Privacy policy

1. What stays on your device

Your collection (cards, quantities, condition, notes, cost basis, price history, and daily value snapshots) is stored in a local database on your phone. Your preferences (theme, currency, language, dashboard layout) are stored locally as well. None of this is uploaded unless you use a feature that needs it, described below.

2. What we collect and why

• Account information (email address, display name, optional username, bio, and profile picture) when you create an account. Used to sign you in, sync your subscription across devices, and show your profile in the Community. Stored with our database provider, Supabase.
• Purchase information (subscription status and receipt identifiers, never your card number) processed by RevenueCat and the App Store or Google Play so we can unlock paid features.
• Community content you choose to post: captions, the card you attach, its value and gain or loss, and your likes, comments, and follows. This content is visible to other users.
• Collection summary (total value, cost basis, and card count for the day) when you are signed in, so your profile can show collection stats. Individual cards are not uploaded.
• Product analytics such as “card added” or “scan completed” events, without personal information, to understand which features are used. Analytics are disabled in the current build.

3. Camera and photos

When you scan a card, a downscaled photo is sent once to an AI identification service (OpenAI, or our own server that forwards to it) to read the card name and set. The photo is used only for that request and is not stored by SlabX. When you pick a profile picture, it is uploaded to our storage provider and shown on your profile.

4. Third parties we send data to

• Supabase (account, profile, Community content, collection summary).
• RevenueCat, Apple App Store, Google Play (subscriptions).
• OpenAI (card photos for identification and card names for AI valuation; no personal information).
• PSA (certification numbers you enter for verification).
• Scryfall, the Pokemon TCG API, YGOPRODeck, and public eBay listing pages (card names you search for, to fetch prices and images).
• Public news feeds (Market Pulse fetches published articles; nothing about you is sent).

We do not sell your data. We do not use cross-app tracking or advertising identifiers.

5. How long we keep it

Account and Community data are kept while your account exists. When you delete your account, your profile and Community content are removed immediately and any remaining server data is deleted within 30 days. Data on your device stays until you delete the app or remove it in Settings.

6. Deleting your account and data

In the app, open Settings, then Delete account. You can also email support@getslabx.com from the address on your account and we will process the deletion within 30 days. To remove data stored on your device, delete the app.

7. Children

SlabX is not directed to children under 13 and we do not knowingly collect personal information from them. Collections for kids can be tracked by a parent inside the parent's app.

8. Security

Data in transit is encrypted with TLS. Server data is stored with providers that offer encryption at rest and access controls. No system is perfectly secure, so please use a strong, unique password.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. Email support@getslabx.com and we will respond within 30 days.

10. Changes

If this policy changes in a meaningful way, we will update the date at the top and note the change in the app.

11. Contact

Questions about privacy: support@getslabx.com.