Legal
Privacy policy
Last updated September 7, 2026
1. Who is responsible
The data controller for the SlabX app and getslabx.com is SlabX, Las Vegas, Nevada, United States. Privacy contact: support@getslabx.com. Postal address: being set up; until it is published here, write to the email address above and we will answer by email or, on request, by post.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use advertising identifiers or cross-app tracking. Policy version 2026-09-07.
2. The short version
- Your collection lives on your phone. It is not uploaded unless you use a feature that needs it, and we say so at that point.
- An account is optional. It holds your email, profile, subscription status, and anything you post to the Community.
- Card photos are sent once for identification and are not kept.
- News emails are opt-in only, and every one carries an unsubscribe link that works with one click.
- Website analytics are off until you say yes. A Global Privacy Control or Do Not Track signal keeps them off.
3. What stays on your device
Your collection (cards, quantities, condition, notes, cost basis, price history, daily value snapshots, and the photos you attach to your own items) is stored in a local database on your phone, together with your preferences (theme, currency, language, dashboard layout). Delete the app and it is gone. A CSV export is available in Settings at any time.
4. What we collect, why, and on what basis
The legal bases below are the ones the EU and UK GDPR require us to name. Where the basis is consent, you can withdraw it at any time without affecting anything that happened before.
| Data | When | Why | Legal basis |
|---|---|---|---|
| Email address, password (hashed), display name, optional username, bio, and profile picture | You create an account | Sign you in, sync your subscription across devices, show your profile in the Community | Performance of a contract (the terms) |
| Terms and privacy acceptance and age attestation, with the time and policy version | You create an account | Prove that consent and attestation were given | Legal obligation, legitimate interest in keeping records |
| Subscription status and store receipt identifiers (never your card number) | You subscribe through the App Store or Google Play | Unlock paid features on every device | Performance of a contract |
| Posts, captions, the card attached to a post with its value and gain or loss, likes, comments, follows | You post in the Community | Show it to other users, as you asked | Performance of a contract |
| Daily collection totals (value, cost basis, card count), never individual cards | You are signed in | Show collection stats on your profile | Performance of a contract |
| Certificate numbers you look up | You verify a slab | Fetch the grade on record from the grader; results are cached so the same cert is not fetched twice | Performance of a contract |
| A downscaled card or slab photo | You scan a card | Identify the card or read the slab label, then discard the image | Performance of a contract |
| Email, name if given, the page you signed up from, and the time you ticked the news box | You join the early access list | Tell you when SlabX is ready for you, send the free Starter Guide when it is published, and, only if you opted in, SlabX news | Consent |
| Email, subject, and message | You contact support or make a privacy request | Answer you and keep a record of the request and its deadline | Legitimate interest in running support; legal obligation for rights requests |
| Whether a visit, sign-up, or purchase followed a Reddit ad (Reddit pixel) | You allow analytics on getslabx.com | Measure whether our advertising works | Reddit's own retention |
| Pages viewed, device type, approximate location from a truncated IP address (Google Analytics cookie) | You allow analytics on getslabx.com | Count visits and see which pages help | Consent |
| Page, referrer, country, and device type, with no cookie and no identifier kept (Vercel Web Analytics), and page load timings (Vercel Speed Insights) | You visit getslabx.com | Count page views and measure page speed without tracking anyone | Legitimate interest in knowing which pages are read and that they load fast |
| Referrer and browser type when a printed QR code is scanned (no IP address stored) | You scan a SlabX QR code | Count scans per campaign | Legitimate interest in measuring print material |
| A keyed hash of your IP address, kept for 24 hours | You submit a public form | Stop abuse of the forms (rate limiting) | Legitimate interest in security |
| Coupon codes you redeem and store orders | You buy through SlabX | Fulfil the order, take payment through Stripe, meet tax and accounting rules | Performance of a contract; legal obligation |
| Marketplace listings you create (item details, price, photos), orders you buy or sell, your ship-to address as a buyer, your ship-from address as a seller, and the tracking number on each shipment | You list, buy, or sell on the marketplace | Run the sale, buy the shipping label, track delivery, release payment, handle problems | Performance of a contract; legal obligation for tax records |
| Whether your identity check passed, when, and Stripe's session reference (never the document or the selfie) | You verify your identity | Show the Verified badge, and gate marketplace actions where required | Consent; legitimate interest in preventing fraud |
| Your Stripe Express account id and whether payouts are enabled | You set up seller payouts | Send you the proceeds of your sales | Performance of a contract |
| Shop profile: name, web address, location, website, logo, about text, and policies, shown publicly once approved | You apply to sell as a shop | Run your storefront and show buyers who they are buying from | Performance of a contract |
5. Camera and photos
When you scan a card or a slab, a downscaled photo is sent once to an identification service (Ximilar for cards, comics, and slab labels; Claude from Anthropic where a text read is needed) to find the card name and set or read the label. The photo is used only for that request and is not stored by SlabX. When you pick a profile picture, it is uploaded to our storage provider and shown on your profile until you change or remove it. Photos you attach to your own items stay on your device.
