Privacy Policy

1. Introduction and Scope

MyCardRep ("MyCardRep," "we," "us," or "our") operates mycardrep.com and any related services (collectively, the "Service"). This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use our Service. This policy applies to all users of the Service, including visitors, registered users, and any other individuals who interact with our platform.

By accessing or using the Service, you expressly consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with any part of this Privacy Policy, you must immediately discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide Directly:

• Account registration information, including email address and password
• Profile information, including username, biography, sport and collectible tags, and links to external accounts
• Profile photographs and images you upload
• Deal logs, including descriptions, approximate values, dates, and the parties involved — including deals you log against another person's off-platform handle (e.g., a Reddit or Instagram username)
• Reviews, ratings, responses, and other content you submit
• Reports you submit about other traders, including identifiers (such as a username or social-media handle), the platform, a description of your experience, and any photographic evidence you attach (see Section 5A)
• Private inventory, sales, trade, and expense records you choose to track, including card details, purchase sources, costs, purchase dates, storage locations, and sale amounts (visible only to you)
• Payment and subscription information when you subscribe to a paid plan. Card payments are processed by our payment processor, Stripe; we do not store your full card number. We retain limited billing data such as your subscription status, plan, renewal date, and payment-processor identifiers (see Section 5B)
• Communications you send to us

2.2 Information Collected Automatically:

• Log data, including IP address, browser type, pages visited, and time spent on pages
• Device information, including device type, operating system, and unique device identifiers
• Usage data, including features used, actions taken, and interactions with other users
• Cookies and similar tracking technologies

2.3 Information from Third Parties:

• If you sign in using Google, we receive your name, email address, and profile photo from that service, subject to your privacy settings with that provider
• Publicly available information about external accounts you choose to link to your profile

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, maintain, and improve the Service
• To create and manage your account
• To display your public profile and reputation information to other users and visitors
• To process and display deal logs, reviews, and reports
• To send transactional communications, including deal confirmations and invitations
• To detect, investigate, and prevent fraudulent activity, abuse, and violations of our Terms of Service
• To enforce our Terms of Service and other policies
• To comply with applicable laws, regulations, and legal processes
• To respond to your inquiries and requests
• To analyze usage patterns and improve user experience
• To process payments, manage subscriptions, and administer any paid plan and the referral program
• We do not currently serve advertisements. We reserve the right to introduce advertising in the future. Your continued use of the Service after any such change constitutes your acceptance of it.

4. Public Information

The following information is publicly visible to all visitors, including those who are not logged in, and may be indexed by search engines:

• Your username and profile photograph
• Your biography and sport/collectible tags
• Your linked external accounts (eBay, Reddit, Instagram, etc.)
• Your deal history, including descriptions, approximate values, and dates
• Reviews you have received, including written explanations and responses
• Your reputation tier, statistics, and badges
• Reviews you have left for other users
• Reports you submit about other traders — including your username as the reporter, the handle and platform reported, your description, the date, and any evidence image you attach — which are surfaced through search features such as "Find a collector" (see Section 5A)
• Your responses to reports or deals concerning a handle you have verified as your own

You understand and agree that any information you add to your public profile, or submit as a review, deal log, or report, will be publicly visible and may be indexed by search engines. Your email address is never displayed publicly.

Reviews, deal logs, and reports may remain publicly visible even after account deletion, as they form part of the community's trust record and the integrity of the reputation system depends on their persistence.

5. Information Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: We use Supabase for database hosting, authentication, and file storage, and Stripe for payment processing and subscription billing. These providers process data on our behalf and are contractually obligated to protect your information.
• Authentication Providers: If you use Google sign-in, that service shares limited profile information with us pursuant to its own privacy policy.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of MyCardRep, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

5A. Trader Reports (Find a Collector / Community Watch)

MyCardRep allows eligible, logged-in users to submit first-hand accounts of their experiences with other people during card transactions, including people who are not MyCardRep members and who are identified by an off-platform handle (such as a Reddit or Instagram username) or by a MyCardRep account. A negative report must include photographic evidence. These reports, and reputation information derived from them, are publicly visible and searchable through features such as "Find a collector," and may be indexed by search engines.

You acknowledge and agree that:

• Reports are submitted voluntarily by users and represent the personal, first-hand experience and opinion of the submitting user only. They are not statements, findings, endorsements, or conclusions of MyCardRep. MyCardRep acts solely as a neutral host of user-generated content.
• MyCardRep does not verify, investigate, endorse, or confirm the accuracy of any report, and makes no representation that any report is true.
• Reports are labeled as unverified and are attributed to the user who submitted them.
• Whether a report is surfaced is determined by automated, objective criteria (such as the reporter's account standing and age, the presence of evidence, and corroboration by other independent users). MyCardRep does not editorially select, rank, or adjudicate the truth of individual reports.

