Privacy Policy
Effective date: October 24, 2026. This version adds the searches and cards you open while signed in (see What we collect). It replaces the versions dated February 21, June 10 and September 27, 2026.
Who we are What we collect Card scanning and AI How we use it Service providers Analytics, ads and cookies What is public Dealer tools Retention Deleting your account Your rights Where data is stored Security Children Changes Contact
Who we are and the short version
Hobby Card Index ("HCI", "we") is a trading card price tracking, collection management, scanning and marketplace platform at hobbycardindex.com. We are based in British Columbia, Canada, and we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). If you live elsewhere, the rights your own law gives you are described under Your rights.
We collect what we need to run your account and the features you use. We do not sell your personal data. We do use Google Analytics and a Google Ads tag, and we do measure opens and clicks on our marketing and digest emails. Both are explained below, and you can opt out of both.
Privacy questions: privacy@hobbycardindex.com. Anything else: support@hobbycardindex.com.
What we collect
Account information
- Email address and username.
- Password, stored only as a one-way bcrypt hash. We never see or store your actual password.
- Optional profile details you choose to add: display name, avatar, phone number, location, bio.
- If you sign in with Google, Microsoft, Apple or eBay, we receive your basic profile from that provider (name, email, and for Google a profile picture and language) plus an account identifier so we can log you in. For eBay sign-in we also hold the sign-in tokens eBay issues so you stay connected.
- Your preferred language, currency and display settings.
Things you create in the app
- Your card collection, watchlists, price alerts, grade lists, wax collection and saved searches.
- Card photos you scan or upload, and the identification results (see Card scanning and AI).
- Community posts, comments, stories and direct messages to other members.
- Marketplace listings, offers, bids, orders, reviews, chat messages with buyers or sellers, and livestreams you host.
- Dealer inventory, expenses, consignors, shows and your own customer records, if you use the dealer tools (see Dealer tools).
- Questions you ask our AI assistant, and the answers.
Searches and cards you open
When you're signed in, we save the searches you run in the app (the top search bar and the Database page) and the cards you open, to your account. We use them to tailor what you see, like trending cards in the categories you collect. We keep your most recent 1,000 searches and 500 card views, and they're deleted with your account. Because this is tied to your account and not to a cookie, it happens whether or not you accepted cookies. Searches made while signed out aren't saved.
Billing and marketplace payments
Payments are processed by Stripe. Your card number goes to Stripe, not to us. We store your subscription plan, status and billing interval and Stripe's customer and subscription reference IDs. If you sell on the marketplace, Stripe collects the identity and banking details it needs to pay you through its own onboarding form; we store only your Stripe account ID and its status.
When you buy or sell on the marketplace we store the shipping name, address and phone number for the order. Name, street, city, postal code and phone are stored encrypted in our database.
Affiliate program
If you apply to the affiliate program we store your payout email, the website and social media links you give us, your audience size and your application note. Clicks on your referral link are recorded with a hashed IP address, browser type, landing page and referrer. We do not store the raw IP address.
Waitlist and contact forms
If you join a waitlist or send us a message through a contact form we store the email address, the name you give us and the message, along with your IP address and browser type for spam prevention.
Technical and security data
- Server logs, including your IP address and browser user agent, used for security, abuse prevention and debugging.
- A security audit log of sensitive account events (sign-ins and failed sign-ins, password and two-factor changes, email changes, API key changes, account deletion), each with the IP address and browser it came from.
- Your active sessions, and the devices you have marked as trusted for two-factor login, each with IP address and browser.
- Feature usage events inside the app (which pages and tools you use). These are recorded only if you accepted cookies on our consent banner. Searches and cards you open while signed in are saved to your account as described above.
- Error reports from your browser when something breaks, so we can fix it. These are sent whether or not you accepted cookies.
- Your API usage, if you have an API key.
