Privacy policy

Card Pirate is operated by Card Pirate. You can contact us about privacy at [CONTACT EMAIL].

If you only browse, we do not ask who you are. Our hosting providers receive the technical details every website receives (such as your IP address, browser and the pages requested) in their request logs.

If you sign in with Google (coming soon), we receive from Google your name, email address, profile picture and Google account ID. We do not receive your Google password and we do not store Google access tokens. A sign-in cookie keeps you signed in.

What you add: the cards in your collection and watchlist, quantities, and anything you choose to enter, such as what you paid, the date and notes. Also your preferences, such as currency.

Vercel Web Analytics counts page views and a few named actions (for example “added a card to a collection”). It does not use cookies. It records only the page type and, where relevant, a set code, never your name, email, account ID, quantities or what you paid.

Sentry receives a report when something breaks: the error message, the code location, the page or API route, the browser or system type, and the app version. It is set up not to collect IP addresses, cookies, sign-in tokens or request bodies, and not to record screen sessions. Error reports do not include your account ID.

We use these providers to run Card Pirate. Each processes data for us under its own terms.

• Vercel: website hosting and Web Analytics.
• Railway: API servers and the database that stores accounts, collections and watchlists.
• Cloudflare R2: storage and delivery of card images.
• Google: sign-in (coming soon).
• Sentry: error reports.

• To run your account and show your collection and watchlist: needed to provide the service you asked for.
• To understand which pages are used and to fix errors: our legitimate interest in keeping the service working, using data that does not identify you.
• To keep the service secure and prevent abuse: our legitimate interest.

We do not sell personal data and we do not use it for advertising.

• Account, collection and watchlist data: until you delete your account.
• Request logs, analytics and error reports: for the retention period of the provider that holds them.

You will be able to do these yourself from your account page:

• Download a copy of your data (access and portability).
• Correct your collection and watchlist entries. Your name, email and picture come from Google.
• Delete your account, which deletes your collection, watchlist and preferences.

You can also write to [CONTACT EMAIL]. Depending on where you live, you may have further rights, including under Malaysia’s Personal Data Protection Act and the UK and EU GDPR, and you may complain to your data protection authority.

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on the safeguards those providers offer for such transfers.

Card Pirate is not directed at children under 13, or under 16 where local law sets that age. Please do not create an account if you are younger.

We will update this page when anything changes and show the new effective date. For significant changes we will tell signed-in users.

This is a draft. It is not in effect yet.