Privacy
Last updated: 21 August 2026
Plain version: we collect what we need to show your cards and almost nothing else. We don't sell your data. Your rack is public by default and you can change that.
What we collect
Your email address. Used to sign you in. You can sign in with Google, with a password, or with a one-time link we email you. If you choose a password it is stored hashed by our authentication provider — we never see it and we cannot recover it for you. We email you to sign in and, rarely, about something that affects your account.
Your profile. Handle, display name, bio, avatar — whatever you choose to put there. All of it is public if your rack is public.
Your cards. Cert numbers, grader, card details, and any slab photos you upload.
What you paid, if you tell us. Cost basis is optional and private. It is never shown on your public rack, never included in a shared link, and technically restricted at the database level so it isn't returned to anyone but you — not just hidden in the interface.
Rack views. We count how many times a rack is viewed so we can show you that number. We do not record who viewed it.
Basic technical data. Standard server logs, and visitor analytics from our hosting provider.
What is public
Your rack is public by default. Anyone with the link — cardrack.ai/yourhandle — can see your handle, bio, and the cards on your rack. That is the point of the product, but you should know it before you add anything.
You can make it private in Settings at any time.
Values are private by default. Estimated values are hidden until you deliberately switch them on. Cost basis is never public under any setting.
What we don't do
We don't sell your personal information. We don't share it with advertisers. We don't buy data about you from anyone else. We don't use your collection to train models.
Who we share data with
We use these services to run CardRack. Each sees only what it needs:
| Service | What it handles |
|---|---|
| Supabase | Database, sign-in, and photo storage |
| Lovable | Application hosting and visitor analytics |
| PSA | We send a cert number to look up card details. We don't send anything about you. |
| eBay | We read public listings to build market data. We don't send them your information. |
| MLB Stats API | Public player news for cards you own. We don't send them your information. |
We may also disclose information if legally required, or to investigate fraud or abuse on the platform.
Your choices
- Make your rack private — Settings
- Hide or show values — Settings
- Remove a card — from the card's page
- Delete your account and everything on it — email hello@cardrack.ai and we'll action it within 30 days
Depending on where you live you may have additional rights to access, correct, port, or delete your data. Email us and we'll honour them.
Children
CardRack isn't intended for anyone under 13, and we don't knowingly collect information from children. If you believe a child has given us information, email us and we'll remove it.
Changes
If we change this meaningfully, we'll email registered users rather than quietly updating the date at the top.