How your data is protected
The technical companion to our Privacy Policy.
If you care about the details, here is exactly how your data is stored and guarded. No hand-waving.
Short version: your inventory lives in a single database record that only your logged-in account can read, enforced at the database level. Provider secrets never reach your browser. We sell nothing and run no ad trackers.
Where your data lives
Your data is stored in a managed PostgreSQL database run by Supabase. Your whole inventory, the cards, costs, grading details, sales, and settings you enter, is held as a single record tied to your account id. Your nightly value-history snapshots, and any calls you choose to publish to the public track record, are separate records, also tied to your account id. Supabase encrypts this data at rest and is SOC 2 Type II compliant.
Who can read it: Row Level Security
This is the part that actually matters. The database has Row Level Security (RLS) turned on. Every row carries the owner's account id, and database policies only ever return a row when the request is authenticated as that owner. There is no application code path, and no shared key, that can hand one account another account's data.
You will notice a "publishable" API key sitting right in this site's source code. That is intentional and standard. It identifies the project, not you, and on its own it grants zero access to any private row. Reading your data requires a live session that the database checks against each row's owner. We confirmed that an unauthenticated request with that public key returns nothing from the private tables.
The only thing anyone can read without logging in is the public track record, which is exactly what it sounds like: the calls we deliberately publish, with their math. It does not expose account details.
In transit and at rest
- Everything travels over HTTPS / TLS. There is no unencrypted path to the database or the app.
- Data is encrypted at rest by the database provider.
Accounts and passwords
- Sign-in is handled by Supabase Auth. Your password is stored only as a salted one-way hash. The app never sees it, never stores it, and cannot reverse it.
- Logged-in sessions use short-lived, signed tokens (JWTs), not your password.
- The app itself never asks you to type a password anywhere except the official sign-in box.
Secrets stay on the server
When the app needs market data, card images, population reports, or a PSA certification lookup, it does not call those services from your browser. The request goes through our own serverless functions, and the API keys for those providers live server-side only. They are never shipped to your browser. When the app looks up a card, it sends the card you are searching for plus your own session token, and nothing about the rest of your inventory.
Who else touches your data
A short, fixed list of providers, used strictly to run the app:
Supabase
Database and account sign-in. This is where your data lives.
Netlify
Website hosting and the serverless functions that hold provider keys.
CardSight
Card identity, images, population and market data. Receives the card you are searching, not your inventory.
PSA
Only when you look up a slab, we send that one certification number to fetch the card.
Cloudflare
Privacy-first page-view analytics. No cookies, no cross-site tracking, no personal data.
eBay
When you tap an eBay link you go to eBay with the card's search terms and our affiliate tag. No personal data or inventory is passed.
We do not sell your data, we do not run ad networks, and we use no cross-site advertising trackers.
On your device
Your browser's local storage holds only conveniences: an unsaved draft of whatever you are analyzing, and your display preferences (theme, layout). No card data is tucked away there, and clearing your browser storage removes it.
Your control
- Export: download a full backup of everything, in JSON and CSV, anytime from inside the app.
- Delete: remove your data from the database from the app's settings, or email us for a complete account deletion.
- Ask: want a copy, a correction, or a deletion confirmed? Email us.
Found a hole?
If you believe you have found a way to reach data you should not, please tell me before anyone else and I will fix it quickly. Email colemanbayley@gmail.com. Honest security reports are genuinely welcome.