Privacy

If you sign in, we store your email address and your collection. If you buy a paid plan, Stripe takes the payment (or, in the phone app, Apple or Google does) and we store which plan you hold and the payer’s reference for your subscription — never your card number. We count how many prices and lookups you use each day, so the daily allowance works. There is no advertising in this app, signed in or not. We do measure visits with Google Analytics, on the website and in the phone app — clause 2 says what Google receives, and clause 7 names its cookies.

We also keep our own count of what the app is used for — which pages are opened, that a search was made, that a card was added or rated — against a random session id in a cookie, never against your name, your email, your address or your device. Clause 6 sets out every field that count holds; nothing you typed is one of them.

• Your email address — entered with a password or for a sign-in link, or provided by Google or Apple if you sign in with one of them. It signs you in, and we use it to tell you about your account and your plan, such as a price change. If you buy a plan, Stripe receives it too (clause 4). Nothing else is sent to it unless you ask.
• Your password, if you set one. It goes from your device straight to Supabase, which keeps only a one-way hash of it; our own server never receives it, and nobody can read it back.
• News emails, only if you turn them on — when you create an account or in Settings, one for each new set and a weekly digest, both off until you tick them. We keep your two choices, a random code that lets the unsubscribe link in every email work without signing in, and a record of which email went to which account so none is sent twice. Unticking either, or the link in any email, stops it.
• A name and profile picture, only if the provider you sign in with sends them — Google does (clause 2). Supabase stores them with the sign-in; the app never reads or shows them.
• Your settings — the grading company you picked, your shipping costs, your selling-fee rate, and how far you got through the first-visit walk-through, and any submission goals you write on the To-dos page — so a new browser or the phone app opens the same way. The Graders page shows how many accounts picked each company, only as a total across at least 25 accounts, never who.
• How long your submissions took, only if you share it — off until you tick it in Settings → Data & extension. For each submission that has come back we read the company, the day it was sent and the day it came back, and count them into that company’s median on the Graders page, shown only once ten are back. No card, price or name is part of it. Unticking it stops it.
• Your collection, as one record attached to your account. It is readable only by your own sign-in, and it holds the cards you added, what you paid, the grade you expect, and what a submission cost when you marked one as sent.

When you buy a paid plan, you pay on Stripe’s own page. Your card number, expiry and security code go to Stripe and never reach us. We give Stripe your email address and an internal reference to your account, so a payment lands on the right account.

Stripe tells us back only what the plan needs: which plan you hold, whether the subscription is active, when the paid period ends, and Stripe’s own ids for you as a customer and for the subscription. Receipts, invoices and the card on file are held by Stripe and shown to you on the Manage billing page.

In the phone app, a plan is bought from the App Store or Google Play instead, and never from Stripe. RevenueCat checks the purchase and tells us which plan it bought, which store, whether it is still paid for, and when the paid period ends. Changing or cancelling it is done in that store’s own subscription settings.

Every plan with a daily limit needs to know how much of it you have used today. Signed in, the count is kept against your account. Signed out, it is kept against a random id in a cookie named sb_subject, set by our server the first time you visit, kept for a year, readable by our server alone, and not derived from anything about you.

The count is one row per account or browser per day: that id, the date, and how many Grading Outlooks and card lookups were used. It holds no card, no search and nothing you typed.

So that a new browser session does not reset the allowance, our server also counts requests against a one-way hash of your network address. That hash is held in the server’s memory only: it is never written to a database or a file, and it is gone when the server restarts. Our browser extension uses the same count. Signed out, it is kept in memory against that hash and a random token of the extension’s own — never stored, never linked to you. Signed in on the site, the extension’s cards count against your account, under your plan, like any other.

