Privacy Policy

Last updated: September 1, 2026  ·  Effective immediately

1. Who We Are

CardResell is operated by Will Jones, an individual doing business as CardResell, located in Bradenton, Florida. Contact: will@cardresell.org.

2. Information We Collect

Account data: When you sign in with Google, we receive your Google account ID, display name, and email address. This is used solely to authenticate you and link your credits and subscription.

Usage data: We store account-linked information such as scan credit balances and subscription status using Firebase (Google) and Upstash (Redis). Portfolio, flip, and collection information may also be stored in your browser's local storage and, where an account-sync feature is available, associated with your Google account ID.

Card images: When you use the Card ID Scanner, your card photo is sent to Ximilar's API for identification. When you use AI Grading, card photos are sent to OpenAI and may also be sent to Ximilar for computer-vision grading and card matching. Images are transmitted securely, and CardResell does not retain the raw images on its servers after completing your request. Third-party providers process inputs under their own policies; see Ximilar's Terms of Use & Privacy and OpenAI's Privacy Policy.

Payment data: Payments are processed by Stripe. CardResell never sees or stores your full credit card number. See Stripe's Privacy Policy.

Analytics: We may use basic analytics (page views, feature usage) to improve the app. This does not include personally identifiable information.

3. How We Use Your Information

• To authenticate you and maintain your session.
• To track your scan credit balance and subscription status.
• To process payments and manage your subscription through Stripe.
• To identify cards using Ximilar and to estimate card condition using OpenAI and/or Ximilar on your behalf.
• To store your flip history and collection data so it persists across sessions.
• To send transactional emails (e.g., password reset) via Firebase Auth.

4. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We share data only with the following service providers necessary to operate the app:

• Firebase / Google — authentication and database storage.
• Upstash / Redis — session and credit caching.
• Stripe — payment processing.
• Ximilar — card identification, card matching, and computer-vision grading.
• OpenAI — AI grading analysis.
• Vercel — hosting and serverless functions.

We may also disclose data if required by law or to protect the rights, property, or safety of CardResell, its users, or the public.

5. Data Retention

Your account data is retained as long as your account exists. You may request deletion of your account and associated data at any time by emailing will@cardresell.org. We will process deletion requests within 30 days.

Card images submitted for scanning are not retained by CardResell after the API response is returned. Ximilar's and OpenAI's respective data-handling and retention policies apply while they process API inputs; see their policies linked above for details.

6. Cookies & Local Storage

CardResell uses Firebase authentication technology to maintain your signed-in session. We do not use third-party advertising cookies. We use browser local storage and session storage for app functions including portfolio, flip, and collection records, preferences, cached interface state, and temporary session state. Information stored in your browser remains on that device until you clear browser data or the app removes it; anyone with access to that browser profile may be able to view it.

7. Children's Privacy

CardResell is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Your Rights

Depending on your location, you may have rights including:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and data.
• Portability: Request your data in a portable format.

To exercise any of these rights, email will@cardresell.org.

9. Security

We take reasonable measures to protect your information, including HTTPS encryption, Firebase security rules, and server-side authentication checks. No method of transmission or storage is 100% secure; use the Service at your own risk.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance of the revised policy. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about this Privacy Policy? Email will@cardresell.org.