If you submit a report, you represent and warrant that: it is your truthful, good-faith, first-hand account; you have a lawful basis to provide any information about another person that it contains; it does not include another person's private personal information (such as a home address, telephone number, or financial-account number); and it does not violate our Terms of Service or any applicable law. You are solely responsible for the content of any report you submit, and you agree to indemnify MyCardRep in connection with it as set out in our Terms of Service.

If you are the subject of a report: You may respond publicly by creating an account and verifying that the handle is yours, after which you may post a response to any report about that handle. You may also flag any report for review, or request correction or removal by contacting [email protected]. MyCardRep may remove or hide any report at its discretion, including reports it determines to be false, abusive, to contain prohibited personal information, or to be non-compliant with our Terms. We will review such requests and respond within a reasonable timeframe, subject to our need to retain certain records for the integrity of the feature and as permitted or required by law.

Reports and responses may remain publicly visible as part of the community's trust record; see Section 6.

5B. Payments, Subscriptions, and Referrals

If you subscribe to a paid plan, your payment is processed by Stripe, Inc. Stripe collects and processes your payment card details directly under its own privacy policy; MyCardRep does not receive or store your full card number. We store limited billing information — such as your plan, subscription status, renewal date, and Stripe customer and subscription identifiers — to operate your subscription.

To operate our referral program and prevent fraud and abuse (such as self-referrals and duplicate accounts), we may use a non-reversible "fingerprint" of a payment card provided by Stripe, along with account name and email, to detect when the same person or payment method is used across accounts. We do not use this information for any purpose other than administering the referral program and preventing abuse.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We may retain certain information after account deletion as required by law, for legitimate business purposes, or to maintain the integrity of the reputation system. Reviews, deal logs, and reports submitted by or about you may be retained indefinitely as part of the community's trust record.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, secure hosting infrastructure, and access controls.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. You use the Service at your own risk, and you are responsible for maintaining the confidentiality of your account credentials.

8. Your Rights and Choices

Subject to applicable law, you may have the following rights regarding your personal information:

• The right to access the personal information we hold about you
• The right to correct inaccurate personal information
• The right to request deletion of your personal information, subject to our data retention policy
• The right to opt out of marketing communications

To exercise these rights, contact us at [email protected]. We will respond within a reasonable timeframe. Please note that certain information may be retained as described in Section 6. If your request relates to a report about you, see Section 5A, which describes how to respond, flag, or request removal, and how such requests are handled.

9. Cookies

We use cookies and similar tracking technologies to operate the Service, remember your preferences, and analyze usage. By using the Service, you consent to our use of cookies. You may disable cookies through your browser settings, but doing so may affect the functionality of the Service.

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a child under 13, please contact us immediately at [email protected].

11. Third-Party Links

The Service may contain links to third-party websites, including external accounts linked on user profiles (eBay, Reddit, Instagram, etc.). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11A. International Users and Data Transfers

MyCardRep is operated from the United States, and the information we collect is processed and stored in the United States and by our service providers. If you access the Service from outside the United States, including from the United Kingdom, the European Economic Area (EEA), or other regions, you understand and agree that your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

For users in the UK and EEA: Where the UK GDPR or EU General Data Protection Regulation (GDPR) applies to our processing of your personal data, the following additional terms apply.

Lawful bases. We process your personal data on the following bases: (a) performance of a contract, to provide the Service you have requested; (b) your consent, which you may withdraw at any time; (c) our legitimate interests in operating, securing, and improving the Service and maintaining the integrity of the reputation system, provided these are not overridden by your rights; and (d) compliance with legal obligations.

Your rights. Subject to applicable law, you have the right to access, correct, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in the EEA, your national data protection authority).

International transfers. Where we transfer personal data from the UK or EEA to the United States, we rely on appropriate safeguards as required by applicable law. You may contact us for more information about these safeguards.

Data relating to third parties (Trader Reports). If you submit a report containing personal data about another person, you are responsible for ensuring you have a lawful basis to provide that information. If you are the subject of such a report and are located in the UK or EEA, you may exercise your data protection rights, including access and erasure, by contacting us as described in Section 5A and below.

To exercise any of these rights, contact us at [email protected]. We will respond as required by applicable law.

12. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. We will notify users of material changes by posting the updated policy on this page with a revised date. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

13. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at [email protected].