Email engagement
Our marketing and weekly digest emails contain a tracking pixel and wrapped links, so we can tell whether an email was opened and which links were clicked. For each event we store your user ID, email address, the email type and the time. We do not store your IP address or browser from these events. Security, password, verification, two-factor and billing emails are never tracked, and unsubscribe links are never wrapped. To stop the tracking, unsubscribe from marketing and digest emails (Settings, or the link at the bottom of any of those emails), or email us.
Card scanning and AI
When you scan a card, the photo is sent to Google's Gemini API to identify the card. We send the photo itself, not your account details. The photo and the result are stored with your account so you can review your scan history.
Scan photos are stored in our image storage (DigitalOcean Spaces). They are not listed anywhere public, but each photo has a web address, and anyone who has that exact address can open it. Do not scan anything you would not want seen if the link were shared.
Improving our own card recognition. We run our own card recognition model alongside Gemini. Scans that our team reviews and confirms may be added to that model's reference set so the next person who scans the same card gets a better match. Only the card photo is used, never your name or account details. If you do not want your scans used this way, email privacy@hobbycardindex.com and we will exclude them.
Text you type to our AI assistant, and Market Intel questions, are sent to Gemini to generate the answer. If you turn on spoken replies, the assistant's reply text is sent to ElevenLabs to produce the audio. Your own typed question is not sent to ElevenLabs, although the reply may repeat part of it.
How we use your data
- To run your account: sign-in, collection tracking, watchlists, alerts, scans, community, marketplace and dealer tools.
- To process subscriptions, marketplace payments, seller payouts and shipping labels.
- To send transactional email and SMS: verification codes, password resets, two-factor codes, price alerts, order updates, receipts.
- To send the weekly digest and occasional product news, if you have not opted out.
- To keep the service secure: detecting abuse and fraud, rate limiting, investigating errors.
- To tailor the app to you, for example showing trending cards from the categories you search for and collect.
- To understand how the site is used in aggregate and to measure our advertising (see Analytics, ads and cookies).
- To improve card recognition, as described above.
- To respond to you when you contact us, and to comply with the law.
Our legal bases, where a law asks for one, are: performing our contract with you (running the account), your consent (analytics cookies, marketing email, scan training), and our legitimate interests in keeping the service secure, improving it and tailoring it to you.
Service providers we share data with
These companies process personal data on our behalf. We share only what each one needs. We do not sell personal data to anyone.
| Provider | What it does | What it receives |
|---|---|---|
| Stripe | Payments, subscriptions, seller payouts | Email, payment details you enter on Stripe's forms, seller identity and banking details (collected by Stripe), order amounts |
| DigitalOcean | Hosting, image storage, database backups | Everything stored in the service |
| Google (Gemini) | Card identification, AI assistant | Scan photos, questions you ask the assistant |
| Google (Analytics and Ads) | Site analytics, ad conversion measurement and remarketing | Page views, anonymized IP, device data; see the next section |
| Google, Microsoft, Apple, eBay | Sign in with those accounts | Handled by the provider; we receive your basic profile |
| Microsoft 365 | Sends all our email (transactional, alerts, digest, marketing, support) | Your email address and the message content |
| Twilio | SMS two-factor codes | Your phone number and the code |
| EasyPost | Marketplace shipping labels and tracking | Shipping name, address, phone and email for the order |
| Mux | Marketplace livestream video and recordings | The video and audio of streams you host |
| ElevenLabs | Spoken AI assistant replies | The reply text |
| eBay | Live listing data, dealer listing tools | Search terms; if you connect a dealer eBay account, the tokens eBay issues, stored encrypted |
| Cloudflare | DNS and edge protection for our domain, performance measurement | Request data such as IP address as it passes through |
| Sentry | Error monitoring, when enabled | Technical error reports; we strip emails, phone numbers and sign-in tokens from server reports before they are sent |
| Slack | Internal alerts to our team | Contact form messages include the sender's name, email and a preview of the message; billing alerts include a user ID and plan |
| Google Workspace | Our mailbox for contacting card shops | Business contact details and replies from shops (not app users) |
Card pricing data, catalog data and search engine research come to us from licensed data providers and public marketplaces. We do not send them your personal data.
