Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address and password (stored as a hash). We do not collect real names, physical addresses, or payment information at this time.

1.2 Collection Data

When you add cards to your collection, we store the card identity information you provide (player, set, year, card number, variant, condition, grade) and any images you upload. This data is associated with your user account.

1.3 Contribution Data

When you contribute to the community catalog (opt-in mining, corrections, evidence uploads), we store your contributions with attribution to your account for reputation tracking and audit purposes.

1.4 Automatically Collected Data

We collect standard web analytics data including IP address, browser type, device information, pages visited, and interaction patterns. This data is used for service improvement, security, and abuse prevention.

1.5 Card Images

Card images you upload are stored in secure cloud storage. Images submitted with collection-only visibility are private to your account. Images submitted with opt-in mining visibility may be reviewed by administrators and, if approved, displayed in the public catalog.

Photos taken on phones and cameras often carry embedded metadata (EXIF) — including the date a photo was taken and, on many devices, the GPS coordinates of where it was taken. When you upload a card image, we strip this metadata on our servers before the image is stored, so it is never shown to other users and is not retained by us. (We also automatically rotate images to display right-side up.) Card photos must show the card only; submissions containing faces or personal surroundings are rejected during review.

1.6 Profile Information

You may set a username, a profile image, and a short bio, and you can earn badges (such as CardWiki Claim status) through your participation. Section 3 explains which of these are visible to other people and which are not.

1.7 Sign-up Campaign Data

If the link you used to sign up carries campaign tags (the utm_source, utm_medium and utm_campaign values that ads, newsletters and partner posts add to a web address), we save those three values with your new account. They tell us which campaign brought you to CardWiki, so we can judge where our promotion works. We don't use a cookie for this, and we save nothing else about the visit this way, so it happens whether or not you accept analytics cookies. These saved values are private: they are never shown to other users, and we don't share them. If you accept analytics cookies, Google Analytics also receives them with your sign-up event, as section 8 describes. They are removed with the rest of your private account data if you delete your account (section 4).

2. How We Use Your Information

3. Data Sharing & Public Visibility

We do not sell your personal data. Some information is public by design, and we share data only in the circumstances below.

Your public profile. Every member has a public profile. The only details visible to other users and visitors are your username, profile image, and any public badges you have earned. Nothing else is public — your email, real name, location, phone number, IP address, image geolocation, private holdings, and account settings are never shown on your profile or anywhere else in the public catalog.

• Public catalog: Approved contributions become part of the public catalog (opt-in only)
• CardWiki's own promotion: card photos you submit for the public catalog on or after September 28, 2026 that are approved and published may appear on our website and in our social media posts, advertising and press materials, including on the platforms and publications that carry them. If CardWiki credits a photo, it uses your username only. Section 6 of the Terms of Service describes this license.
• Service providers: We use Supabase for our database, authentication and image storage; Postmark to send account and service emails; and card identification services that process uploaded card images to return a match. These providers act on our instructions, may not use your data for their own purposes, and are located in the United States.
• Third-party links: When clicking through to third-party marketplaces, the destination site may receive referral data per standard web protocols
• Legal requirements: If required by law, subpoena, or to protect the rights and safety of CardWiki and its users

4. Data Retention & Account Deletion

Active account data is retained for the lifetime of your account.

Published contributions are permanent. When you contribute to the public catalog — card images, card details, or sales data that are approved and published — those records become a permanent part of the shared community dataset. If you delete your account, they stay in the public catalog, credited anonymously to “Community” instead of your username.

You can request deletion of your account at any time by emailing support@cardwiki.ai. We respond to requests within 30 days. We grant them in most cases and remove your private account data and your collection.

What we keep. Some records are retained even after an account is deleted, because removing them would break the shared catalog or leave us unable to run the service safely:

• Contributions you published to the public catalog, credited anonymously to “Community”, as described above.
• A record that the account existed, together with its sign-up and activity history, for record keeping and database integrity.
• Security and moderation records, including records of abuse, fraud or violations of our Terms, so that we can prevent repeat abuse. These are kept for as long as needed for that purpose.
• Anything we are required to keep by law, or that we need to establish, exercise or defend a legal claim.

