Privacy Policy

Effective November 6, 2026

This Privacy Policy explains how CardVine ("CardVine," "we," "us," or "our"), a product of StatZhub Consulting LLC, collects, uses, and shares information when you use the CardVine app and website (collectively, the "Service").

1. Information we collect

Account information. When you create an account, we collect your username, email address, and a securely hashed password. If you choose to add a profile photo, we store that image.

Collection data. Information you enter about your cards — names, images, grading company and grade, purchase price, estimated value, quantity, and category — along with your wish list and any items you mark sold.

Social and trading data. Friend connections, community memberships, posts, direct messages, trade proposals, trade items, and trade ratings you send or receive through the Service.

Direct messages. We store the messages you send and receive, and any photos in them, so you can read your conversations. Only you and the other person can see them. We do not scan them automatically. Our team reads a conversation only if it is reported, if it relates to an order in a Buyer Protection claim, to investigate abuse or a safety issue, or where the law requires.

Shipping information. If you use the paid shipping-label feature to complete a trade, we collect the shipping address, package details, and declared value you provide, and share the relevant portions with our shipping partner to generate a label (see Section 3).

Plan and payment information. CardVine offers a free Basic plan and two paid plans, Premium and Premium Card Shop. If you subscribe to a paid plan, pay for a card or trade through CardVine, or pay a trade shipment fee, payment is processed by Stripe. CardVine does not receive or store your full card number; we keep your plan, your subscription status, and your Stripe customer reference. If you sell cards and receive payouts, Stripe collects the identity and bank details it needs to pay you directly, and we receive only whether your payout account is set up. See Section 3.

Card shop applications. If you apply for Premium Card Shop, we collect the shop name, street address, and company identifier (such as an EIN) you provide. Only you and our review team can see the company identifier; we use it, and your address, to verify your business. We also ask whether you agree to show your shop's name and street address publicly. If you say yes, they appear in CardVine's Find a Card Shop directory, where signed-in users can see them and get directions, for as long as you are a verified Card Shop member. If you say no, your address is never shown. You can change your answer at any time from the Plans screen. Once your shop is verified, your shop name and a Verified Card Shop badge are shown on your public profile.

Promoted items. Paid members can promote some of their for-sale cards, and verified card shops can promote events. Promoted cards, events, and the seller's username are shown to other users in the app.

Location (optional). You may choose to tell us your country, state or province, and city in Account Settings. If you do not, we may use the state and country of a shipping address you have saved. We use location only to understand where our collectors are, and it is not shown to other users. Only our team can see it.

Bank disputes. If a bank or card issuer opens a dispute about a payment, we keep the dispute record (the amount, reason, and outcome) together with the order records we use to respond.

Usage information. We collect basic usage data — such as which features you use and how often — to help us understand how the Service is used and to improve it. This includes when you open the app, and counts of your own activity such as cards, trades, and posts. Our team sees these figures, in total and for each account, to run the Service, keep it safe, and prevent fraud and abuse.

Buyer Protection claims. If you file or answer a Buyer Protection claim, we collect your description, any photos you attach, and, for a return, a tracking number. Our review team can see these and the messages exchanged about that order, and uses them only to decide the claim. Photos are stored privately and are visible only to the buyer, the seller, and our team.

Launch notifications. If you enter your email address on cardvine.app to be told when CardVine launches, we store it, along with the plan you say you are interested in, in our database and email a notice of the sign-up to our support inbox. We use it only to tell you about the launch, and it is not shared with advertisers. A CAPTCHA check (see Section 3) helps keep automated sign-ups out.

Website analytics. To understand how many people visit cardvine.app and which pages they view, we count page views on our own servers. For each visit we record the page, the website that referred you (if any), and a one-way daily code made from your IP address and browser details so we can count unique visitors. We do not store your IP address, we do not use cookies or similar storage on your device for this, and we do not share this data with advertisers. We honor your browser's Do Not Track and Global Privacy Control settings and do not count visits that send them. Page-view records are deleted after about 13 months.

Photos and content you share. Photos you add to posts, direct messages, and events are stored on our behalf by our hosting provider. To keep the Service safe, the text and photos of public posts, comments, and events are automatically checked by a content-moderation service (see Section 3), and content that is flagged or reported may be held and reviewed by our team. Direct messages are not scanned, but you can report a conversation, and our team may review it.

Card scans. If you choose to scan a card, you take a photo with your camera or pick one from your device, and it is sent through our servers to Scrydex, a card-recognition service, to identify the card. We use the photo only to find the card and do not save it. Scrydex has told us that it does not store photos submitted this way or use them to train its models under normal use of its service. We ask for camera access only when you tap Scan a Card, and you can choose a photo instead.

Links you share. You can share a link or QR code to your storefront, or a link to a single card you have for sale. Anyone who opens your storefront link, with or without a CardVine account, can see your username and profile photo and the cards you have marked for sale: for each card, its picture, name, set, number, finish, condition or grade, estimated market value, and your asking price. A storefront shows only cards marked for sale, and only while Public Collection is on. The preview of a storefront link in a text message or on a social site shows a QR code and your username. A link to a single card shows a small preview (the card picture and name); the price and other details, and your full collection page in the app, are shown only to people signed in to CardVine. You can turn a card's link off, or turn off Public Collection, at any time, which removes that card or the whole storefront from view. When someone builds a cart on a storefront before signing in, the cards they chose are saved in their own browser or device so the cart survives creating an account, and are not sent to us until they check out.