We may also disclose information when the law requires it, to protect our rights or someone's safety, or if HCI is ever sold or merged, in which case this policy continues to apply to your data.
Analytics, ads and cookies
We use Google Analytics (with IP anonymization) to understand aggregate site usage, and a Google Ads tag to measure sign-ups and purchases that came from our ads and to build remarketing audiences, so people who visited HCI may see our ads elsewhere on Google's network. We do not run any other ad network, and we do not use Meta, TikTok or Reddit pixels.
Consent. In the app and on this page, Google's tags run without setting or reading any
cookies until you accept on our consent banner. Accepting turns cookies on; declining leaves them off. On
some of our public reference pages, visitors from the European Economic Area, the United Kingdom and
Switzerland get the same default-off treatment, while visitors from elsewhere have the tags on by default
and can turn them off from the banner. Your choice is stored in your browser under the key
hci_cookie_consent and applies across the site. Cloudflare may also set a short-lived
performance beacon on pages that pass through it.
Under California law, using the Google Ads tag for remarketing can count as "sharing" personal information. To opt out, decline cookies on the banner or email us.
Cookies and browser storage we set ourselves
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
cv-token | local storage | 24 hours, or 7 days on a trusted device | Keeps you signed in |
hci_auth | cookie | 90 days | Tells the site you have an account so it can send you to the app |
hci_trusted_device | cookie | 30 days | Remembers "trust this device" for two-factor login |
csrf-token | cookie | 24 hours | Protects forms against cross-site request forgery |
hci_ref | cookie | 30 days | Remembers which affiliate referred you |
mp_bucket | cookie | 30 days | Keeps your marketplace experience consistent while we test changes |
hci_cookie_consent | local storage | until cleared | Your consent choice |
| Preferences | local storage | until cleared | Theme, language, currency, layout, cached prices |
_ga, _ga_*, _gcl_au | Google cookies | up to 2 years | Analytics and ads, only after you accept |
What other people can see
- Marketplace: your seller page, listings, feedback and reviews are public. Livestreams you host are public and a recording is kept so buyers can review them.
- Community: your profile, posts, comments and stories are visible to signed-in members. Direct messages are visible only to the people in the conversation. We store them and may review messages that are reported to us.
- Scan photos: not listed publicly, but reachable by anyone who has the exact link (see Card scanning and AI).
- Your collection, watchlists, alerts and dealer data are private to you unless you choose to share or export them.
Dealer tools and your customers' data
If you use the dealer tools you can store your own customers' names, emails, phone numbers, addresses, eBay usernames, purchases and notes. That data belongs to you. We store it on your behalf, we do not use it for anything else, and we never contact your customers. You are responsible for having the right to store their details and for answering their requests. When you delete your account, your customer records are deleted with it.
How long we keep data
We keep your account data for as long as your account exists. Some data has a shorter life:
- Sessions: removed after 7 days without activity.
- Two-factor codes: removed 24 hours after they expire. Verification and password reset links: 7 days.
- Rate limiting records: 48 hours.
- Error logs: 30 days after an error is resolved, 90 days otherwise. API and download usage logs: 90 days.
- Database backups: a daily copy is kept for 7 days and a weekly copy for 4 weeks, so deleted data leaves our backups within about five weeks.
The security audit log, email engagement events and marketplace transaction records are kept for the life of your account. Marketplace order, payment, dispute and payout records are kept after deletion for as long as tax, accounting and dispute rules require. Waitlist and contact form messages are kept until you ask us to remove them.
Plain talk: the security audit log and the deletion record described below do not yet have an automatic expiry. We are setting one and will update this page when it is in place.
Deleting your account
Go to Settings, Account, Delete Account. You confirm twice, then prove it is you with your password, or with a one-time code we email you if you signed up through Google, Microsoft, Apple or eBay. You can also email privacy@hobbycardindex.com from the address on your account and we will do it for you within 30 days.