• Card searches and price lookups go to our server, and our server asks a third-party card catalogue. The catalogue sees a request from us, not from you — it does not receive your address, your collection or anything that identifies you. What we send is the card being asked about.
• Our browser extension, on a card listing of a marketplace it supports, sends that listing’s text to our server as soon as the page opens — or when you open its badge, if you switched automatic rating off for that marketplace — its title, the price it prints, whether it says the card is already graded, and the set code and card number where the page states them in fields of their own, with the listing’s web address, so the badge in the corner of the page can answer. A lookup you type into its Search tab sends what you typed. Nothing else on the page is read, no picture is sent, and it runs on no other page but those listings and ours. The list of cards you looked at, which its History tab shows, stays in your browser and is never sent.
• A message you send us from the support page or the app keeps what you wrote, the address a reply goes to (your account’s, or the one you typed), the page you sent it from and, for a wrong-price report, the card and the figures that page showed. It is stored with us, together with your account if you were signed in and the app’s version if you sent it from the phone, and emailed to us (clause 2). A screenshot you attach from the app is emailed to us and not stored with the message.
• A photo you take in our phone app to add a card goes to our server, which passes it to the same card catalogue to identify the card, and nothing else. We do not store the photo: the answer is the card, and the picture is dropped when the request ends. You need to be signed in to send one, and each counts against your daily allowance (clause 5).
• Card photographs load directly from the catalogue’s image host, the same way any image on any website loads. That host therefore receives your IP address and your browser’s user-agent string, and we do not control what it logs. This and Google Analytics, next, are the two places where a third party sees your browser rather than our server, and they are worth knowing rather than glossing over.
• Google Analytics receives, straight from your browser or the phone app, a note each time a page or screen opens: its route, cut as clause 2 describes, the name of the website that sent you, and the identifier and device details of clause 2. Google sees your network address when a note arrives. A note never carries your account, your email, what you searched for, a price you typed or a submission’s id. The website loads it only on slabscore.io itself, never on our test copies.
• Our own usage notes, the count clause 1 describes. They go to our server and to no one else. One note is one row, and a row holds six things: the random session id from the slabscore.sid cookie of clause 7; the address of the page it happened on, without the part after the ?; which of 13 things happened; the catalogue’s own id for a card, when the note is about one card; the venue code of clause 7; and a short detail such as which game, how many cards were in a submission, or the kind of place a visit came from — the kind only, never the website or the page you were on. The 13 are: that a page was opened and, on the first page of a visit, whether you came from a search engine, a social network, another website or none of these; that a search was made; that a card was added to a collection; that a card was priced; that a card was rated; that a submission was planned, and that one was marked as sent; that one of our printed QR codes was scanned; that a sign-in link was requested; that a sign-in completed; that a new account completed its first sign-in; that someone signed out; that our own server failed on a page, and which page it was; that the browser was signed in to one of our own team’s accounts, so our own use can be left out of the counts. We read them as totals, and as the pages one session id opened in order — never joined to an account.
• What a usage note never holds: your IP address, your browser’s user-agent string, your name, your email address or your account — the notes are the same whether you are signed in or not, apart from the one that marks a browser signed in to our own team’s account — the token our browser extension uses, and anything you typed. A search term travels in the part of the address after the ?, and that part is removed before the row is written. Nothing is recorded at all for a request whose browser names itself as a bot or a link previewer.

Cookies, all on this site’s own address and limited to it:

• slabscore.settings — your chosen grading company, your shipping costs in each direction and your selling-fee rate, for a year. It is sent to our server with each page so a page rendered there computes the same numbers you see.
• slabscore.usualGrade — only if you pick a usual grade in Settings: that grade, for a year, so a card page opens on it.
• slabscore.sid — the random session id behind the usage notes of clause 6, for a year.
• slabscore.venue — only if you arrived by scanning one of our QR codes: which code, a short label such as the name of a card show, for a year.
• sb_subject — the random id behind the daily allowance of clause 5, for a year.
• The sign-in cookies, named sb-…-auth-token, only while you are signed in. They keep you signed in and are removed when you sign out.
• _ga and _ga_… — set on slabscore.io by Google Analytics (clause 2): a random id that tells one browser from another, and the visit in progress, each for up to two years. Only on slabscore.io itself, and never for a visit from the European Economic Area, the United Kingdom or Switzerland (clause 2).

Browser storage, which never leaves your device:

• slabscore.collection.v1 — your collection, when it is kept in this browser rather than with your account. It is never transmitted to us.
• slabscore.collection.source — whether this browser shows the collection stored here or the one stored with your account.
• Display preferences — the last game you picked, table density, whether the sidebar is collapsed, and which first-visit tips you have dismissed — under names beginning slabscore., plus an import you have not finished, kept only until the tab closes.