2. How we use your information

• To provide, maintain, and improve the Service
• To let you catalog your collection and see estimated market values
• To connect you with other collectors and enable trading, messaging, and community features
• To process subscriptions, payments, seller payouts, and tax, and, where applicable, generate shipping labels for trades
• To review card shop applications and show verified-shop badges and promoted listings
• To moderate content, enforce our Community Guidelines, and respond to reports
• To communicate with you about your account, transactions, or support requests
• To detect, prevent, and address fraud, abuse, or technical issues

3. How we share your information

We do not sell your personal information. We share information only as follows:

• Other users, as directed by you. If you make your collection public, or engage in friending, community posting, messaging, or trading, the relevant information is visible to other users as part of using those features.
• Stripe. Payment processing for subscriptions, card purchases, trade shipment fees, seller payouts, and sales tax is handled by Stripe, Inc. Stripe receives the payment and identity details necessary to process your transaction or payout. If a bank disputes a payment, we send Stripe, and through it the bank or card issuer, the records that show what was ordered and delivered, which can include the order details, tracking and delivery confirmation, photos, and messages about that order. See Stripe's Privacy Policy.
• U.S. Census Bureau geocoder. To order card shops by distance, we send the street address of each listed card shop, and the shipping address of a user looking for shops (unless they share their device location instead), to the U.S. Census Bureau's public geocoding service to turn it into map coordinates. We do not store the searcher's coordinates.
• Shippo. If you pay for a trade shipping label, your shipping address and package details are shared with Popout, Inc. (DBA Shippo) and the carrier fulfilling the shipment, solely to generate and track that label.
• Launch list. If you sign up for launch updates on cardvine.app, we store the email address you enter, and the plan you say you are interested in, in our own database (hosted by Supabase, below). We use it only to tell you when CardVine launches, and you can ask us to remove it at any time at support@cardvine.app.
• YouTube. Our tour video on cardvine.app is hosted by YouTube. Nothing is loaded from YouTube until you press play, and then it loads in YouTube's privacy-enhanced mode (youtube-nocookie.com). Once you play it, YouTube may collect information such as your IP address and viewing activity under Google's Privacy Policy.
• Cloudflare Turnstile. The sign-up form on cardvine.app, and the sign-in, sign-up, and password-reset screens of the CardVine app, use Cloudflare Turnstile, a CAPTCHA service, to tell people from bots. Turnstile runs in your browser and may collect technical signals such as your IP address and browser details to make that decision. See Cloudflare's Privacy Policy.
• Supabase. Our database, authentication, and file storage are hosted by Supabase, which processes data on our behalf under its own security and privacy commitments.
• Resend. We use Resend to send account, trade, billing, and receipt emails to the address on your account.
• OpenAI. The text and photos of public posts, comments, and events are sent to OpenAI's moderation service to check them against our Community Guidelines. Direct messages are not sent.
• Scrydex. Scrydex (scrydex.com) identifies cards from the photos you choose to scan (see Card scans in Section 1), and supplies the Riftbound and Gundam Card Game catalogs, card prices by condition and grade, and price history. Photos you scan are sent to Scrydex through our servers, without your name or account details, and only to identify the card; Scrydex has told us it does not keep them or use them to train its models under normal use of its service. See Scrydex's privacy policy.
• Card data providers. To look up cards, sets, and prices, the Service and your device contact third-party card databases: Scryfall (Magic: The Gathering), YGOPRODeck (Yu-Gi-Oh!), Lorcast (Disney Lorcana), the One Piece card API (optcgapi.com), and the Star Wars: Unlimited card database (swu-db.com). For Pokémon, we copy the TCGdex catalog and prices to our own servers, so your searches go to us, although some Pokémon card images may still load from TCGdex until we have copied them. Our servers also use a public exchange-rate service (Frankfurter) to convert prices. These providers receive the card search or lookup and your device's network address, but not your account or personal information.
• Legal and safety. We may disclose information if required by law, or if we believe it's necessary to protect the rights, property, or safety of CardVine, our users, or others.

4. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we're required to retain it for legal, tax, or fraud-prevention purposes, such as payment, dispute, and claim records. We keep secure backups of our database and uploaded files, and deleted information may remain in those backups for a limited time.

5. Your choices

• You can review and edit most of your account and collection information directly in the app.
• You can control whether your collection is publicly visible in your profile settings.
• You can request access to, correction of, or deletion of your personal information by contacting us at support@cardvine.app.

6. Data security

We use reasonable technical and organizational measures — including row-level access controls on our database — designed to protect your information. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

7. Children's privacy

CardVine is not directed to children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

8. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by updating the effective date above and, where appropriate, through the Service.

9. Contact us

Questions about this Privacy Policy? Reach us at support@cardvine.app.