Privacy Policy

cardIQ is published by Glados Group OÜ, a private limited company registered in Estonia under code 17456495, whose registered office is at Viru väljak 2, 10111 Tallinn, Estonia. It is the controller of your personal data. For any question about this policy or your data, write to support@cardiq.gg.

We collect what you give us and what the service needs to work:

• Account. Your first and last name, email address, password (stored only as a hash, which nobody can read back), language, and when your account was created. The codes we email to verify your address or reset your password expire after five minutes.
• Sign-in with Google, Apple, GitHub or GitLab. The identifier of your account with that provider and the email address, username and profile picture it shares with us. We never see your password with that provider.
• Security. Your sessions — the IP address and the browser or app that opened each one, and when it expires — and, if you turn on two-factor authentication, its secret and backup codes.
• Collection. The cards you add and what you enter about them: variant, grade and grading company, quantity, certification number, purchase price, currency and date.
• Alerts and destinations. What you watch (cards, sets, listings), your thresholds, the destinations you set up — a Discord webhook, email addresses, a URL of your own and its headers — and the history of what was sent to them.
• Subscription and billing. Your plan and the packs you bought, your orders and payments, whether you used a free trial and, if you fill it in, your billing profile (company name, address, billing email, VAT number). On the web, you enter your payment card on Stripe's page; in the app, Apple or Google takes the payment and sends us the proof of the purchase (the product, its transaction identifiers, dates and renewal state). We never receive or store a card number.
• Free trial and referral. To grant one free trial per person on the web, we keep a SHA-256 hash of your email address and the fingerprint Stripe gives of the card used, never the card itself. If you take part in the referral programme, we keep your referral code, the accounts that signed up with it and the credit earned.
• API. The API keys you create, and how many requests your plan's quota has used.
• Technical logs. Our servers log requests and errors, which can include an IP address.

What you type in a search is sent to our servers to find cards and sets, and is not kept with your account.

The app also keeps some data on your phone alone, where we cannot read it:

• your session, in the system's secure storage;
• your preferences: appearance, tab bar, pinned shortcuts, recent searches and the choices made when you first opened the app;
• the figures and card pictures the home-screen widgets show.

Camera. The camera is used only while the scanner is open, and the card is read on your phone: its image is neither recorded nor sent to us, only the text read on it, to find the card in the catalogue as a search would.

Notifications. The app asks for permission to show notifications. You can withdraw it at any time in your phone's settings.

The app shows no advertising, reads no advertising identifier and embeds no third-party analytics or tracking tool.

To compute prices, cardIQ collects the public listings and sales of marketplaces such as eBay, Fanatics Collect and Goldin. They can include the public username of the seller, which we keep only as part of the listing, never to profile anyone. A seller can object by writing to support@cardiq.gg.

• To provide the service you signed up for — your account, collection, alerts, API access and subscription: necessary to perform our contract with you.
• To bill you and keep our accounts, as the law requires: legal obligation.
• To keep the service secure and prevent fraud and abuse, such as a second free trial, and to compute prices from market data: our legitimate interest.
• To email you about your account — verification codes, welcome, subscription confirmations and reminders, and the alerts you set up: necessary to perform the contract. We send no marketing email without your consent.
• To show notifications on your phone: your consent, given in the system's prompt.

We do not sell your data, use it for advertising or make decisions about you by automated means.

Only the providers that run the service for us, each bound by contract to use your data on our instructions alone:

• DigitalOcean hosts our servers, database and file storage in Amsterdam, the Netherlands.
• Cloudflare carries the traffic to our services and hosts this website and the dashboard.
• Stripe processes payments and subscriptions.
• Resend sends our emails.

A subscription bought in the app is sold by Apple through the App Store or by Google through Google Play, which handle its payment under their own privacy policies.

Others receive data only because you ask them to: the provider you sign in with, and the destinations you set up for your alerts (Discord, the email addresses or URLs you entered). We may also disclose data to an authority when the law requires it.

This website loads its fonts from Google Fonts, which receives your IP address when you visit it.

Your account data is stored in the European Union. Some providers — Stripe, Cloudflare, Resend, Apple and Google for a purchase in the app, and the sign-in provider you choose — may process data in the United States. These transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.

• Account, collection, alerts and settings: as long as your account exists.
• Sessions: until you sign out, or seven days without use.
• Verification and reset codes: five minutes.
• Technical logs, and the payment events Stripe sends us: 30 days.
• Invoices and payment records: seven years, as the Estonian Accounting Act requires.
• Free-trial hashes and referral records: after the account is deleted too, to prevent abuse and settle commissions.

What happens when you delete your account is described on the account deletion page.

Under the General Data Protection Regulation and the Estonian Personal Data Protection Act, you can access your data, correct it, have it erased, restrict or object to its use, receive it in a portable format and withdraw a consent at any time.

You can correct your name and delete your account yourself, in the app or on the dashboard. For anything else, write to support@cardiq.gg: we answer within one month. If you think your rights are not respected, you can lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or with the data protection authority of the country where you live or work.

All traffic is encrypted (HTTPS). Passwords are stored only as hashes, two-factor authentication is available on every account, and the app keeps its session in the phone's secure storage.

This website sets no cookie. The dashboard uses only the cookies it needs to work: your session, the steps of a sign-in and your language. We use no advertising or audience-measurement cookie.

cardIQ is meant for adults: you must be 18 or older to create an account. We do not knowingly collect data from children.

We may update this policy. The date at the top says when it last changed, and we will tell you by email or in the app before a significant change applies.