Privacy Policy

Account Information:

• Email address (required for account creation)
• Username (optional display name)
• Profile photo and bio (optional)
• Password (stored securely hashed)
• Display preferences and notification settings
• Referral attribution (which referral code, if any, brought you to the Service)

Collection Data:

• Cards and products you add to your collection
• Group organization and folder structures
• Purchase prices and dates you enter
• Grading session photos and results

Camera & Card Images:

• Photos of cards you capture or upload when using the scanner and grader tools
• These images are analyzed to identify the card and estimate its grade, and are stored so you can revisit your scans and grading sessions

Payment Information:

• Billing name and address
• Payment method (processed securely by Stripe; we do not store full card numbers)
• Subscription tier and billing history
• App store purchase receipts (processed by RevenueCat for mobile subscriptions)

Usage Data:

• Pages visited and features used
• Search queries within the Service
• Device type, browser, and operating system
• IP address and approximate location derived from it (country, region, and city — we do not collect precise GPS location)
• Referring URLs and exit pages
• Push notification tokens (if you enable push notifications)
• Error and crash reports (collected automatically to improve reliability)

Communications:

• Messages you send us through the in-app contact form or by email

We use your information to:

• Provide, maintain, and improve the Service
• Process and display your collection and portfolio data
• Generate personalized insights and recommendations
• Send service-related communications (account alerts, updates)
• Analyze usage patterns to improve features
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

We do not sell your personal information. We do not use your data for targeted advertising from third parties.

Your data is stored securely using Supabase, a PostgreSQL-based platform with enterprise-grade security:

• Data encrypted at rest using AES-256
• Data encrypted in transit using TLS 1.3
• Row-level security (RLS) policies restrict data access
• Regular automated backups
• Data hosted in secure, SOC 2 compliant data centers

Card photos you capture with the scanner and grader are stored in cloud storage (Supabase Storage) at long, unlisted URLs. These URLs are not published or indexed, but anyone who has the exact link can view the image — so please don't include anything personal in the frame when photographing cards.

While we implement industry-standard security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

We use cookies and similar technologies for:

• Essential cookies: Session management and authentication state (required for login)
• Preference cookies: Referral attribution and sign-in flow
• Local storage: Your display settings, tool preferences, and drafts are kept in your browser's local storage on your device

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in or using authenticated features.

We use Vercel Analytics and Vercel Speed Insights to collect basic usage data (pages visited, performance metrics) to improve the Service. We use Sentry for error monitoring, which collects technical data (browser, device, error details) when issues occur; for a small sample of sessions that encounter an error, Sentry may also capture a replay of what was on screen to help us diagnose the problem. Fonts are served by Adobe Fonts (Typekit), which receives standard web request data when fonts load. None of these services are used for advertising. We do not use tracking pixels or cross-site advertising trackers.

We share data with third parties only in these circumstances:

• Service providers: Supabase (database and image storage), Vercel (hosting and analytics), Stripe (payments), RevenueCat (mobile subscriptions), Sentry (error monitoring), OneSignal (push notification delivery), Resend (email delivery), Cloudflare (content delivery for card catalog images) — each processes data only to provide its service
• AI card analysis: Card photos you scan or grade are sent to our card-identification server and to Anthropic's AI API to identify the card and read grading labels. Anthropic does not use this data to train its models
• Legal requirements: When required by law, subpoena, or court order
• Safety: To protect rights, safety, or property of Pack Magik LLC or others
• Business transfers: In connection with a merger, acquisition, or sale of assets

We do not display your collection data, grading results, or personal information to other users unless you explicitly choose to make your profile or collection public. Card photos are stored as described in Section 3 (Data Storage & Security). We do not sell your personal information.

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and associated data
• Restrict processing: Limit how we use your data
• Data portability: Request a machine-readable copy of your personal data
• Object: Opt out of certain data processing activities

You can exercise the most important rights yourself, directly in the app:

• Delete your account: Settings → Delete Account. Your account is scheduled for deletion with a 30-day grace period (during which you can recover it by contacting support), after which it is deleted
• Export your data: Settings → Export lets you download your collection and grading history as machine-readable files

For anything else, contact us at gerdes@packmagik.com. We will respond within 30 days.

For California residents (CCPA): You have additional rights including the right to know what personal information is collected and the right to non-discrimination for exercising your rights.

For EU/UK residents (GDPR): You have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Pack Magik is operated from the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate.

By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence.

We retain your data for as long as your account is active or as needed to provide services:

• Account data: Until you request account deletion
• Collection data: Until you request account deletion
• Usage analytics: Retained to improve the Service
• Card and grading photos: Until you delete them or request account deletion

When you request account deletion, your account enters a 30-day grace period during which it can be recovered by contacting support; after that it is deleted. Following deletion, we may retain certain data for up to 90 days for backup purposes and to comply with legal obligations.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page with an updated "Last Updated" date
• Displaying a prominent notice within the Service for significant changes

Continued use of the Service after changes constitutes acceptance of the updated policy.