Privacy Policy
OneZeroTwo. Updated 2026-10-03.
What we collect
- Your account email and a hashed password. The hash is one-way (argon2id); we never store or see your password in plain text.
- Your first name, so the app can address you, and an optional display name if you choose one. Both are collected when you sign up and you can change them any time in the account panel.
- If you sign in with Google, we receive your Google account's email address, your first name and Google's id for your account. We do not receive your password or contacts, and we send nothing to Google about what you do here.
- The collection, watchlist, trade and sales records you enter. They exist so the app can do its job for you, and for nothing else.
- The alerts your watchlist raises: which watch, the price that crossed your target and when, whether you have seen or dismissed it, and whether it was emailed to you. They are kept until you dismiss them, stop watching the card or delete your account. An alert you dismiss is deleted automatically a day later, and a watch you stop is held for ten minutes, in memory only, so Undo can bring it back.
- To keep working without signal, the app keeps a copy of the cards, collection and watchlist you last looked at, and any Show Pack you download, on your own device. It never leaves your device, and signing out deletes it.
- Scan usage counters and scan metadata (which engine read a photo, how long it took, whether it hit a quota). These contain no photo, no text read from a photo, no card name and no certificate number.
- Dealer day pass and FlipFinder usage records: which day a pass was started, when it was started and when it ran out, and one row for each FlipFinder run. They exist to count what your plan includes over the last 30 days. They hold no card, no price and nothing you searched for.
- Set performance opens: which card sets you opened and on which day, one row per set per day. They exist to keep the daily fair-use limit on that page honest and to decide which sets are worth pre-computing overnight. They hold no card, no price and nothing the analysis said, and they are kept 30 days and then deleted automatically.
- Which one-time notices you have dismissed: the name of the notice and when you dismissed it, so the app explains a view once instead of every time you open it. They hold no card, no price and nothing you did on the page.
- Subscription status from Stripe: your plan, its status and renewal date. Card entry happens on Stripe's hosted checkout page. Card numbers never reach our server and we never see them.
- A billing event log for the payments on your account: the Stripe identifiers, the status, the plan, the renewal date and the amount charged. We deliberately strip everything else Stripe sends us, including your billing name, billing address and the brand and last four digits of your card. Those are kept by Stripe, not by us.
- Weekend passes you buy: the Stripe identifiers for that payment, the amount, when the pass starts and ends, and whether it was refunded or disputed. Kept while your account exists and deleted with it.
- Suggestions you send through the Suggestions form: what you wrote, the page you were on, and an email address so we can reply (your account email, or one you volunteer as a guest).
- Error logs with the route, status code and a short technical message, and, when the app crashes in your browser, the error's technical message and where in the app it happened, with no text you typed and no address. They contain no user-entered text and no email addresses.
- A log of the emails we send, kept 30 days and then deleted automatically: which kind of message it was, which mail service carried it, whether it went out, and only the part of the address after the @, never the full address.
- Invite links. If we send you an invite link, we keep a name for it, usually the handle we sent it to, so we know which link went where. If you claim it, we also keep which account claimed it and when, and the membership it added. We never record whether or when a link is opened. If you never made an account and want that name removed, ask us and we will delete it.
- Page counts. We count page views per day by kind of page, the website that linked to us, and your browser's language setting. To estimate how many people visited, your IP address and browser name are combined with a random key that changes every day and is never saved; only the daily total is kept. We count how many searches run and how many found nothing, and which cards are priced, never what anyone typed. When you pick a card from a search, we count it once a day for your network, meaning the block of internet addresses your connection is part of, so everyone on one office or show hall connection counts once. The network is combined with a random key that changes every week and is never saved, and we forget a network 7 days after its last search; only the number of networks per card, by day and by 7-day window, is kept. We also count how many times a day card pages are opened at each grade, such as raw or PSA 10, never by whom. Kept 400 days.
- The Most searched list. The app can show the cards most searched in it as a ranked list, and the same list may appear in our own posts, such as on social media. It names cards and their rank only, never who searched for them or how many did.
Card photos are never stored
Photos you scan are processed in memory and then dropped. They are never written to disk or to our database. Our automated test suite pins this: the scan log schema has no column that could hold image bytes or text read from a photo, and a change that added one would fail the build.
Who else touches data (subprocessors)
- Stripe processes payments and stores your payment details under its own privacy policy.
- Anthropic receives scan photos for reading when the vision engine handles a scan. We do not store what was sent.
- Our email delivery provider receives your email address to deliver password reset, email verification and renewal reminder messages, and an alert when a card on your watchlist hits the price you set, which you can turn off from any such email or in your account, and a one-time notice when we add a membership to your email address. It also carries the suggestions you send through the Suggestions form. That message goes to the operator rather than to you, and your address travels in it, both in the text and as the reply-to address, so the operator can answer you. If you send a suggestion as a guest and leave the address blank, no address is sent.
- Google confirms who you are when you choose Google sign-in. That exchange happens between our server and Google at the moment you sign in, and nothing else about you is sent to them. If you never use Google sign-in, we never talk to them about you at all.
- DigitalOcean hosts the server and database.
No trackers
There are no analytics trackers, no advertising scripts and no third-party cookies on this site. The only cookies are the session cookies that keep you signed in. Usage metrics are computed from our own database and never leave it. The one exception is the Most searched list above, which names cards and their rank and nothing about any person.
Deleting your data
You can delete your account yourself: open Account in the app and press Delete account at the bottom of the page. You confirm it with your password, or, if you only ever sign in with Google, by typing your email address. The account is deleted at once and these database rows are removed: your name and display name, your sign-in (your password, the link to your Google account and your sessions, on every device), your settings, collection, watchlist, sales records, alerts, password reset and verification tokens, scan counters and scan metadata, your day pass and FlipFinder usage records, your set performance opens, which one-time notices you dismissed, your subscription status, your weekend pass purchases and the passes themselves, and any membership we gifted to your email address. If you would rather we did it, ask us (contact below) and we remove the same rows.
If you claimed an invite link, the membership it gave you is removed with the rest, and our record of the invite keeps only that it was used and when: the account that used it and the name we gave it are erased.
If you pay for a plan, your subscription is cancelled at Stripe right away, rather than at the end of the billing period, and nothing is refunded. It is cancelled before anything is deleted, and if Stripe cannot confirm the cancellation, nothing is deleted and the app tells you so.
The server also saves a copy of its database every night and deletes each copy after 14 days, so a deleted account can stay in those copies for up to 14 days. They exist so the service can be recovered after a failure.
Our hosting provider also takes backups of the whole server, and a deleted account can stay in those for up to four weeks. They are kept only so the service can be restored after a failure.
The redacted billing event log described above is kept, because it is our own record of payments that actually happened and a business has to keep its financial records. It holds Stripe's identifiers, the status, the plan, the dates and the amounts, and no name, email address or card details. Stripe retains its own payment records as financial regulations require it to.
Suggestions you sent through the Suggestions form are the second exception. They are kept, but anonymised: the account id and the email address on the suggestion are erased, so nothing in it points at you any more. That covers every suggestion sent with that email address, whether you were signed in at the time or sent it as a guest before you had an account. The text of the suggestion itself stays, because it is about the app and may already have been acted on. That means anything you typed into that box stays with us, so please do not put anything private in it.
If you never made an account and want the email address off a suggestion you sent as a guest, write to the contact address below from that address and we will erase it the same way.
Contact: support@onezerotwo.app