This Privacy Policy describes how CardRanks LLC (“CardRanks,” “we,” “us,” or “our”) collects, uses, and shares your personal information when you visit, use, or interact with our website at https://cardranks.app or any related Services we provide.
By using CardRanks you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.
1. Who We Are
CardRanks LLC is a Washington limited liability company. Our mailing address is 100 N Howard St. Ste. R, Spokane, WA 99201. You can reach us at support@cardranks.app.
2. What Is CardRanks
CardRanks is a web platform for organizing, ranking, and dueling collectible trading cards. Users create profiles, build personal card collections, run head-to-head card comparisons (duels) using an Elo ranking system, and share campaigns, rankings, and community posts with other players.
3. Information We Collect
3.1 Information You Provide Directly
- Email address (for authentication and communications)
- Username and display name (chosen during signup or in your profile)
- Password (hashed; we never store plaintext passwords) — only for email/password sign-in
- Profile content you choose to share (bio, avatar emoji, favorite cards)
- User-generated content (campaigns, community posts, card data you contribute)
- Photos of cards you scan or upload, and any sold-comp notes, dates, prices, and listing links you attach to cards in your collection
- Communication preferences (email and notification settings)
3.2 Information from Third Parties
When you sign in via Google, we receive your name, email address, and profile picture from Google’s OAuth service. We do not access your Google contacts, calendar, drive, or any other Google product data.
3.3 Information Collected Automatically
- IP address and approximate geographic location (country/city, derived from IP)
- Browser type, version, device type, and operating system
- Usage data: pages visited, features used, duels played, session duration
- Cookies and similar technologies (see our Cookie Policy)
- Server and error logs (for diagnostics and security)
3.4 Marketplace Data (Market Watch)
If you use Market Watch (available on paid plans), we additionally process:
- the cards, grades, and price thresholds you choose to watch, and your alert history;
- marketplace listing data we retrieve on your behalf from eBay (such as listing titles, prices, item identifiers, listing URLs, seller usernames, and images), which we cache to power alerts and the “See what’s available now” feature;
- your daily usage of the feature, to enforce plan limits.
When we query eBay’s API we send only the card search terms needed to find listings. We do not send your CardRanks account, identity, email, or other personal information to eBay.
3.5 Affiliate Links and Referral Tracking
CardRanks participates in the eBay Partner Network, eBay’s affiliate program. Some links to eBay listings in Market Watch and elsewhere in the Services are affiliate links. When you click an affiliate link:
- eBay receives the click together with the standard browser and device information your browser sends to any site you visit (such as IP address, user-agent, and referring page), under eBay’s privacy notice;
- eBay places a referral cookie that attributes your subsequent eBay activity to CardRanks for a limited window (currently 24 hours), and we may earn a commission if you make a qualifying purchase;
- we attach a non-identifying reference tag to the link (for example, an opaque card or campaign identifier) so we can measure which links perform. We do not include your name, email, account ID, or other identifying information in that tag.
eBay provides us with aggregate commission and performance reports — for example, that a qualifying purchase occurred in a given category and its value — but does not tell us which individual user made a purchase. These affiliate links are used only to attribute referrals and earn commissions; they are not used for cross-context behavioral advertising or to build advertising profiles about you. See our Terms of Service for our affiliate disclosure.
3.6 Card scans and unpublished collection cards
If you use Scan a card, we process a photo of a card you photograph or upload so we can search our catalog and, if you choose, save it to your profile. Optical character recognition runs in your browser — the photo is not sent to a third-party OCR vendor. We store the image in our card-image storage only when you save the scan (a cancelled capture is not uploaded). A scan that does not match a catalog card is kept as a personal, unpublished card on your profile until a catalog editor either adds it to the public catalog (once identity and market-link fields are complete) or declines to add it. Declined cards remain on your profile so you can rank them and record your own sold-comp notes and links; those manual prices are not used as community market data. If an editor later runs our existing enrichment tools on a queued scan, the stored photo may be sent to xAI (Grok) for the same vision reads we already perform on catalog card images (for example, artist and energy type).
