Legal · Draft

Privacy Policy

Last updated: 2026-05-21. This document is a working draft awaiting legal review before public launch — treat as informational only.

Summary in one paragraph

Cardhunt is a tool for individual Pokémon TCG collectors. We store the cards you add, the cost basis you record, the transactions you log, the wishlist and hunt items you save, and the magic-link sign-in identifier we use to recognise you. We do not sell your data, we do not run advertising trackers on signed-in pages, and you can export or delete your collection at any time by contacting privacy@cardhunt.vanhoek.com.

Data we collect

Account: email address (used for magic-link sign-in via Supabase), display name, optional public profile slug.
Collection: cards you add, their finish, condition, language, grade, photos, purchase price, acquisition type/source/date, and any notes.
Finance: transactions you record (purchase, sale, trade) with amount, counterparty, date and linked card.
Engagement: last-seen timestamp written when you open the app while signed in (used for the admin Last visit column only).
System: standard server logs (IP, user agent, timestamps) retained by our hosting provider (Vercel) and database (Supabase) for security and abuse prevention.

How we use it

Your data powers the features you signed up for: collection management, P&L computation, hunt watchlists, and the admin tools we use to operate the service. We do not share collection-level data with third parties for advertising. Pricing comes from PriceCharting (catalog + market data) and card metadata from the Pokémon TCG API — we send card identifiers, not your personal data, to either.

Third parties we rely on

Supabase — database, authentication, file storage. supabase.com/privacy
Vercel — hosting, edge network, analytics. vercel.com/legal/privacy-policy
PriceCharting — pricing data (one-way, no personal data sent).
Pokémon TCG API — card metadata and images (one-way, no personal data sent).

Your rights (GDPR)

You can request a copy of your data, correction of inaccurate data, or deletion of your account and collection at any time. Email privacy@cardhunt.vanhoek.com and we will respond within 30 days. You can also sign in and remove cards or your account from the Settings page once that flow ships.

Cookies & tracking

We use one essential cookie for keeping you signed in (Supabase session). We do not run third-party advertising trackers. Vercel Analytics is enabled for anonymous page-view counts; no per-user cross-site tracking.

Contact

Questions or requests: privacy@cardhunt.vanhoek.com.