6. Companies that process data for us
These providers act on our instructions under a data processing agreement. Where a provider is in the United States and you are in the EU, UK, or Switzerland, the transfer basis is listed. We check each provider's Data Privacy Framework (DPF) status on dataprivacyframework.gov and fall back to standard contractual clauses (SCCs) where a provider is not certified.
| Provider | What it does for us | Data it sees | Location and transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, file storage, server functions | Account, profile, Community content, collection totals, contacts, support tickets, consent records | Hosting region set at project creation (published here once confirmed); SCCs through the Supabase DPA |
| RevenueCat | Subscription status across devices | App user id, store receipt identifiers, subscription status | United States; DPF where certified, otherwise SCCs |
| Apple App Store, Google Play | Billing for subscriptions | Handled under Apple's and Google's own policies | Your store account's region |
| Ximilar | Card, comic, and slab label recognition | The scan photo for one request; no account data | Czech Republic (EU) |
| Anthropic (Claude) | Text read of a scan when needed; AI valuation and insights on paid plans | The scan photo for one request; card names and recent sale prices, never personal data | United States; DPA with SCCs |
| PSA, PCGS, and other graders | Certificate lookups | The cert number you enter | United States; a cert number is not personal data on its own |
| Scryfall, Pokemon TCG API, YGOPRODeck, Lorcast, One Piece TCG API, TCGdex | Card catalogs, images, and prices | The card name you search for | Various; no personal data |
| eBay and SoldComps | Recent sold prices | The card name being priced | United States; no personal data |
| Resend | Sends the Starter Guide, support replies, account emails, and the news emails you opted into | Your email address and the message; for news, the opt-in time | United States; DPF |
| Stripe | Payments for the store and the marketplace; holds marketplace payments until delivery; Stripe Connect pays sellers and creators | Name, email, payment details entered on Stripe's pages, order amounts; for sellers, the identity and bank details Stripe collects for payouts | United States; DPF including the UK and Swiss extensions |
| Stripe Identity | Identity verification when you choose it or a feature requires it | Your government ID images and selfie, captured and held by Stripe; SlabX receives only pass or fail | United States; DPF including the UK and Swiss extensions |
| Shippo | Shipping rates, labels, and tracking for marketplace orders | Ship-from and ship-to names and addresses, parcel size, the tracking number; the buyer's address is printed on the label the seller receives | United States; DPA |
| Printful (when merch launches) | Prints and ships merch | Name, shipping address, order contents | United States; DPA with SCCs |
| Google Analytics (Google LLC) | Website analytics, only after you say yes | Pages viewed, device type, truncated IP | United States; DPF |
| Reddit (Reddit, Inc.) | Measures our Reddit ads, only after you say yes | Page visited, sign-up or purchase event, device and browser data Reddit collects through its pixel | United States |
| Vercel | Hosts getslabx.com and the admin screens; cookieless page counts (Web Analytics) and page speed measurements (Speed Insights) | Request logs (IP, page, browser) for a short period; for analytics, the page, referrer, country, and device type with no cookie and no stored identifier; for speed, load timings per page | United States; DPA with SCCs |
We do not use data brokers, and no processor may use your data for its own purposes.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, Community content, collection totals | While the account exists. On deletion the profile and posts go immediately and the rest within 30 days |
| Terms acceptance and consent records | The life of the account or contact plus 3 years, as evidence that consent was given |
| Scan photos | Not stored. Discarded after the identification request |
| Cert lookup results | Indefinitely, without any link to who looked them up |
| Early access and news list | Until you unsubscribe or ask us to delete you. An unsubscribe is recorded and you come off the news list; only a new opt-in from you puts you back on it. Addresses that bounce or complain are blocked from news email |
| Support tickets and privacy requests | 3 years from closing, then deleted or anonymized |
| Website analytics | 14 months (Google Analytics retention setting) |
| Rate-limit hashes | 24 hours |
| QR scan records | Referrer and browser type for 12 months; scan counts indefinitely |
| Admin audit log | 6 years |
| Payment, store order, and marketplace order records, including shipment tracking | 7 years for tax and accounting law |
| Identity verification result and session reference | While the account exists; the document itself is held by Stripe under Stripe's retention |
| Marketplace addresses | With the order record; removed from a listing draft when the draft is deleted |
8. Your rights, by where you live
Everyone can ask us to access, correct, export, or delete their personal information, and can object to or restrict a use of it, by the methods in section 9. We never discriminate against anyone for exercising a right. Regional details:
European Economic Area, United Kingdom, and Switzerland
You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. We answer within one month; if a request is complex we may extend by two further months and will tell you why. You can complain to your national supervisory authority (in the UK, the Information Commissioner's Office). Where we rely on legitimate interest we have balanced it against your rights; ask us for the assessment. We are assessing whether Article 27 of the GDPR requires us to appoint a representative in the EU and the UK; until one is named here, contact us directly at the address above.
