Privacy Policy

• Account identity handled through Clerk, including authentication details needed to create and secure an account.
• Profile fields you choose to save, such as username, display name, bio, social links, public-profile setting, and avatar URL.
• Collection, wishlist, set visibility, and featured-card data used to power your private workspace and any public showcase you enable.
• Private Operations data, including sealed lots, single-card rows, cost basis, market estimates, purchase locations, fee assumptions, shipping assumptions, sale snapshots, notes, and CSV export or import-preview input.
• Technical and security information needed to run the service, protect routes, debug errors, and maintain catalog sync or image mirroring jobs.

We use this information to provide account access, save your collection and Operations records, render catalog pages, generate privacy-safe public profiles and Open Graph previews, process avatar uploads, calculate private Operations estimates, prevent abuse, debug service issues, and keep the Pokemon catalog cache and image mirror healthy.

Cardulate does not currently run advertising analytics, sell personal information, or share personal information for targeted advertising. If analytics or feedback tooling is added later, this policy should be updated before that tooling is launched.

Your public profile is off unless you enable it. When enabled, public routes may show your username, display name, avatar, bio, social links, featured cards, and only the sets you mark public. Public collection and Open Graph helpers strip private collection fields by construction.

Operations data is private business data. Costs, purchase locations, fee settings, shipping assumptions, notes, sale snapshots, realized margins, CSV exports, and import-preview data are not used in public catalog, public profile, or Open Graph routes.

• Clerk for authentication and account management.
• Neon for application database storage.
• Vercel for hosting, routing, server execution, and operational logs.
• Cloudflare R2 for profile avatars and mirrored catalog image assets.
• Pokemon TCG API, Scryfall, and YGOPRODeck as trading card catalog sources.

These providers may process information for hosting, authentication, storage, database, security, or catalog-data purposes. Cardulate uses trading card data sources for catalog information and attribution; those sources do not receive your private collection or Operations records from Cardulate.

• Keep your profile private, make it public, or change public profile fields in profile settings.
• Control which owned sets are public; private sets and private collection fields stay out of public profile and Open Graph routes.
• Edit or remove profile fields, featured cards, avatar, collection rows, wishlist rows, and Operations rows from the app where supported.
• Manage account authentication details through Clerk account controls.
• Send privacy questions, access requests, correction requests, or deletion requests to privacy@cardulate.app.

We use managed infrastructure, authenticated server-side access, route protection, private query helpers, and service-specific credentials to protect the information Cardulate stores. No online service can promise perfect security, so we limit public exposure paths and keep private Operations data separate from public catalog and profile features.

We keep account and app data while needed to provide the service, support user choices, maintain security, or satisfy legitimate operational needs. Cardulate is intended for users 13 and older and is not directed to children under 13.

For privacy questions or requests, contact privacy@cardulate.app. This policy may change as Cardulate adds features, analytics, feedback tooling, or new providers.