CARDBRD

Privacy Policy

Effective date: June 24, 2026 · Version 2026-06-24.1

This Privacy Policy explains how Cardbrd LLC (“Cardbrd,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Cardbrd website and mobile application (the “Service”). By using the Service you agree to this Policy and to our Terms of Service.

1. Information we collect

Account information — your first and last name, username, and email address, and an optional profile picture you upload.
Communication preferences — whether you have opted in to promotional/marketing email, and the date and source of that consent.
Collection data — the cards, collections, sub-collections, sales, trades, shows, play sessions, price overrides, and notes you add to the Service, including any images you upload.
Transaction & proposal data — sale/trade proposals and messages you exchange with other users through the Service.
Payment information — if you subscribe, our payment processor (Stripe) collects and processes your payment details. We do not store your full card number; we receive only limited billing data (such as a customer ID and subscription status).
Usage, device & advertising data — basic technical information such as device/browser type, app version, IP address, and log data, plus cookie/SDK identifiers and interactions (including clicks on “Buy” and advertising links) collected by us and by our analytics and advertising partners.

2. How we use information

To create and maintain your account and authenticate you.
To provide, sync, and back up your collection and related features across your devices.
To process subscriptions and payments and manage referral/comp programs.
To enable user-to-user proposals and notifications you choose to use.
To retrieve and display third-party pricing and valuation estimates.
To identify cards you scan: when you use the camera scanner, the photo you capture is sent to a third-party AI vision provider to recognize the card. The image is used only to return an identification and is not retained for training.
To send you essential service emails (such as sign-up confirmation, password resets, security, and billing notices), which you receive as long as you have an account because they are needed to operate the Service.
To send you promotional/marketing email (tips, news, and offers) only if you have opted in, and to measure and improve those communications.
To operate, measure, and promote the Service through analytics and advertising, including showing and measuring ads and tracking affiliate referrals.
To maintain security, prevent abuse, debug, and improve the Service.
To record your acceptance of our Terms of Service (version and timestamp), as evidence of agreement.

3. How we share information

We do not sell your personal information for money. We share information only as follows:

Recipient	Purpose
Supabase	Cloud database, authentication, and storage that hosts your account and collection data.
Stripe	Payment processing and subscription management.
Pricing-data providers (e.g. TCGplayer, PriceCharting, SportsCardsPro)	Retrieving market-price and valuation estimates.
AI identification provider (Anthropic)	Processing the card images you scan to recognize the card. Images are sent for identification only and are not retained for training.
Email/notification providers (e.g. Resend)	Sending service and (if you opted in) promotional emails.
Analytics & advertising partners	Measuring usage and delivering, capping, and measuring ads. These partners may set cookies or use device identifiers.
Affiliate networks (e.g. Impact / TCGplayer)	Attributing your clicks on affiliate “Buy” links so we can earn a commission (see “Advertising & affiliate links”).
Apple	App distribution and, where applicable, in-app purchases on iOS.
Other users	Limited profile details (such as your username) and the contents of any proposal you send them.

Our use of advertising and analytics partners that set cookies or use identifiers may be considered “sharing” or a “sale” of personal information under certain laws (such as the California CCPA/CPRA), even though we do not exchange it for money. You can opt out — see “Your privacy choices.”

We may also disclose information if required by law, to enforce our Terms, to protect the rights and safety of Cardbrd or others, or in connection with a business transfer (such as a merger or acquisition).

4. Marketing communications

We distinguish two kinds of email:

Service (transactional) email — e.g. email confirmation, password resets, security alerts, and billing/subscription notices. These are necessary to operate your account, so you receive them while your account is active; they are not marketing.
Promotional (marketing) email — tips, product news, and offers. We send these only if you opt in, either by checking the optional box at sign-up or by turning on the toggle under Profile in the app. Marketing is off by default.

You can opt out of promotional email at any time by turning off the toggle under Profile in the app, by clicking the one-click unsubscribe link in any marketing email, or by emailing support@cardbrd.io. Opting out of marketing does not stop service email.

5. Advertising & affiliate links

The Service may display advertising and contains affiliate links. When you click certain “Buy” or product links (for example, links to TCGplayer through the Impact affiliate network) and then make a purchase, Cardbrd may earn a commission, at no extra cost to you. These links are external links to buy physical goods and open in your browser; they are not in-app digital purchases. We label affiliate links where they appear.

To deliver, cap, and measure ads, we and our advertising partners may use cookies, SDKs, and device identifiers. This may involve sharing limited identifiers and usage data with those partners. You can limit this — see “Your privacy choices” and “Cookies and similar technologies” below.

6. Cookies and similar technologies

The Service uses cookies, local storage, and similar technologies to keep you signed in, remember preferences, operate the app, measure usage (analytics), and support advertising and affiliate attribution. You can control cookies through your browser or device settings; blocking some cookies may affect how the Service works.

7. Your privacy choices

Marketing email — opt in or out anytime under Profile, via the unsubscribe link, or by emailing us.
Targeted advertising / “sale” or “sharing” — you can opt out of data “sharing” for cross-context behavioral advertising by adjusting your browser/device cookie controls, by emailing support@cardbrd.io with the subject “Do Not Sell or Share My Personal Information,” and, where we are required to honor it, by sending an opt-out preference signal such as Global Privacy Control (GPC).
Access, correction, export, deletion — you can edit your data in the app and delete your account at any time (see below), or contact us to exercise applicable rights.

8. Data storage and security

Your data is stored with our cloud providers and protected by access controls, including database row-level security that restricts your records to your own account. While we take reasonable measures to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data retention and deletion

We keep your information for as long as your account is active. You can delete your account at any time from within the app, which permanently removes your collection, sales, trades, and related data. We may retain limited records (such as Terms-acceptance logs and transaction records) where necessary for legal, accounting, or fraud-prevention purposes.

10. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise most of these directly in the app or by contacting us. Residents of the EU/UK (GDPR) and California (CCPA/CPRA) have specific rights, including the right to opt out of the “sale” or “sharing” of personal information and the right not to be discriminated against for exercising them.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

12. International users

Cardbrd is operated from the United States, and your information may be processed and stored there or in other countries where our providers operate. By using the Service you consent to this transfer.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the version and effective date above and, where appropriate, notify you within the Service.

14. Contact

Questions about this Policy or your data, or to exercise a privacy right? Contact us at support@cardbrd.io. Postal mail: Cardbrd LLC, 239 4th Ave, Ste 1401 #8699, Pittsburgh, PA 15222.

← Back to Cardbrd