California
As of the date of this policy, SlabX is below the thresholds that make the California Consumer Privacy Act apply (annual gross revenue above the current inflation-adjusted threshold, personal information of 100,000 or more California residents or households, or half of revenue from selling or sharing personal information). We still give California residents the same rights: to know what we collect, to delete it, to correct it, and to opt out of any sale or sharing, which we do not do. We answer within 45 days. Under the California Online Privacy Protection Act we disclose that we honor the Global Privacy Control signal and treat a Do Not Track signal the same way, as a decline of analytics.
Nevada
Under Nevada Revised Statutes Chapter 603A: we do not sell covered information as defined there. Nevada consumers may submit a verified request not to sell their covered information to support@getslabx.com, our designated request address, and we respond within 60 days. Material changes to this notice are announced by updating the date at the top of this page, by a notice inside the app, and by email to anyone on the news list.
Canada
Under PIPEDA and provincial laws you can access and correct your personal information and withdraw consent. We respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada.
Brazil
Under the LGPD you have the rights of confirmation, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent. Requests go to the contact above, which also serves as our data protection contact for LGPD purposes.
Australia
You can request access to and correction of your personal information, and complain to the Office of the Australian Information Commissioner if you are unhappy with our answer.
Elsewhere
We apply the same rights and the 30-day response time unless your local law gives you more.
9. How to exercise a right
- In the app: Settings, then Delete account, removes your account and server data (profile and posts immediately, the rest within 30 days). Settings, then Export collection, gives you a CSV of your collection.
- On the site: use the contact form and choose Privacy request, or email support@getslabx.com.
- By email: unsubscribe links in every news email work with one click, no sign-in needed.
We verify that a request comes from the address on the account or list before acting, usually by replying to it. An authorized agent may act for you with written permission. There is no charge unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline and explain why.
10. Cookies, analytics, and privacy signals
getslabx.com sets one strictly necessary item: a record of your analytics choice in your browser's local storage. Google Analytics runs only after you choose “Yes, allow analytics” in the banner; until then it is denied through Google's consent mode, and advertising features are permanently off. Separately, our host Vercel counts page views without cookies or stored identifiers (page, referrer, country, device type only), which cannot identify or follow you and so runs without asking. If your browser sends a Global Privacy Control signal or Do Not Track, we treat that as a decline. Change your answer any time with Privacy choices in the footer. Signed-in admin sessions use an authentication cookie. The SlabX app itself contains no analytics or advertising SDKs. The Reddit advertising pixel loads under that same choice and never before it: if you decline, or a Global Privacy Control or Do Not Track signal is on, it is never loaded. When it does run it tells Reddit that a visit, sign-up, or purchase happened so we can measure our ads. It is never loaded on the member or admin screens.
11. Children
SlabX is not directed to children. You must be at least 13 to create an account, and in the European Economic Area and the United Kingdom at least 16, or the age your country has set for consenting to online services if it is lower. We do not knowingly collect personal information from anyone under those ages; if we learn that we have, we delete it. Parents can track a child's collection inside their own app.
12. Security
Data in transit is encrypted with TLS. Server data is stored with providers that encrypt at rest, and every table is protected by row-level access rules so that only you, or a signed-in administrator on an allow list, can read your records. Administrator actions are logged. Passwords are stored hashed, never in plain text. Public forms are rate limited. Report a security concern to support@getslabx.com; details are on the security page and in security.txt. No system is perfectly secure, so please use a strong, unique password.
13. International transfers
SlabX operates from the United States, so if you are outside it your data is transferred here and to the processors in section 6. For transfers out of the EEA, UK, and Switzerland we rely on the EU-US Data Privacy Framework (with its UK and Swiss extensions) where the provider is certified, and on standard contractual clauses otherwise. Ask us for a copy of the clauses.
14. Changes
When this policy changes we update the date and version at the top. For material changes we also show a notice in the app and email everyone on the news list before the change takes effect. Earlier versions are available on request.
15. Contact
SlabX, Las Vegas, Nevada, United States. Email support@getslabx.com.