Privacy Policy

This policy describes the current CardX implementation for development use. It will be updated before production release as provider details and the account-deletion workflow are finalized.

Information we collect

The information we collect depends on the features you use. Some information is required to create an account or complete a transaction. Other information is provided when you choose to use a feature.

Account and sign-in information

• Name, email address, profile image, and account identifiers.
• Sign-in information for email/password and Google authentication, including provider account identifiers and authentication state.
• Session information such as expiration, IP address, and user-agent information used to operate and protect the service.

Marketplace content and activity

• Listing information you provide, including card or memorabilia details, descriptions, prices, packaging information, and images.
• Favorites, cart selections, listing views, purchases, and related activity used to provide marketplace features and organize public collections.
• Messages, conversation participation, read state, and listing or order details included in a message card.

Orders, shipping, and payouts

• Buyer and seller names, shipping addresses, seller shipping origins, parcel details, shipping quotes, tracking information, labels, and carrier events.
• Order, payment, refund, payout, dispute, and fulfillment records.
• Seller onboarding information requested by the payout provider, which may include phone number, address, date of birth, identity details, business URL, and bank-account information.

Photos, files, and device permissions

When you add listing photos or shipping-proof photos, the app may request access to your camera or photo library. Selected images and associated upload metadata are sent to CardX storage so they can be used for the requested marketplace or fulfillment feature. The app stores authentication session data in secure platform storage. The current app does not request precise location, contacts, or microphone access.

Technical information

CardX and its infrastructure may process request method, URL, status, timing, IP address, user-agent, connection, and error information to operate, secure, troubleshoot, and improve the service. The final policy must be updated if analytics, advertising, crash reporting, or other tracking tools are added.

How we use information

• Provide, secure, and maintain CardX accounts and sessions.
• Publish and manage marketplace listings and images.
• Process carts, payments, orders, shipping, payouts, and disputes.
• Enable buyer and seller messaging and marketplace activity.
• Detect abuse, fraud, security issues, and unauthorized access.
• Meet legal, accounting, tax, and regulatory obligations.

How we share information

CardX shares information only as needed to provide the requested service, protect users and the marketplace, or meet legal obligations. The final policy must name the legal entities and locations of each provider before publication.

• Authentication providers, including Google, receive information needed to sign in and maintain the selected account connection.
• Stripe receives payment and seller-payout information. CardX does not store full payment-card numbers in the Marketplace database.
• EasyPost receives shipping addresses, parcel details, tracking information, and label requests for shipping features.
• Storage, hosting, database, cache, and realtime infrastructure providers process information on CardX's behalf.
• Marketplace participants receive information needed for a requested transaction. For example, a seller may receive a buyer shipping address to fulfill an order, and public listing details may be visible to marketplace visitors.
• CardX may disclose information when required by law, to protect rights and safety, or during a permitted business transfer.

The current implementation does not include an advertising SDK or a sale of personal data. Update this statement if the product changes.

Retention

CardX retains different categories of information for different periods based on the purpose for which they are used.

• Account and profile data is retained while the account is active and is deleted or anonymized within 30 days after an approved deletion request, subject to the exceptions below.
• Sessions are retained until expiration. Security and operational logs are retained for up to 90 days.
• Listings, messages, favorites, carts, activity, and images are retained while needed for the account or feature and are deleted or anonymized within 30 days after account deletion unless they are linked to a transaction or legal hold.
• Orders, shipping, payment, payout, refund, dispute, and tax records are retained for 7 years after the related transaction closes.
• Backups expire within 30 days after the corresponding primary data is deleted.

CardX may retain limited information longer when needed for fraud prevention, security, legal compliance, financial recordkeeping, dispute handling, or a legal hold. Provider records follow the applicable provider's retention and deletion terms.

Account and data deletion

You can start account deletion from Profile > Delete account in the CardX app or through the public Delete account resource. CardX first confirms recent owner authentication and checks for active checkout, shipment, payout, dispute, or legal-hold work. A clear request signs you out immediately and completes disposable-data cleanup asynchronously. Orders, payment, payout, shipping, dispute, fraud, tax, and compliance records may be retained and anonymized when required.

Security

CardX uses access controls, secure platform storage for mobile sessions, and encrypted connections where supported by the service and its providers. No method of transmission or storage is completely secure, so users should protect their account credentials and contact CardX about suspected unauthorized access.

Children's privacy

CardX is intended for users 18 and older and is not directed to children under that age. Users under 18 should not create an account. CardX does not knowingly collect personal information from anyone under that age.

Your choices

• Review and update available profile and listing information.
• Choose whether to provide optional listing and profile content.
• Manage device camera and photo-library permissions in system settings.
• Start account and data deletion through the app or the public Delete account resource.
• Contact CardX with privacy questions or requests.

Changes to this policy

CardX may update this policy when its data practices or legal obligations change. The effective date at the top of this page will identify the current version. Material changes should be communicated through appropriate product or account channels.

Contact

Questions and privacy requests should be sent to the contact below.