Privacy Policy

1What we collect

Crash Card Radar collects the information listed below, as stated in this policy. This includes your name, email and hashed password (when you create an account), your email-tips choice, your My scans list, scan photos and text processed for card matching, basic usage and device info with hashed IP addresses, and settings saved in your browser.

• Account info (needed to use the app): your name, your email address and, if you set one, a password. We store only a secure hash of your password, never the password itself. If you use a sign-in link or code, we keep a hash of it only until it expires.
• My scans: the cards and products you scan or add, and your running total, so they follow you between devices.
• Scan photos and text: a photo you scan is sent to our server so it can be matched to a card. We don't keep scan photos as a rule. A small number may be saved briefly to fix scanner problems. When a card isn't in our catalog yet, we may save its name and details so it can be added.
• Basic usage and device info: pages and features used (for example the home page and the app), the date and time, the device type (like iPhone or Windows), your browser type and user-agent, the website that linked you here (referrer, without its query string), and any campaign tag in the link you followed (like ?utm_source=tiktok). This is our own first-party visitor count; it isn't shared with or sold to analytics or ad companies, and it uses no extra cookies. We don't store raw IP addresses in our traffic stats, only a salted, one-way hash of them. Your IP address is used briefly for rate limits and to estimate a rough location (city or region level) for scan activity.
• Settings saved in your browser, like your language and scanner preferences.

2Why we use it

• To run the site: signing you in, saving your scans, matching cards, and showing prices.
• To keep it safe and fast: rate limits, blocking abuse, and approving or blocking devices.
• To improve it: seeing which features people use and which cards are missing. We (the operator) get notified when scans happen, including the matched card, device type, and rough location, so problems can be spotted and fixed.
• To email you about sign-in, like sign-in links and verification codes. We only send Hot list tips and stream alerts if you tick “Email me Hot list tips & stream alerts” (off by default); you can untick it in your account or reply to unsubscribe anytime.

3Cookies and local storage

We use a small number of first-party cookies that the site needs to work:

• Sign-in session cookies: keep you signed in (up to about 400 days, renewed as you use the app).
• Device cookie (ccr_dev): a random ID that identifies your browser for rate limits and device checks. We store only a hash of it.
• Language and preferences: remember your settings.

There are no advertising or cross-site tracking cookies. The app can also save files on your device for offline use (a service worker cache). You can clear cookies and site data in your browser at any time, but that signs you out.

4Who we share it with

We don't sell or rent your personal information, and we don't "share" it for cross-context behavioral advertising. We only use services that help run the site:

• Hosting: the site runs on a DigitalOcean server in the US.
• Email delivery: to send sign-in links and codes to your email.
• Approximate location lookup: your IP address is sent to an IP-location service (ip-api.com) to get a rough location for scan activity. It is not saved with your scans.
• Operator notifications: scan and device alerts go to the operator's own email.

Prices come from public data (TCGCSV, Pocamarket, eBay listings). We don't send your personal data to those sources. When you click a link to another site (like TCGplayer, eBay, or Whatnot), or an affiliate link, that site's own privacy policy applies. We may also share information if the law requires it, or to protect the site and its users from abuse.

5How long we keep it

• Account info and My scans: until you delete them or ask us to delete your account.
• Sign-in links and codes: until they expire, usually within minutes.
• Sign-in sessions: until you sign out, they expire, or they're removed.
• Traffic stats and server logs: kept only as long as they're useful for running and fixing the site, and individual visit records are deleted after about 13 months (totals may be kept).

We use reasonable steps to protect your data, like HTTPS, hashed passwords and tokens, and limited access, but no website can promise perfect security.

6Your choices and rights

You can ask us to see, correct, download, or delete your personal information, including your account and saved scans. Email Crash23411@gmail.com from the address on your account and say what you want. We'll reply within a reasonable time, usually within 30 days. We won't treat you differently for asking.

7California and other US state residents

If you live in California or another US state with privacy laws, you have the rights listed above: to know what we collect, to delete or correct it, and to opt out of the sale or sharing of your data. We don't sell or share personal information, so there's nothing to opt out of. We don't use sensitive personal information to profile you. The categories we collect are listed in What we collect. They come from you and your device, and we use them only for the reasons in Why we use it.

8Kids

Trading cards are for all ages, but sign-in accounts aren't meant for children under 13, and we don't knowingly collect their personal information. If you think a child under 13 has given us personal information, email us and we'll delete it.

9Changes

We'll update this page if how we handle data changes, and update the date at the top. If a change is significant, we'll make it clear on the site. Also see our Terms of Use.

10Contact

Privacy questions or requests: Crash23411@gmail.com. Operator: Crash23411 (@crash23411), crashcardradar.com.