The records in the last three items are accessible only to CardWiki administrators and are never published, sold or shared for advertising. Deleted data may also persist in encrypted backups for a limited period before those backups age out. We handle individual situations case by case and may decline a deletion request, in whole or in part, where one of the reasons above applies.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and private personal data (published catalog contributions remain part of the shared record — see Section 4)
• Export your collection data in a portable format
• Withdraw consent for optional data processing (e.g., opt-in mining)
• Object to processing based on legitimate interest

To exercise these rights, contact support@cardwiki.ai. We will respond within 30 days.

6. Minors and Children's Privacy

Trading cards are a hobby many collectors start young, and younger collectors are welcome on CardWiki. If you are under 18, you may use the Service only with the knowledge and approval of a parent or legal guardian. Accounts belonging to users under 18 are subject to additional limitations, described in Section 3 of our Terms of Service.

We do not currently ask for your date of birth at sign-up, and we do not collect more personal information from a minor than we collect from any other member. We reserve the right to request information reasonably necessary to confirm an account holder's age, or to confirm a parent or legal guardian's consent, and to limit, suspend, or close an account where that is not provided.

If You Are a Parent or Guardian

If you believe your child has created an account or used CardWiki without your permission, please contact us at support@cardwiki.ai. In your message, include the email address associated with the account so we can locate it. Upon verification, we will promptly delete the account and any associated personal data from our systems.

A parent or legal guardian who has consented to a minor's account may contact us at the same address at any time to review what we hold, restrict how it is used, or close the account and have its personal data deleted.

We take minors' privacy seriously. Where the law that applies to you sets an age threshold below which a service may not collect personal information without verified parental consent, we do not knowingly collect personal information from anyone below that threshold. If we become aware that we have, we will delete it as quickly as practicable.

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, row-level security (RLS) on database tables, and role-based access controls. No system is perfectly secure; we cannot guarantee absolute security.

8. Cookies and Tracking Technologies

What We Use

We use cookies and similar technologies to operate and improve CardWiki. We group these into two categories:

Strictly Necessary. These cookies are required for the site to function. They include session authentication tokens and your cookie consent preference. Because they are essential to the service, they cannot be disabled.

Analytics. With your consent, we use Google Analytics 4 to collect anonymized data about how visitors use the site — including which pages are visited, how long sessions last, and where traffic originates. This data is processed by Google and helps us understand what's working and improve the product. We also use it to measure our own promotion, such as how many sign-ups a campaign brought in. We do not use it to show you personalized ads or to build advertising profiles of you.

Your Choices

When you first visit CardWiki, you will see a consent banner. You can accept or decline analytics cookies at that time. You may change your preferences at any time by clicking Cookie Preferences in the footer.

No Advertising Cookies

We do not serve ads, and we do not allow any third-party advertising networks to set cookies on your device through CardWiki.

Affiliate Links

Some outbound links to marketplaces (for example, eBay) include affiliate tracking parameters in the link itself. CardWiki does not set affiliate cookies on your device; after you click through, the destination marketplace may set its own cookies under its own privacy policy. We may earn a commission on qualifying purchases.

Cookie List

Third-Party Processors

Google Analytics data is processed by Google LLC. For more information, see Google's Privacy Policy and Google's data safeguarding terms.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification. Continued use after changes constitutes acceptance.

10. Contact

For privacy questions or data requests, contact: support@cardwiki.ai. For legal notices, contact legal@cardwiki.ai.

11. Who We Are

CardWiki is operated by Cardwiki LLC, 3 Monroe Pkwy Ste P 823, Lake Oswego, OR 97035, United States.

We operate from the United States, and your information is stored and processed in the United States. If you use CardWiki from another country, you are sending your information to the United States.