Privacy Policy
Effective date: August 21, 2026 · Last updated: August 21, 2026
cardVendo is a point-of-sale and inventory app for trading-card dealers. This policy explains what the app collects, why, who else receives it, and what control you have. It applies to the cardVendo mobile app on iOS and Android.
We have tried to write this so it is actually readable. Where a plain-language summary and the detail below differ, the detail governs.
Summary
- We collect the account email you sign up with, and the inventory and sales data you enter.
- We do not run advertising, analytics, or tracking software of any kind.
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- Photos you attach to cards are stored at unlisted but publicly reachable URLs. Please read Card photos are publicly reachable before attaching a photo.
- You can permanently delete your account and all of its data from inside the app, without contacting us.
Who is responsible for your data
cardVendo is operated by Zade Shammout, an independent developer in the United States. For privacy questions, or to exercise any right described in this policy, contact privacy@cardvendo.app.
If you are in the European Economic Area, the United Kingdom, or Switzerland, we act as the data controller for the information described here.
What we collect
Information you give us directly
Account information. Your email address and a password. Passwords are hashed by our authentication provider and are never visible to us in readable form. If you sign in with Apple in a future version, we receive the email address Apple releases to us, which may be a private relay address you can revoke at any time.
Inventory and business records. Everything you enter to run your business. This includes card names, sets, card numbers, conditions, grades and certification numbers, quantities, storage locations, acquisition dates, the cost you paid, market values, sale and trade prices, cash amounts, the payment method category you select (such as “Cash” or “Venmo”), returns, event names and dates, and expenses.
These records are commercially sensitive. They describe your margins and your inventory. We treat them as confidential and we do not use them for any purpose other than operating the app for you.
Photos. Photographs of cards you take in the app or select from your photo library. See Card photos are publicly reachable for how these are stored.
Card images sent for recognition. When you use the scan feature, the app sends a cropped photograph of the card to our server, which forwards it to a third-party recognition service to identify the card. We do not attach your name, email, or account identifier to that image, and the recognition provider does not receive your IP address, because the request is made by our server rather than by your phone.
Information collected automatically
Push notification token. If you enable price alerts and grant notification permission, we store a push token issued by Expo, along with whether the device is iOS or Android, so alerts can reach you. We do not store any other device identifier. Denying or revoking notification permission stops this.
Server logs. Our hosting provider records standard request logs, which include IP addresses and timestamps, for security, abuse prevention, and debugging. These are retained by that provider on its own schedule and are not combined with your inventory data by us.
On-device storage. Your session token is kept in the operating system's secure keystore. Sales made while offline are queued in local app storage on your phone until they sync. This data stays on your device and is removed when you sign out or uninstall the app.
What we do not collect
We want to be specific rather than vague, because “we may collect” language is often used to reserve rights that are never exercised. As of the effective date above, cardVendo contains:
- No advertising software and no advertising identifiers. We do not serve ads.
- No analytics or product-telemetry software. We do not record screen views, taps, sessions, or funnels.
- No crash-reporting or session-replay software.
- No location collection. The app never requests or reads your device location.
- No access to your contacts, calendar, microphone, health data, or files outside the photos you deliberately choose.
- No payment card numbers, bank details, or government identifiers. cardVendo records only which payment method category you selected for a sale. It never processes a payment and never sees a card number.
- No purchase or use of personal information from data brokers.
If this ever changes, we will update this policy and, where the change is material, tell you in the app before it takes effect.
Card photos are publicly reachable
Please read this section carefully, because it is the one place where cardVendo's behavior may not match your expectations.
Photos you attach to cards are stored in a public storage bucket. Each photo is saved at a long, randomly generated address that is not listed, indexed, or linked anywhere. However, that address is not password-protected. Anyone who obtains the URL - for example, because you shared it, or because it appeared in an export - can view the photo without signing in.
In practice these addresses are not guessable. But we describe them as unlisted rather than private, because that is the accurate word, and we would rather you make an informed choice than rely on an assurance we cannot honestly give.
Practical guidance:
- Photograph the card, not your surroundings. Check what else is in frame.
- Do not photograph anything containing personal information, such as an invoice, a shipping label, an ID, or a screen showing a customer's details.
- If you need a photo removed, delete the card in the app, or delete your account, and the underlying file is deleted with it.
We are aware of this design and may tighten it in a future release. If we do, this section will be updated.
Do not enter other people's personal information
cardVendo is built to track cards, not customers. There is no field in the app intended to hold a buyer's name, phone number, address, or any other detail about another person.
Please do not type such information into free-text fields such as storage location or card notes. If you do, you become responsible for that information under applicable privacy law, and we may be unable to respond to a request from that person because we have no way to find them in your records.
