Privacy Policy

The short version

We collect the account details you sign in with, the card photos and collection you add, and the activity needed to run CardBox. We use them to catalog, identify, crop and value your cards, to run the public catalog, and to make recognition better.

We do not sell your personal information. We do not run advertising networks on CardBox. What you publish is public under an anonymous alias; everything else is private to you and the people you invite. You can ask for a copy of your data or for your account to be deleted.

What we collect

Account: when you sign in, our sign-in provider (Auth0) gives us your email address, name, avatar and the provider's account id, so we can keep you signed in and show your collection.

Your cards: the front and back photos you upload, the crops derived from them, the card details you or our reader record, your collection and inventory, your corrections and the values shown for them.

Activity and diagnostics: pages and actions, timestamps, IP address, browser and device information, error reports and the screenshots or notes you choose to attach when you report a problem.

Messages: what you write in a report, an access request, a beta request or a support message.

Public content: your alias, the cards you publish, and any flair or achievements shown with them.

How we use it

To run CardBox: sign you in, store and display your collection, identify cards, crop and rotate scans, show values, keep the catalog current, and let you share a public library if you choose.

To improve CardBox: recognition, cropping, catalog coverage and image quality. A good scan may be used as the catalog picture for that card, and corrections help the reader and curator do better.

To keep it safe and working: prevent abuse, investigate errors, secure the service, and meet legal obligations. We also use aggregated or de-identified information to understand usage.

To talk to you: service messages, replies to your reports, and — only where you have asked for it — product updates.

AI and automated processing

CardBox reads cards with AI models. Scans you upload are sent to a model provider so it can return the card's name, number, set and treatment; a crop engine then frames the card. An automated match can be changed by you at any time, and the card stays yours.

We do not use your account details in those model requests beyond what the card needs. Model providers process the scan to answer our request under their own terms; we do not sell the scan or give the provider your email address.

Who processes it

We use service providers for hosting and storage (Rackspace Spot and Cloudflare R2), sign-in (Auth0), AI card reading (DeepSeek and OpenRouter), email delivery, diagnostics and error monitoring. They receive only what their part of the service needs, and their contracts limit them to providing that service to us. We may change providers; this page is updated when the list changes materially.

Other members and visitors see only what you publish: your alias, published cards and any flair. Your name, email and private collection are not shown.

We may disclose information when the law requires it, to protect someone's safety or our rights, or as part of a merger, acquisition or sale of the service, subject to this policy.

We do not sell your personal information and we do not share it for cross-context advertising. Links to other services, such as our Discord server, are governed by those services' own policies.

Public libraries and your choices

Your collection is private by default to you and the people you invite. If you turn on a public library, your published cards appear under your anonymous alias, and only cards in releases that are live in Production are shown. You can turn it off in Settings; published cards then stop appearing.

Achievements and Discord

When you earn an achievement, CardBox announces it in the CardBox Discord server. The post shows your display name — your anonymous alias, or the name you chose in Settings — and the achievement. It does not include your email, your collection's contents or your private cards. These announcements are part of using CardBox and are not optional.

If your CardBox account is linked to a Discord member, the post can mention that member. Linking and membership are handled by the CardBox Discord server.

Cookies and local storage

We use a session cookie to keep you signed in, and local storage for preferences such as the theme, the sidebar and dismissed hints. Our CDN may set security cookies. We do not use advertising cookies or third-party ad networks.

How long we keep it

We keep your account, your collection and your uploads while your account is open and for a reasonable period afterwards for backups, security and legal obligations. Error logs are kept for a limited period.

If you ask us to delete your account, we delete or de-identify your personal information within a reasonable time, except where we must keep it by law or for a security investigation. A photo that was accepted as a catalog picture may remain part of the catalog, where it belongs to the card, not to your account.

Security

We use encryption in transit, access controls, least-privilege service credentials and backups. No service can promise perfect security; if a breach affects your information we will notify you and the authorities as the law requires.

Your rights

Depending on where you live, you may ask for a copy of your information, correct it, export it, delete it, or object to or restrict some processing. You can change or delete most of it yourself in the app, and turn your public library off in Settings.

To make a request, use Report a problem in the app or email [email protected]. We may ask you to verify that the account is yours. We honour requests as the law applies to us; nothing here limits a right you have under that law.

Children

CardBox is for collectors aged 13 and over and is not directed to children under 13. If we learn that a child under 13 has an account, we will delete it. Tell us with Report a problem if you think that has happened.

Where we process it

CardBox is operated from the United States and information is processed there and in the regions our providers use. Where the law requires safeguards for a transfer, we use them.

Changes to this policy

When this policy changes, the date at the top changes too. If a change is material, we will tell you in the app or by email before it takes effect where we reasonably can. Using CardBox after a change means the new version applies.