Privacy Policy

Cardspark helps collectors identify cards, organize collections and tracked cards, save searches, and explore card and market information through ChatGPT and other supported experiences. This policy explains what information Cardspark collects, how we use it, and the choices available to you.

This policy applies to Cardspark's website, connected applications, MCP services, and related account features (collectively, the “Service”). It does not govern ChatGPT or other third-party services, which operate under their own terms and privacy policies.

Information we collect

Information you provide

• Account information, such as your email address and authentication identifiers.
• Collection data, including cards, quantities, variants, conditions, grades, graders, tracked cards, saved searches, and display preferences.
• Information you submit when contacting us, joining a waitlist, or requesting support.
• Card descriptions, selections, and other information sent to Cardspark through a connected application.

Card images and identification

When you use card-image identification through ChatGPT, the image is handled by OpenAI under its own terms and privacy policy. Cardspark receives the structured card observations and selections needed to identify cards and perform the action you request. Cardspark's current Service does not intentionally retain the original image file.

Technical information

Our service providers and servers may process standard technical information such as IP address, request timestamps, device or browser information, authentication events, and diagnostic logs. We use this information to operate, secure, troubleshoot, and improve the Service.

How we use information

We use information to:

• Authenticate users and maintain accounts.
• Provide card lookup, collection, tracking, saved-search, and market-data features.
• Keep user data synchronized across supported Cardspark experiences.
• Respond to support requests and communicate about the Service.
• Protect the Service, prevent abuse, diagnose errors, and enforce our terms.
• Understand aggregate product usage and improve Cardspark without attempting to identify individuals from de-identified data.
• Comply with legal obligations.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use your collection or account data to train a general-purpose AI model.

Browser privacy signals and advertising

Some browsers transmit a “Do Not Track” signal. Because there is no consistent industry standard for interpreting that signal, Cardspark does not currently alter its practices in response to it. Cardspark does not sell personal information or share it for cross-context behavioral advertising, so a Do Not Track signal does not change our current processing.

Cardspark does not currently use third-party advertising pixels, cross-site behavioral tracking, or conversion-tracking tools on its website. We do not use your account, collection, tracker, or saved-search data to build an advertising profile. Cardspark may promote its own Service through channels that do not require us to disclose your personal information to an advertiser.

Browser privacy signals do not prevent processing that is necessary to provide and secure the Service, such as authentication events, fraud-prevention measures, and limited diagnostic or security logs. If Cardspark later engages in practices subject to a legally recognized opt-out preference signal, including Global Privacy Control, we will honor that signal as required and update this policy and our controls before enabling those practices.

How Cardspark works with ChatGPT

Cardspark is an independent application that can connect to ChatGPT. When you use Cardspark in ChatGPT, OpenAI may send Cardspark the portions of your request and account authorization needed to perform the action you selected. Cardspark returns requested card or collection information to ChatGPT, where it may appear in your conversation.

OpenAI controls how it processes your ChatGPT conversations. Disconnecting Cardspark from ChatGPT prevents future authorized access, but it does not automatically delete information already stored in your Cardspark account. You may separately request access to or deletion of your Cardspark data as described below.

Service providers and data sources

We rely on companies that help us operate Cardspark. They may process information only as needed to provide their services to us, subject to their own terms and our arrangements with them. Current providers include:

• OpenAI for the ChatGPT platform and connected-app requests.
• Supabase for authentication and database infrastructure.
• Railway for application hosting and operational infrastructure.
• Scrydex for card catalog and market information. Card lookup requests may include card descriptions or identifiers, but we do not intentionally send Scrydex your Cardspark account identity.

We may also disclose information if required by law, to protect the rights or safety of users or others, to investigate abuse, or as part of a merger, financing, acquisition, or sale of assets. If our provider list or practices materially change, we will update this policy.

Retention

We generally retain account, collection, tracker, and saved-search data while your account remains active so that the Service can provide the features you request. We may retain limited operational records for security, fraud prevention, support, and legal compliance.

When data is deleted, copies may remain temporarily in backups and logs until they are overwritten through normal rotation. We may retain de-identified or aggregated information that can no longer reasonably identify you.

Your choices and rights

You may ask us to provide a copy of your Cardspark account data, correct inaccurate account information, or delete your account and associated user data. Depending on where you live, you may have additional rights concerning access, deletion, correction, portability, restriction, or objection.

To make a privacy request, email privacy@cardspark.app. We may need to verify your identity before completing a request.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encrypted network connections, verified authentication, and access controls. No online service can guarantee absolute security.

Children

Cardspark is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Cardspark, please contact us so we can review and delete it where appropriate.

International processing

Cardspark and its providers may process information in the United States and other countries. Those countries may have data-protection laws different from those where you live.

Changes to this policy

We may update this policy as Cardspark develops. We will post the revised policy here, update the date above, and provide additional notice when required by law or when a change is materially important.

Contact

Questions or privacy requests can be sent to privacy@cardspark.app.

Cardspark LLC, Brooklyn, NY USA