Privacy Policy

Last updated: 2026-11-03

CardTracker SaaS Demo ("we," "us") is a web application for trading card sellers to manage inventory, orders, and fulfillment, and to optionally connect their own accounts with third-party services like Mana Pool, eBay, and EasyPost. This page explains what information we collect, how we use it, and who we share it with.

Information you provide directly

Account information: shop name, email address, and password. Passwords are never stored in plain text - only a salted scrypt hash.
Inventory data: card names, sets, conditions, quantities, prices, cost basis, and storage locations you enter or import.
Third-party credentials you choose to connect: if you link your own Mana Pool, eBay, or EasyPost account, we store the API key/token you provide (or the OAuth token eBay issues) so the app can act on your behalf - for example, pulling your orders, pushing inventory updates, or buying a shipping label. These credentials are only ever used to call that service's API for actions you take in the app; we don't use them for anything else.

Information from your sales activity

When an order syncs in from a connected marketplace (or you ship something through the app), we store the buyer's name and shipping address - this is required to print a shipping label and track fulfillment. It's used only for that purpose.

What we don't do

We don't run any third-party analytics, advertising, or tracking scripts on this site.
We don't sell your data or your customers' data to anyone.
We don't share your data with third parties except the specific services you personally connect (Mana Pool, eBay, EasyPost), and only to carry out the actions you request through those integrations.

Cookies

We use a single session cookie to keep you signed in. It's cryptographically signed and contains no information beyond your account identifier and session expiry. There are no advertising or third-party tracking cookies.

Data retention and deletion

We retain your account and inventory data for as long as your account is active. To request deletion of your account and associated data, contact us using the information below.

Security

All traffic to this site is encrypted (HTTPS). Passwords are hashed, never stored in recoverable form. Access to the underlying server and database is limited to the operator.

Children's privacy

This service is intended for business use by card sellers and is not directed at children under 13. We do not knowingly collect information from children.

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.

Contact

Questions about this policy or your data can be sent to support@cardboardcounter.com.