Privacy policy

1. What we collect

• Account details: your email address. If you sign in with a password, we store only a one-way hash of it, never the password itself. If you sign in through our login service (auth.cardscry.jp), we receive an account identifier and your email address from it; if you use Google there, Google shares your name and email address with that service.
• What you add: your inventory (cards, condition, language, quantity and the price you paid), your card list, and cards you scan (set, collector number, the text recognised from the card and how confident the recognition was).
• Photos you scan are processed in your browser and are not uploaded or stored by us.
• Technical data: like most websites, our servers log your IP address, the pages you request, the time and your browser type. Your IP address is also held briefly in memory to limit repeated failed sign-ins.

2. Cookies and browser storage

We use your browser's local storage to keep you signed in, remember your language, and keep your card list while you are signed out. During sign-in through our login service, a short-lived cookie protects the sign-in from forgery, and the login service sets its own session cookies. Cloudflare, which sits in front of the site, may set its own cookies to tell people from bots. We do not use analytics, advertising or tracking cookies.

3. How we use it

• To run your account and its features: inventory, list, scans and price lookups.
• To keep the service secure, for example by limiting repeated failed sign-ins.
• To send account emails such as address verification and password resets.
• To find and fix problems.

We do not sell your information, show ads, or build profiles about you.

4. Who else is involved

We share information only as needed to run the site:

• Cloudflare provides the network in front of the site: every request, including sign-ins, passes through it, and it protects the site from attacks and caches images.
• Oracle Cloud hosts the gateway that public traffic passes through on its way to our server.
• An email delivery provider sends account emails on our behalf.
• Google, only if you choose to sign in with Google, under Google's own privacy policy.
• jsDelivr serves the components the card scanner downloads, so it receives your IP address when you use the scan page.

Card images and prices are fetched by our server, so your browser does not contact those sources. Links to stores and marketplaces (such as Hareruya, TCGplayer, Cardmarket and Mana Pool) take you to their sites, which have their own policies. Some of these providers may process data outside Japan.

5. How long we keep it

Account data is kept until you ask us to delete your account. After deletion it remains in our backups for up to 14 days, until they are replaced. Server logs are kept only as long as needed for security and troubleshooting.

6. Your choices and rights

You can ask us to show you the personal information we hold about you, correct it, stop using it, or delete your account and its data. You can change the email address and password of your sign-in account in the login service; CardScry picks up the new email address the next time you sign in.

To make a request, email [email protected]

7. Security

Connections to the site are encrypted, passwords are stored only as hashes, failed sign-ins are rate limited, and access to our servers is restricted. No system is perfectly secure, but we take reasonable steps to protect your information.

8. Changes to this policy

If we change this policy we will update this page and the date above. For significant changes we will let signed-in users know.

9. Contact

Questions about this policy or your data: [email protected]