Privacy Policy

This Privacy Policy explains what data Card Colony collects, how we use it, and your choices. We try to keep it short and plain.

1. What We Collect

Type	What & Why
Email address	Required to sign in (one-time code), receive analysis receipts, price alerts, and account notifications.
Card photos you upload	Sent to our AI provider for grading analysis. We do not store your card photos on our servers after the analysis is delivered.
Analysis history	Card names, predicted grades, and verdicts are stored in your browser's local storage so you can see your history. Account-linked history is stored on our servers.
Subscription & billing	Handled by Stripe. We see your plan, status, and email — never your full card number.
Usage data	Per-month analysis counts, by email or IP address, to enforce free-tier limits and prevent abuse.
Cookies & local storage	Session tokens, preferences (theme, etc.), Colony Coins balance, and basic analytics.
Analytics	Aggregate page views and events via Google Analytics. Used to understand what's working, not to identify individuals.

2. How We Use It

• To provide the AI analyses, market data, and other features you request.
• To send you account emails: welcome, verification codes, analysis receipts, price alerts, and important service notices.
• To enforce free-tier limits and prevent fraud, abuse, or service degradation.
• To send you the weekly digest or newsletter if you opt in. You can unsubscribe at any time from any newsletter email.
• To improve the product — measuring which features get used and which don't.

We do not sell your personal information to anyone. We do not display third-party ads inside Card Colony.

3. Third-Party Services We Use

Operating Card Colony requires sharing limited data with these services. Each operates under its own privacy policy:

• Anthropic (AI vision analysis) — receives the card images you upload for analysis. Anthropic's policy: anthropic.com/legal/privacy
• Stripe (payments) — receives your name, email, and billing details when you subscribe. stripe.com/privacy
• Upstash (Redis hosting) — stores session tokens, usage counters, and coin balances tied to your email.
• Resend (email delivery) — receives your email address and the contents of emails we send you.
• Netlify (hosting) — sees standard server logs including IP addresses.
• Google Analytics (aggregate analytics) — sees anonymized page-view data.
• eBay & PriceCharting — receive search queries you make on the market tools.

4. Cookies and Local Storage

Card Colony uses your browser's local storage and cookies for:

• Essential: Sign-in session, plan information, theme preference, analysis history.
• Functional: Colony Coins balance, set tracker progress, price alert preferences.
• Analytics: Google Analytics measurement cookies.

You can clear these from your browser settings at any time. Clearing them signs you out and removes your local-only data.

5. Data Retention

• Card photos: discarded after analysis; never stored long-term on our servers.
• Usage counters: kept for ~40 days, then automatically deleted.
• Account email and subscription history: kept while your account is active.
• Analytics: aggregated and anonymized, retained per Google's defaults.

6. Your Rights

You can:

• Access or export your account data — submit our contact form and we'll send you a copy within 30 days.
• Delete your account — email us and we'll remove your account data within 30 days, subject to legal retention requirements (e.g., billing records).
• Correct inaccurate data we hold about you.
• Unsubscribe from marketing emails using the link in any such email. (You'll still receive essential transactional emails like billing receipts and password codes.)
• Disable cookies in your browser; some features will stop working as a result.

If you're in California (CCPA) or the EU/UK (GDPR), you have additional rights. Email us and we'll honor any valid request within the law's required timeframe.

7. Children

Card Colony is not directed to children under 13. We don't knowingly collect data from anyone under 13. If you believe a child has provided us with personal information, email us and we'll delete it.

8. Security

We use HTTPS everywhere, store only what we need, and rely on reputable processors (Stripe, Upstash, Resend) for sensitive data. No system is perfectly secure; if a breach affecting your information ever occurs, we'll notify you and the appropriate authorities as required by law.

9. International Users

Card Colony is operated from the United States. By using it, you agree your data may be processed in the U.S. and other countries where our service providers operate.

10. Changes

If we change this policy in a material way, we'll update the "Last updated" date and, when reasonable, notify you by email. Material changes only take effect after notice.

11. Contact

Privacy questions, data requests, or complaints: please use our contact form.

The Card Colony · Salado, Texas · Veteran-owned