How we use your information
We use your information only to:
- Create and authenticate your account.
- Store, display, and sync the inventory and sales records you create.
- Calculate profit, margin, and per-event profit and loss.
- Identify cards you scan and look up their market prices.
- Send the price alerts you configure.
- Keep the service secure, diagnose faults, and prevent abuse.
- Respond to you when you contact us.
We do not use your data to train machine-learning models. We do not profile you. We do not make automated decisions that produce legal or similarly significant effects.
Who else receives your information
We use a small number of service providers. Each receives only what it needs to perform its function, and none is permitted to use your information for its own purposes.
| Provider | What it receives | Why | Their policy |
|---|---|---|---|
| Supabase | Account email, all inventory and sales records, photos, push token, IP address in logs | Database, authentication, file storage, and server functions | supabase.com/privacy |
| Expo | Push token, device platform | Delivering price-alert notifications | expo.dev/privacy |
| CardSight | A cropped photograph of a card, with no account identifier and no IP address from you | Identifying scanned cards | cardsight.ai |
| Pokémon TCG API, Scryfall, optcgapi | The card name or number being looked up, and your device's IP address | Card catalog data and market prices | scryfall.com/privacy |
| Apple, Google | App distribution and, on iOS, push delivery | Operating the app stores and notification infrastructure | apple.com/legal/privacy |
Two points worth calling out.
Catalog lookups are made by your phone. Because the app queries the card catalogs directly rather than through our server, those providers can see your device's IP address and the card you are looking up. Recognition scans work the other way: those go through our server, so the recognition provider sees neither.
We do not control what third parties retain. We send them the minimum described above, but their retention periods are governed by their own policies, linked in the table.
We may also disclose information if we are legally required to, or where necessary to protect our rights or someone's safety. We will not do so voluntarily where we have a lawful basis to refuse.
Links out of the app
The app offers shortcuts to look up comparable sales on eBay, TCGplayer, and PriceCharting. Tapping one opens that site with your search terms. Those sites are independent of us, they receive your IP address and search query, and their own privacy policies apply once you leave cardVendo.
We do not sell or share your information
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done either in the twelve months preceding the effective date of this policy.
How long we keep it
We keep your account and its records for as long as your account exists, because they are the working records of your business.
When you delete your account, we delete your authentication record, every inventory, sale, trade, event, expense, and alert associated with it, and your stored card photos. This is immediate and permanent, and we cannot restore it afterward. Please export your data first if you may want it.
Backups and provider-level logs may persist for a short period after deletion as part of ordinary infrastructure operation, and are overwritten on their normal cycle.
Deleting your account
You can delete your account entirely from within the app:
Profile → Delete account
You will be asked to confirm by typing DELETE, and offered the chance to export your data first. No email, form, or request to us is required.
If you would prefer we do it for you, write to privacy@cardvendo.app from your account's email address.
Your rights
If you are in the EEA, the UK, or Switzerland, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. You may also lodge a complaint with your local supervisory authority.
Our legal bases are: performance of our contract with you, for operating your account and storing your records; legitimate interests, for security and abuse prevention; and consent, for push notifications and camera or photo access, each of which you can withdraw at any time in your device settings.
If you are in California, you have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing - though as stated above, we do neither. We will not discriminate against you for exercising these rights.
Everyone, wherever you are, may use the same rights on request. We would rather apply one standard than a different one per jurisdiction.
The fastest route for access and deletion is the in-app export and delete-account features. For anything else, email privacy@cardvendo.app and we will respond within 30 days.
International transfers
Our infrastructure is operated in the United States. If you use cardVendo from outside the United States, your information is transferred to and stored there, under safeguards including the standard contractual clauses where required.
Security
Your records are protected by row-level access rules that restrict them to your own account, transport encryption in transit, and encryption at rest by our hosting provider. Session tokens are held in your device's secure keystore.
Card photos are the documented exception, described in Card photos are publicly reachable.
No system is completely secure. We cannot guarantee that your information will never be accessed without authorization, and you use cardVendo with that understanding. If a breach affects your personal information, we will notify you and any required regulator as the law requires.
Children
cardVendo is not directed at children. It is intended for people aged 13 and over, and aged 16 and over in the European Economic Area and the United Kingdom. We do not knowingly collect personal information from anyone below those ages. If you believe a child has created an account, contact privacy@cardvendo.app and we will delete it.
Changes to this policy
We may update this policy as the app changes. The effective date at the top always reflects the current version. If a change materially affects how we handle your information, we will give notice in the app before it takes effect, and where the law requires it, ask for your consent.
Contact
If you are unsatisfied with our response, and you are in the EEA or the UK, you may complain to your national data protection authority. For product help rather than privacy questions, see Support.