Privacy Policy

Last updated: September 11, 2026

Card Gallery ("Card Gallery," "we," "us," or "our") provides a mobile application and related web services (collectively, the "Service") that let collectors catalog, display, cast, and share their graded trading card collections. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

Information you provide

Account information. When you create an account, we collect your email address and authentication credentials. If you sign in with Apple, we receive the identifier (and, if you allow it, the name and email) that Apple shares with us.
Collection data. The cards you add — including certification numbers, card details, images, grades, values, notes, and any collections, frames, or showcases you create.
Subscription information. When you subscribe, we receive your subscription status and purchase history from Apple (through our subscription manager, RevenueCat) so we can manage your access. Payments are processed by Apple; we do not collect or store your payment card details.
Communications. If you contact support, we keep the messages you send and our replies.

Information collected automatically

Usage and device data. Basic technical information needed to operate and secure the Service, such as device type, operating system, and app version, plus limited product-interaction metrics (for example, casting activity) used to understand and improve features.
Website analytics and advertising pixels. On cardgallery.io (not in the app) we use the Triple Whale pixel, the Meta pixel, and the TikTok pixel. They use cookies and browser storage to record pages viewed, taps on our App Store buttons, referring site and campaign, and basic device and browser information, so we can measure how people find Card Gallery and how our ads perform. In the EEA, UK, and Switzerland these pixels run only after you accept them in the banner shown on your first visit.
Casting sessions. When you cast to a TV or publish a showcase, the cards and display settings for that session are stored so the receiving screen or web page can render them.

Stored on your device

Your card vault is stored primarily on your device. Some data is synced to our servers to power features that can't run on the phone alone — public showcases, the TV cast receiver web page, and value/stat enrichment.

2. How We Use Your Information

To provide, maintain, and improve the Service;
To create and manage your account and authenticate you;
To enrich your cards with images, market values, and player/team statistics;
To power casting to your TV and the public showcases you choose to publish;
To respond to your support requests;
To protect against fraud, abuse, and security threats; and
To comply with legal obligations.

3. How Your Information Is Shared

We do not sell your personal information. The app does not track you across other companies' apps or websites. Our website uses the advertising and analytics pixels described in Section 1, which is the only way we share data with advertising partners. We share information only as described below:

Service providers. We use trusted vendors to run the Service, including Supabase (authentication, database, and storage), Apple (Sign in with Apple, payments, and app distribution), RevenueCat (subscription management), Cloudflare (web hosting and content delivery), and Resend (support-email delivery). These providers process data on our behalf under their own terms and privacy commitments.
Data sources. To enrich cards we query third-party data providers (for example, PSA grading and population data, market-value and pricing data, sports-statistics services, and an AI service used to generate short card descriptions). We send the minimum needed (such as a certification number or player name) to retrieve details.
Advertising and analytics partners. Through the website pixels, Triple Whale (attribution and analytics), Meta, and TikTok (advertising measurement) receive the browsing and device information described in Section 1. Meta and TikTok may use this data under their own privacy policies, including to show you Card Gallery ads and to measure them. When you start a free trial or subscribe, we also send Triple Whale your email address and purchase details so the purchase can be matched to the visit that led to it.
Public showcases. If you choose to publish a showcase or share a link, the cards and details in that showcase become viewable by anyone with the link. You control whether to publish and what it contains.
Legal and safety. We may disclose information if required by law or to protect the rights, safety, and security of our users and the Service.
Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Your Choices & Rights

Privacy controls. Public sharing is off by default. You decide whether to publish a showcase and can unpublish it at any time.
Access and deletion. You can delete your account and all associated data directly in the app under Settings → Delete account, which permanently removes your account and synced data from our systems. You can also request access or deletion by contacting us at the email below.
Device permissions. You can control camera, local network, Bluetooth, and Face ID permissions in your device settings.
Cookies and pixels. In the EEA, UK, and Switzerland the website pixels load only if you accept them, and you can change your choice by clearing this site's data in your browser, which brings the banner back. Anywhere else you can block them with browser settings or extensions. To opt out of Meta's ad personalization, use your Meta ad preferences; for TikTok, use the ad settings in the TikTok app.
Regional rights. Depending on where you live (for example, the EEA/UK or California), you may have additional rights to access, correct, port, or delete your information, and to object to or restrict certain processing. Contact us to exercise these rights.

5. Data Retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your synced personal data, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Security

We use reasonable administrative, technical, and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

8. International Users

We operate the Service from the United States and may process and store information in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in locations with data-protection laws different from your own.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated policy.

10. Contact Us

Questions about this Privacy Policy or your data? Contact us at [email protected].