Removed immediately
Your profile and sign-in details, collection, watchlists, alerts, grade lists, saved searches and browse history, scan history, notifications, AI assistant history and usage logs, dealer inventory and customer records, community posts, comments, stories and direct messages, affiliate account, email engagement events, sessions and trusted devices, and any eBay sign-in tokens.
What remains, and why
- A deletion record in our security log: your username, email address, plan, when the account was created and when it was deleted, with the IP address the request came from. We keep it to prove the deletion happened and to prevent abuse of free trials and promotions.
- Scan photos in our image storage are not yet removed automatically. Email us after deleting and we remove them, and any copies used for card recognition, within 30 days.
- Backups roll off within about five weeks. We do not restore deleted accounts from them.
- Stripe keeps its own payment records, as payment processors must. Mux keeps livestream recordings until we ask it to remove them; email us and we will.
- Marketplace activity. If you have orders, offers, bids, disputes, payouts or marketplace chat messages, the in-app delete will stop and ask you to email support. We then remove or de-identify everything we are not required to keep for tax, accounting and dispute purposes, within 30 days.
Deleting your account does not cancel a paid subscription on its own. Cancel it under Settings, Billing first, or tell us in your email and we will cancel it for you.
Full step-by-step instructions: hobbycardindex.com/data-deletion.
Your rights
- Access and export. Your collection, watchlist and dealer data can be exported as CSV from the app. For a complete copy of the personal data we hold about you, email us and we will send it within 30 days.
- Correction. Most account details can be edited in Settings. For anything else, email us.
- Deletion. See Deleting your account.
- Withdraw consent. Decline cookies on the banner, unsubscribe from marketing and digest email in Settings or from the link in any such email, or ask us to exclude your scans from card recognition. Withdrawing consent for something the service needs to work (such as your email address) may mean closing the account.
- Object or restrict. Tell us what you object to and we will stop unless the law requires otherwise.
- No discrimination. Exercising these rights never changes the price or quality of the service.
By region
Canada: you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca). European Economic Area and United Kingdom: you have the GDPR and UK GDPR rights of access, rectification, erasure, restriction, portability and objection, and may complain to your local supervisory authority. California: you have the CCPA rights to know, delete, correct, opt out of sharing and not be discriminated against. We do not sell personal information. Elsewhere: tell us where you live and we will answer under the law that applies to you.
Contact us about your data
Email privacy@hobbycardindex.com from the address on your account and tell us what you need. We answer within 30 days.
Where your data is stored
Our servers are hosted by DigitalOcean in the United States, and most of the providers listed above are also in the United States. Your information is therefore stored and processed outside Canada and, if you live elsewhere, outside your country. While it is there it may be reachable by the courts and authorities of that country under its laws. We choose providers that commit to comparable protections, and by using HCI you agree to this transfer.
Security
Passwords are stored as bcrypt hashes. All traffic is encrypted with HTTPS. Two-factor authentication (authenticator app, email or SMS code) is available on every account and required for admin, dealer and enterprise accounts; authenticator secrets are stored encrypted. Sensitive account actions are logged. Marketplace shipping details are stored encrypted. Access to production systems is limited to our team. No online service can promise perfect security. If a breach creates a real risk of harm to you, we will notify you and the Privacy Commissioner as the law requires.
Children
Hobby Card Index is not intended for children under 13, and we do not knowingly collect personal data from anyone under 13. If you are under the age of majority where you live, a parent or guardian must agree to our Terms for you. If you believe a child under 13 has created an account, email us and we will delete it.
Changes to this policy
If we change this policy we post the new version here and update the effective date at the top. For
significant changes we also make the update visible in the app or tell you by email. Earlier versions of
this policy lived at /legal/privacy.html; that address now brings you here.
Contact
Hobby Card Index, British Columbia, Canada.
Privacy: privacy@hobbycardindex.com
Support: support@hobbycardindex.com