Privacy Policy
Last updated 16 October 2026
The short version
PocketPrices stores your account email and the card collection you build. It runs no analytics and no tracking of any kind, sets no advertising cookies, and sells nothing to anyone. Photographs you scan are not kept — they are turned into a numeric fingerprint, matched against our card catalogue, and discarded.
What we collect
- Your email address
- Needed to create an account, sign you in, and send password resets. Handled by Supabase Auth; we never see or store your password, only a hash held by Supabase.
- Your collection
- The binders you make and the cards in them, including quantity, condition, whether a card is marked for trade or sale, any asking price you set, and favourites. This is the product — it is stored so that it is there when you come back.
- Daily value snapshots
- Once a night we record what your collection and each binder were worth, so the value graph has a history to draw. One row per day.
- Scan counts
- How many scans you have used today, so the free allowance can be enforced. For signed-out visitors this is counted against a salted, irreversible hash of your IP address — the address itself is never written down. Counts older than seven days are deleted automatically.
- A browser setting or two
- Your light/dark theme preference and, if you are not signed in, how many scans you have used today. Both live in your browser's local storage and are never sent to us.
Photographs you scan
When you scan, your device finds the cards in the image and sends each cropped card to our embedding service. That service converts the image into a list of 768 numbers describing what it looks like, returns them, and keeps nothing: it holds no database credentials and writes no files.
The numbers are compared against the fingerprints of catalogue cards to work out which card you photographed. The photograph is never stored, never attached to your account, and never used to train anything.
What we do not do
- No analytics, telemetry, session recording or heatmaps
- No advertising, ad networks or advertising identifiers
- No selling or sharing of personal information
- No tracking you across other websites or apps
- No email beyond the ones you ask for — sign-up confirmation and password resets
Who processes your data
We use a small number of services to run the app. Each sees only what it needs to do its job.
- Supabase
- Database, authentication and transactional email.
- Vercel
- Hosts and serves the website.
- Cloudflare R2
- Serves card artwork. These are catalogue images, not yours — it holds nothing about you.
- Fly.io
- Runs the embedding service that reads scanned images. It receives the cropped image and returns numbers; it stores nothing and has no access to your account.
- Stripe
- Takes payment if you subscribe to Pro. Your card details go to Stripe directly and never reach us — we store only your Stripe customer id, the plan you are on and when it renews.
Card names, prices and artwork come from third-party catalogue and marketplace sources. Those are requests we make about cards, not about you — no request to them carries your identity.
Your data, and getting rid of it
You can edit or delete any binder or card at any time, which removes it. To delete your whole account and everything attached to it, email us at privacy@pocketprices.app and we will do it. Deleting your account removes your collection, your snapshots and your scan counts; the database enforces that with cascading deletes rather than relying on us to remember. If you have subscribed, cancel first from your billing page — deleting the account removes our record of the subscription, not the subscription itself. Stripe keeps its own payment records for as long as tax and accounting law requires, which is not something either of us can waive.
Depending on where you live you may have rights to access, correct, export or delete your personal information, and to object to its processing. The same address reaches us for any of those.
Children
PocketPrices is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, write to us and we will remove it.
Security
Every row of collection data is protected by database-level row-level security, so one account cannot read another’s even if the application has a bug. Traffic is encrypted in transit. No system is perfect, and we will tell you if something goes wrong that affects you.
Changes
If this policy changes in substance we will update the date at the top and, for anything material, tell account holders by email.