Privacy Policy

This Privacy Policy explains how the operator of CheckCardValue (“CheckCardValue”, “we”) collects, uses and shares information when you use https://checkcardvalue.com (the “Service”). The short version: photos you scan without an account are not stored; signed-in scan photos are deleted after 30 days; your collection stays until you delete your account; and we never sell your personal information.

1. Information we collect

• Account information: your email address, a salted hash of your password (we never store the password itself), when you confirmed your email, and the sessions you're signed in on (IP address and browser).
• Card photos you scan. If you're not signed in, the photo is processed in memory to identify the card and is not stored by us. If you're signed in, the photo is saved to Cloudflare R2 storage so you can see your scan again, and is deleted automatically after 30 days.
• Scan results: for every scan, what the AI read from the card (for example name, number and set code), the matched card, the alternatives, a confidence score, whether you picked a different card, the AI model used and its processing cost. For anonymous scans this is linked to a random visitor ID rather than to an account.
• Collection data (accounts only): the cards you save, with variant, condition, quantity, purchase price and notes.
• Usage and device data for every request: date and time, IP address, approximate country (from our CDN), browser user agent, referring page, and the page or endpoint requested.
• Purchase information: payments are handled by Polar, our merchant of record. We never receive your full card details. Polar shares with us your subscription status, plan and billing period, and may share your name, email and order details.
• Messages you send us, such as support emails and feature requests.

2. Cookies and similar technologies

• Strictly necessary cookies: a sign-in session cookie, a random visitor ID (to enforce the free scan allowance), a theme preference, and an admin session cookie for our staff.
• Bot protection: Cloudflare Turnstile runs on sign-up, sign-in, password reset and some scans to tell people from bots. It processes signals such as your IP address and browser characteristics under Cloudflare's privacy policy.
• Advertising: visitors without a paid plan see ads from Google AdSense. Google and its partners use cookies to serve and measure ads, which may be based on your visits to this and other websites. You can opt out of personalized ads at Google Ads Settings or aboutads.info. See how Google uses data from partner sites. Paid subscribers don't load the ad script at all. Our site is not directed to children, and we configure our ad account accordingly.
• Affiliate links: links to TCGplayer (through the Impact network) and eBay (through the eBay Partner Network) may carry a tracking ID so the retailer can credit us with a commission if you buy. The retailer or network may set its own cookies when you follow such a link. See our affiliate disclosure.

3. How we use information

• to identify cards, show their estimated market values, and run your account and collection;
• to apply free and paid usage limits, and to support you;
• to send service emails: email confirmation, password resets and security notices;
• to send occasional product emails to account holders — for example, a single reminder if you viewed our plans while signed in but didn't subscribe. Every such email has a one-click unsubscribe link, and opting out doesn't affect service emails;
• to secure the Service: rate limiting, bot checks, fraud and abuse prevention, and blocking abusive IP addresses;
• to measure and improve identification accuracy, performance and costs — for example by reviewing cases where you corrected a match;
• to comply with legal obligations and enforce our Terms.

We do not use your photos to train AI models, and we do not sell your photos or collection data. OpenAI's API terms provide that data sent through its API is not used to train its models unless the customer opts in, which we have not done.

4. How we share information

We share information only with service providers acting on our behalf:

• OpenAI — the card photo you scan is sent to OpenAI's API to read the card. OpenAI may retain API inputs for a limited period for abuse monitoring under its API data policy;
• Polar — payments, sales tax and VAT, invoices and subscription management (as merchant of record);
• Cloudflare — content delivery, DNS, security, Turnstile bot checks, and R2 storage of signed-in users' scan photos;
• Google — AdSense advertising for visitors without a paid plan (see section 2);
• our email provider — to deliver account emails;
• our hosting provider — to run our servers and database.

Card and price data come from public sources (the pokemontcg.io API, which republishes TCGplayer and Cardmarket prices). We fetch that data on a schedule; we don't send your personal information to those sources.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the business. We do not sell personal information for money. Google's advertising cookies described in section 2 may be considered “sharing” for cross-context behavioral advertising under California law; you can opt out as described in section 6.

5. Retention

• Anonymous scan photos: processed in memory to identify the card and not stored by us.
• Signed-in scan photos: deleted from our storage automatically after 30 days.
• Scan results (what was read and matched, without the photo): kept to measure accuracy, and deleted with your account.
• Collection data and account data: kept until you delete your account from the account page.
• Request logs (including IP addresses): deleted after 180 days.
• Free-scan counters: kept to enforce the one-time free scan; the IP-address part of a counter stops blocking free scans after 30 days.
• Ban records: kept until removed.

6. Your rights and choices

Delete your account at any time from the account page. This permanently deletes your account, your collection and your saved scan photos.

Depending on where you live (including California under the CCPA/CPRA, other US states with privacy laws, and the EU/UK under the GDPR), you may have the right to know what personal information we hold, access it, correct it, delete it, receive a copy, and opt out of sale, sharing or targeted advertising. To exercise a right, email [email protected]. We will verify your request, respond within the time the law requires, and not discriminate against you for exercising your rights. An authorized agent may submit a request on your behalf with proof of authorization. To opt out of personalized ads, use the Google links in section 2 or a paid plan (which loads no ads).

For EU/UK users: we process data to perform our contract with you (providing the Service), for our legitimate interests (security, abuse prevention, improving the Service), with your consent where required for advertising cookies, and to comply with law. You may lodge a complaint with your local data protection authority.

7. International transfers

Your information may be processed in the United States and other countries where we or our providers operate, with appropriate safeguards where required.

8. Security

We use encryption in transit (HTTPS), access controls and minimal data retention. No method of transmission or storage is 100% secure.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK where local law requires parental consent). You must be 13 or older to use the Service and 18 or older to buy a plan. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

10. Do Not Track and Global Privacy Control

We do not track you across other sites ourselves. Browsers' Do Not Track signals have no agreed standard, so we don't respond to them; where the law requires it, we treat a Global Privacy Control signal as a request to opt out of sale or sharing.

11. Changes

We may update this policy and will post changes here with a new effective date.

12. Contact

the operator of CheckCardValue — [email protected]