4. How We Use Your Information
We use your personal information to:
- Deliver and operate the Services (account authentication, personalized experience, ranking calculations)
- Identify cards you photograph, save unmatched scans to your personal collection, and (if you or a catalog editor request it) enrich those photos with the same vision tools we already use on catalog images
- Operate Market Watch — scan marketplaces for cards you watch, send price alerts, and provide on-demand availability lookups (paid plans)
- Operate our participation in the eBay Partner Network affiliate program and measure the performance of referral links
- Enable user-to-user features (community posts, public profile viewing, leaderboards)
- Send administrative emails (signup confirmation, password reset, important service notices)
- Respond to your inquiries and provide support
- Improve the Services by analyzing usage patterns and trends
- Detect, prevent, and respond to security incidents, fraud, abuse, and Terms violations
- Send marketing and promotional communications about CardRanks features (only if you opt in or maintain default notification preferences)
- Comply with legal obligations
5. Legal Bases for Processing (GDPR / UK GDPR)
If you are in the European Economic Area, UK, or Switzerland, we rely on the following legal bases:
- Performance of a contract — to deliver the Services you signed up for
- Legitimate interests — to operate, improve, and secure the Services
- Consent — for marketing communications and non-essential cookies (you may withdraw consent at any time)
- Legal obligation — when required by law
6. Who We Share Your Information With
We do not sell your personal information. We share information with the following categories of service providers:
- Supabase, Inc. — authentication and database hosting (privacy policy)
- Vercel Inc. — web hosting and deployment (privacy policy)
- Google LLC — Google Sign-In (OAuth identity), only if you used Google to create or sign in to your account (privacy policy)
- Resend, Inc. — transactional email delivery (privacy policy)
- Cloudflare, Inc. — DNS, CDN, and email routing (privacy policy)
- Functional Software, Inc. (Sentry) — error monitoring (privacy policy)
- PostHog Inc. — product analytics (privacy policy)
- eBay Inc. — marketplace listing data via the eBay API, used to power Market Watch price alerts and availability lookups (we send card search terms to eBay but not your personal information); and the eBay Partner Network affiliate program, where clicking an affiliate link sends your click and standard browser information to eBay directly from your browser, as described in “Affiliate Links and Referral Tracking” above (privacy notice)
- xAI — card-image vision used by catalog enrichment (artist, energy type, and similar reads on stored card photos, including queued user scans an editor chooses to enrich) (privacy policy)
We may also disclose information when required by law, to comply with a legal process, to protect our rights or property, or in connection with a merger, acquisition, or sale of assets.
eBay Marketplace Account Deletion. As a registered user of the eBay API, we receive eBay’s account closure/deletion notifications. If we hold any cached marketplace data associated with an eBay account that has been closed or deleted, we remove it in response to those notifications.
7. Data Retention
We retain your personal information for as long as your account is active and for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where retention is required by law.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access your personal information
- Correct inaccurate or incomplete information
- Delete your information
- Restrict or object to processing
- Data portability (receive a copy in a structured format)
- Withdraw consent at any time
You can exercise most of these rights directly through your /profile page (view, edit, delete account). For requests we can’t handle automatically, email support@cardranks.app.
9. Children’s Privacy
CardRanks is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete that information promptly.
10. International Data Transfers
Our service providers may store and process your personal information in countries outside your country of residence, including the United States. We rely on appropriate safeguards (such as standard contractual clauses) for international transfers where required by law.
11. Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information. These include encryption in transit (HTTPS), row-level database security, hashed passwords, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure. You acknowledge that you use the Services at your own risk.
If we become aware of a security breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.
12. California Privacy Rights (CCPA / CPRA)
If you are a California resident, you have the following rights:
- Right to know what personal information we collect, use, and share
- Right to delete personal information
- Right to correct inaccurate information
- Right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising)
- Right to non-discrimination for exercising these rights
To exercise these rights, use your /profile page or email support@cardranks.app.
13. Other US State Privacy Laws
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, and other US states with comprehensive privacy laws have similar rights to those described above. You may exercise these rights through the same channels.
14. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, and analyze usage. For details, see our Cookie Policy.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the “Last updated” date at the top of this page and, where appropriate, by displaying a prominent banner in the Services or by emailing registered users.
16. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
CardRanks LLC
100 N Howard St. Ste. R
Spokane, WA 99201
United States
support@cardranks.app