Privacy
What is stored about an account, why, and how to get rid of it. Last updated .
The short version
You can read every page on this site without an account, and nothing personal is collected if you do. An account exists so that watchlists and alerts can belong to someone. What is stored is listed below, in full. It is never sold, never shared for advertising, and can be deleted on request.
What is stored
| Data | Why | Kept for |
|---|---|---|
| Email address | Identifies the account, signs you in, and delivers the alerts you asked for. | Until the account is deleted. |
| Password | Stored only as a bcrypt hash. The password itself is never stored, logged or echoed back. | Until the account is deleted. |
| Display name | Optional. Shown back to you in the account menu. | Until changed or the account is deleted. |
| Phone number | Optional, and only if you turn on SMS alerts. Verified once by code, then used to send the alerts you configured. | Until you remove it or delete the account. |
| Push subscription | Optional. The browser-issued endpoint and keys needed to deliver a web-push alert to that specific browser, plus its user-agent string so a failing subscription can be retired. | Until you turn push off, the browser revokes it, or it fails repeatedly. |
| Watchlists, alert rules and portfolios | The lists and thresholds you created. They are what the product does. | Until you delete them or the account. |
| Collection value | In the app, the total value of the collection on your phone, posted as a number each time it changes so friends can see where you stand. Card by card, your collection stays on the phone. | The most recent 400 readings; all of them go when the account does. |
| Contacts (phone numbers and email addresses) | Only if you tap “Sync contacts” in the app AND agree on the consent screen that follows, and then allow contacts access when iOS asks. The app converts each phone number and email address in your address book into a one-way SHA-256 code on your phone and uploads those codes to the Cardboard Alpha server, where each is hashed again with a secret key only we hold and stored. Only these hashes are stored: never the phone numbers or email addresses themselves, and never names. We store them so that when someone in your contacts joins Cardboard Alpha later, they can be matched to you automatically, without you syncing again, and you can be told they joined (a notification, if you have notifications on). They are used for that matching and nothing else: never for marketing, never shared, never sold, and never sent to anyone else. Names, photos, notes and the rest of the contact card are never uploaded; names stay on your phone to show your invite list. Syncing again replaces the set you uploaded before. | Until you remove them (in the app: Settings → Remove contact data, or contact us and we delete them on request), or you delete the account. Before 9 October 2026 these codes were discarded immediately after matching; syncing from that date on is what stores them. |
| Friend links | Who the contact match connected you with, including someone who joined after you synced and whose phone number or email matched your stored hashes. A friend sees your display name and collection total on their leaderboard, and you see theirs. | Until you remove them (in the app: Settings → Remove contact data), or either account is deleted. |
| Card photos | A photo the app takes to identify a card is sent to the recognition service, and a straightened crop of the card may be kept to improve identification. It is a picture of a card, never of a person. | As recognition material; the link to your account is removed when the account is deleted. |
| Live-stream card frames ("Don’t Get Cooked") | While you use this in-app feature to check a card in a live auction stream, the app captures still frames of the card shown inside its own in-app video view and sends them to the recognition service to identify it and improve future matches. Only the card rectangle is kept, never the surrounding video, chat or the person hosting the stream. | As recognition material; the link to your account is removed when the account is deleted. |
| Subscription and purchase status | If you subscribe to a paid plan, our payments processor (RevenueCat) keeps your purchase history and links it to an id tied to your account so paid features unlock on every device you sign into. A Free account has nothing to unlock and nothing is collected here. | Until you cancel the subscription or delete the account. |
| Orders, shipping address and payments | When you buy a physical item — cards from your cart, a shop accessory, a Live auction win, or a card held in the Vault — we keep the order (what, price, status, tracking) and the name and shipping address you give so it can be delivered. Card and Apple Pay payments are taken by our payments processor (Stripe) inside the app; we never see or store your full card number, only Stripe’s reference to the payment. | Your saved address goes when the account is deleted. Order records are kept for bookkeeping, detached from your account and with the address removed. |
| Live shows: chat, bids and broadcasts | Chat messages you post in a Live show are shown to everyone watching, next to your display name, and are filtered automatically for objectionable content. Your bids and wins are recorded to run the auction. If you are an approved seller and go live, your camera video and microphone audio are streamed to viewers through our video provider (LiveKit) while you broadcast. | Chat and bids are deleted with your account; a seller’s sales records are kept until support closes them out. Broadcasts are streamed, not recorded. |
| Reports and blocks | If you report a message, show, seller or user, we keep what you reported, the reason you chose and when, so a person can review it (within 24 hours) and act. People you block are listed on your phone only. | Reports: until resolved and reviewed, then for abuse-prevention records; the link to your account is removed when the account is deleted. |