None of these is used to follow you between sites or to advertise. Stripe’s payment and billing pages are on Stripe’s own site and set Stripe’s own cookies there. SlabScore is operated from the United States and shows no consent banner. Every cookie above is needed for the app to work or is our own count, except the two Google Analytics cookies: blocking them in your browser, or with Google’s Google Analytics Opt-out Browser Add-on, stops them and changes nothing else about the app.

No advertising or ad networks. No third-party script but Google Analytics (clause 2): no tag manager containers, embedded widgets, social buttons or session recording. No fingerprinting. No mailing list. We do not sell, rent or share data.

This is checkable rather than asserted: the only third-party code the app ships is the web framework, the libraries that render the page, the client libraries for Supabase and Stripe named in clause 2, and Google’s analytics library — Google’s tag on the website, Firebase Analytics in the phone app — set up to count visits for us with every advertising feature off.

• Your account and collection — until 30 days after you delete the account, or ask us to (clause 10).
• Earlier versions of your collection — each save keeps the version it replaced for 90 days, so a change can be undone from Settings → Your data. They go with the account.
• Messages you send us — kept without a fixed limit, because a report may be the only record of a problem. Deleting your account removes its link to your account; ask us to delete a message and we will.
• The subscription record — while the account exists. Stripe keeps its own payment records for as long as the law requires it to.
• The daily allowance counts — kept until the account they are counted against is deleted. A count against a browser id is never deleted, and belongs to nobody once that cookie is cleared.
• The hashed network address — only in the server’s memory; never stored.
• Our own usage notes — kept without a fixed limit. A note is only ever added, never changed, and it cannot be traced back to you, because the session id is the only identifier in it and it is not derived from anything about you.
• Hosting logs — Vercel’s short rolling period (clause 2).
• Google Analytics — Google keeps the detail of each page or screen view, and what it holds about one browser or app install, for 14 months, counted again from each new visit — the setting on our Google Analytics property. After that only totals remain. It holds nothing we could find by your name or email, so clearing its cookies, or reinstalling the app, starts a new identifier.

Wherever you live, you can ask us for a copy of the personal data we hold about you, to correct it, or to delete it, and you can object to how we use it. Email admin@slabscore.io from the address on the account; we may ask you to confirm the request from that address before we act on it.

You can delete your account yourself, in Settings → Account: it lists what goes, then asks you to type the account’s email before anything happens. Or email us, as above. The account is signed out everywhere at once and deleted 30 days later; signing in before then cancels the deletion and nothing is removed.

Deleting an account deletes its sign-in, its collection and its earlier versions (including the records of cards sent to a grader), its plan record and the daily counts kept against it. The collection kept in a browser is not touched. A paid plan still running has to be cancelled first (Manage billing), or ask us to cancel it in the same email. A plan bought in the phone app does not stop deletion, but only the App Store or Google Play can cancel it: it keeps billing until you cancel it there. Stripe keeps its own records of past payments as the law requires, and we cannot delete those.

Without an account, clear this site’s data in your browser: that removes your collection, your settings and the cookie ids, and nothing that identifies you remains with us. We cannot recover a collection kept only in a browser once it is deleted. Your collection can be exported at any time from Settings as a backup file.

If you are in the UK or the EU and are not satisfied with our answer, you can complain to your data protection authority.

SlabScore is for people aged 13 and over. We do not knowingly collect personal data from anyone under 13. If you believe a child has created an account, email admin@slabscore.io and we remove it.

SlabScore is operated from the United States, and the services in clause 2 process data in the United States; Google may also process Google Analytics data in other countries where it operates. If you use SlabScore from elsewhere, your data is transferred there.

When the app starts storing or sending something this page does not describe, this page is rewritten before that ships, not after, and the effective date at the top changes with it. A privacy page describing an architecture the app no longer has is a false statement rather than an out-of-date one.

Dead Center Studios LLC is the company behind SlabScore and is responsible for this page.

Privacy questions, data requests and complaints: admin@slabscore.io.