Privacy
Plain-language summary of what this site stores. Last updated November 2026.
What we store
- Checklist marks. Which cards you have marked as owned. They are stored in your account on our servers so they sync between devices, with a copy cached in your browser for speed and offline use. Browsing the catalog without an account stores nothing that identifies you.
- Account. If you sign in with Google or Discord we receive your account id, display name, avatar and, if the provider has verified it, your email address. We never see your password. The email is used to identify you if you contact us and for service messages about your account.
- Marketing email. Only if you tick the box in your account. It covers news about this site and offers from partners, sent by us; partners never receive your address. Untick the box or use the unsubscribe link in any email to stop. We record when you gave consent.
- Handle. The public name in your share links. You choose it and can change it.
- Public profile links. If you connect YouTube, add a link for X, Instagram, Facebook, Twitch or TikTok, or show your Discord username, it starts hidden. Entries you switch on appear on your public collection page and can be seen by anyone who can open it. Discord shows the username from your connected account only while that connection stays active. You can hide or remove each entry at any time.
Collections, wishlists and graded cards
Beyond checkmarks, your account can hold: how many copies of a card you own and whether they are raw; for each graded copy the grading company, grade, an optional certification number, an optional purchase price, an optional estimate you typed, an optional acquisition date, notes and your visibility choices for that copy; the cards, quantities, condition, priority, maximum price and notes on your wishlists, including the grade a wishlist asks for; the copy requirement on your custom sets; the sealed products you own; and your decks.
Riftbound, One Piece and Japanese Pokemon each have their own sharing switch. They start private even when your Pokemon collection is public, and changing one game's switch does not change what you share for another game.
Decks start private. If you publish a deck as public or unlisted, its page shows its name, description, card list, format and your handle. Public decks are also listed and searchable. A deck does not show what you own. You can change its visibility or delete it at any time.
Grades on graded copies can appear on your public pages when your collection is public and "Show my graded-card grades publicly" is on in your account, and on a shared wishlist. Certification numbers are private by default and appear only when you turn them on for a specific copy. Purchase prices, estimates, acquisition dates and graded-card notes are always private; there is no control that publishes them. Wishlist notes and maximum prices are private unless you turn them on for that list. Public pages and shared links omit private fields entirely; they are not sent and hidden.
Your account also keeps a private daily snapshot of your collection's reference value (totals by raw, PSA 10 and sealed, how many copies or units were priced and the dates of the prices used, never purchase prices, estimates you typed or notes) and a one-time earlier estimate based on the holdings of your first snapshot. Visitors see the shared snapshots only while your collection is public and "Show collection value" is on. Clearing your collection keeps past snapshots; deleting your account deletes them.
Deleting your account removes your graded copies, wishlists, custom sets, decks and sealed quantities with it. A backup file you download contains your private graded-card fields, so treat it as private.
Card scanning
When you scan a card, the cropped photo of that one card is sent to our server and passed to Cloudflare Workers AI, which reads the printed name and collector number so we can match it to the catalog. The photo is not stored by us and is not used to train any model; only the identified card and a daily count of scans (by account, or by a daily-changing hash of your network address for visitors) are kept, to enforce the daily scan limit. Show sessions are private to your account: they hold the cards, quantities and the price summaries you saved, and are removed when you delete a session or your account.
Outbound links
Buying links to TCGplayer (tcgplayer.com), eBay (ebay.com) and Amazon (amazon.com), and TradePost (tradepost.co) offer links, go through our /out redirect. For each click it records the retailer, the item, the page placement, the time and whether you were signed in. It does not record your account id, address or another identifier, and we use it for affiliate and link reporting. When you follow an external link, including PriceCharting (pricecharting.com), Card Ladder (cardladder.com), Collectr (app.getcollectr.com), ALT (alt.xyz), PSA (psacard.com), TCGCSV (tcgcsv.com), an official Pokemon, Riftbound or One Piece game or rules page, or a social profile, that site receives your IP address and the page you came from, and its own terms and privacy policy apply.
Cookies
One session cookie keeps you signed in. It is strictly necessary and contains a random token, nothing about you. Advertising, if shown, is served by Google AdSense, which may set its own cookies and use your browsing data to personalize ads as described in Google's advertising policy. Where required by law you will be asked for consent before those cookies are set.
Sharing
Your collection pages are visible to anyone with the link while sharing is switched on in your account. Switch it off and they return "private" to everyone but you.
Deleting your data
The Delete account button in your account removes your account, handle, sign-in links and every checkmark stored on the server immediately.
Third parties
Card images load from TCGplayer's image servers (tcgplayer-cdn.tcgplayer.com) and Pokemon sprites from GitHub (raw.githubusercontent.com), so those hosts see your IP address when a page loads. Raw and sealed prices come from public TCGplayer market data via TCGCSV, including USD references for Japanese Pokemon printings. PSA 10 references come from PriceCharting data. TradePost offer figures come from TradePost's public offer data. Advertising is served by Google AdSense (see Cookies). Signing in with Google or Discord, or connecting YouTube, sends you to that provider to authorize the connection. Connecting YouTube uses Google's YouTube Data API with read-only access to the channel names and handles on your account so you can choose one to show. Public profile links go to YouTube, X, Instagram, Facebook, Twitch or TikTok. Links to official Pokemon, Riftbound and One Piece game or rules pages go to those publishers. Following a link to any of those services, or to PriceCharting, Card Ladder, Collectr, ALT, PSA, TCGCSV, TradePost, TCGplayer, eBay or Amazon, sends that site your IP address and the page you came from, and that site's terms and privacy policy apply. The QR code generator is loaded from jsDelivr, which receives your IP address and the file request but not the link being encoded. Account and marketing email is delivered through Resend, which receives the recipient address and message content. We do not sell or share your data.