| Crash and performance diagnostics | If the app crashes or runs slowly, a crash report or performance trace may be sent to our error-monitoring service (Sentry) so the problem can be fixed. It never includes your email, phone number, password or card photos. | Per our error-monitoring provider’s standard retention window. |
| Page views and in-app actions | First-party page-view and in-app action events are collected to operate the service, kept 90 days, and are not sold or shared. | 90 days. |
| Alert delivery records | What was sent, when, to which channel, and whether it succeeded — so an alert is not sent twice and a failure can be retried and explained. | 90 days. |
| API keys | A hash of each key you issue, its label, and when it was last used — so a key can be rate-limited and revoked. | Until you revoke the key or delete the account. |
| Referral link cookie and referrals | If you open a member’s referral link, a cookie (pq_ref) holds their referral code for 30 days so they can be credited if you sign up. When a referral link is opened we count the visit, and keep a keyed one-way hash of the visitor’s network address (never the address itself) to count unique visits. If you sign up, the account that referred you is recorded so they can earn their reward. If you are a member with a referral link, we keep your code and the counts of visits, sign-ups and rewards it produced. | The cookie: 30 days, or until you sign up. Raw visit records: a short rolling window, then only daily totals. The referral record: until either account is deleted. |
| Server logs | Request path, timing, status, coarse client information and IP address. Used to keep the service up, enforce rate limits, and investigate abuse. | 30 days. |
Details
- No advertising, no selling, no tracking across sites
- Your personal data is never sold, rented, or shared for anyone else’s marketing. There are no advertising pixels, no third-party analytics scripts, no cross-site trackers, and no data brokers. Nothing on this site follows you to another one.
- Marketplace links are affiliate links
- Links to marketplaces (eBay, TCGplayer) are affiliate links: we earn a commission on qualifying purchases, at no extra cost to the buyer. When you click one you leave this site. The marketplace and its affiliate network (eBay Partner Network; Impact, which operates TCGplayer’s program) may set cookies on their domains to attribute the purchase. Those cookies are theirs and are governed by their privacy notices. We do not run their scripts or pixels on our pages, and no third-party cookie is set on cardboardalpha.com by an affiliate link. We receive only aggregate, non-identifying commission reports (order totals, no names). eBay Partner Network and Impact receive the click and, on a qualifying purchase, the order value, for commission attribution; no account data from us.
- Cookies
- Two cookies, both first-party. The first is the session that keeps you signed in. It is
httpOnly(a script cannot read it),secure, andSameSite-scoped, and it holds a signed token, not your password and not your data. Signing out clears it. The second,pq_ref, is set only if you arrive through a member’s referral link. It lasts 30 days, carries only that member’s referral code, and is used solely to credit them if you sign up; it is cleared once you do. There are no advertising or analytics cookies, which is why there is no cookie banner asking you to accept any. - Who else touches it
- Only the processors needed to run the service, each handling one thing and nothing else: the application host and its managed database; an email provider, to send an alert to your address; an SMS provider, to verify a phone number and send an SMS alert; in the app, a subscription-management provider (RevenueCat), only if you subscribe, and an error-monitoring provider (Sentry), to diagnose a crash or a slow screen. They act on instructions and are not permitted to use your data for their own purposes. No one else receives it, and nothing is shared for advertising. Marketplace affiliate networks are covered separately above.
- Your rights
- You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted — including under the GDPR and the CCPA, wherever you live. In the app, Settings → Delete account removes everything at once, with no email to send: the account record, its watchlists, alert rules, phone number, push subscriptions, contact digests, friend links and collection readings. Or use the contact form with the topic “Privacy”; requests are answered within 30 days. There is no charge, and asking is never a reason to treat an account differently.
- Alerts you can stop
- Every alert channel is opt-in and individually switchable in settings. Every email carries an unsubscribe link that works without signing in. Turning a channel off stops it immediately; it is not a preference that takes days to apply.
- Text messages (SMS)
- A mobile number is collected only when you choose to add one, and is used only to send the verification codes and the alerts you set up. Mobile numbers and SMS opt-in consent are never sold, rented or shared with third parties or affiliates for their marketing or promotional purposes; the SMS provider above receives a number only to deliver those messages. Reply STOP to any text to opt out, or HELP for help.
- Security
- Passwords are bcrypt-hashed and never recoverable in plaintext. Traffic is HTTPS only. Credentials and provider secrets live in environment configuration, never in the codebase and never in a log. Access to production data is limited to the operator of this site.
- Children
- This is a market-data tool, not a service for children. Accounts are not knowingly created for anyone under 16. If you believe a child has registered, write to the address above and the account will be removed.
- Where data is held, and changes to this policy
- Data is stored and processed on servers in the United States. If this policy changes substantively, the date above changes with it, and a change that materially affects how your data is used will be announced to account holders by email before it takes effect.