against for using them. We do not sell or share personal information as those terms are used in California law. To exercise any right, email cardra@cardratcg.com.
7. Children
Cardra accounts are for people aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email cardra@cardratcg.com and we will delete the account and its data promptly.
8. Security
Traffic is encrypted in transit. Your collection is stored so that only your account can read it, enforced at the database level. Subscription status can only be changed by our payment provider's verified notifications, not by the app. No system is perfectly secure, so we can't guarantee absolute security, but we will notify affected users if a breach of personal data occurs, as required by law.
9. Changes to this policy
We'll update this page when what we do changes, and update the date at the top. If the change is significant, we'll also tell you in the app or by email.
10. Contact us
Cardra LLC
4539 N 22nd St Ste R, Phoenix, AZ 85016, United States
cardra@cardratcg.com
We usually reply within 1–2 business days.