1. Introduction
[Company Legal Name] ("CardDojo," "we," "us," or "our") operates the CardDojo website and related services (the "Service"), a marketplace and community platform for trading card collectors and vendors, including card inventory management, a peer-to-peer and vendor marketplace, and a nationwide calendar of in-person card shows.
This Privacy Policy explains what personal information we collect, how we use and share it, and the choices available to you. It applies to everyone who visits or creates an account on CardDojo.
2. Information We Collect
Information you provide directly
- Account information: email address, display name, phone number (optional), and profile photo, collected when you create an account.
- Organization/vendor information: if you register as a vendor, we collect your organization's legal name, display name, and bio.
- Marketplace activity: card inventory listings, collection and wishlist entries, orders, messages to other users, reviews, and stolen-item reports you submit.
- Order and shipping details: a shipping address you provide when placing an order that requires shipping.
- Support communications: anything you send us through the support chat or by email.
Information collected automatically
- Usage and device data: IP address (stored only as a one-way cryptographic hash, never in raw form), browser user agent, and general activity timestamps (e.g., when you last used the Service).
- QR sticker scans: when a CardDojo authentication sticker is scanned, we log the scan (hashed IP, user agent, and coarse location) to help build a card's history and detect fraud. Scans are anonymous — we don't require you to be signed in to scan a sticker, and we don't attempt to identify who scanned it.
- Dynamic QR code scans: sellers can create QR codes that point at their CardDojo pages. When one is scanned we record the time, the approximate location our hosting provider derives from the connection (country, region, city), the kind of device (phone, tablet or desktop) with its operating system and browser family, the website address of the page the link was opened from if there was one, and any campaign tag included in the link. We do not store the IP address, the full browser user agent, or the full address of the referring page, and we do not link a scan to a CardDojo account. The seller who owns the code sees these totals; they cannot see who scanned.
- Cookies and similar technologies: see our Cookie Policy for full detail on what we store in your browser and why.
Information we do not collect
We do not collect government-issued ID numbers, Social Security numbers, or tax identification numbers. We do not store payment card numbers or bank account details — those are handled directly by our payment processor (see "How We Share Information" below), never by CardDojo's own systems.
3. How We Use Information
We use the information above to:
- create and maintain your account and authenticate you;
- operate the marketplace: display listings, process orders, coordinate pickups and shipping, and connect buyers with vendors;
- verify sellers who apply for vendor status;
- send transactional communications (order confirmations, payout notices, security alerts) and, if you opt in, marketing communications;
- investigate stolen-item reports and take safety/fraud-prevention action, including suspending accounts that violate our Terms of Service;
- maintain and improve the Service, including diagnosing technical issues; and
- comply with legal obligations.
We do not use your personal information to train third-party advertising or AI models, and we do not currently run any analytics or advertising trackers on the Service — see our Cookie Policy.
4. How We Share Information
We share personal information only in the following circumstances.
Service providers who process data on our behalf, each used only to provide their service to us:
| Provider | What they receive | Purpose |
|---|---|---|
| Supabase | Email address, authentication credentials | Sign-in, session management, account security |
| Resend | Email address, message content | Sending transactional and marketing emails |
| Cloudflare R2 | Uploaded images and files | Storing photos, avatars, and documents you upload |
| Google Cloud Translation | Card names and descriptions (not personal information) | Translating non-English card catalog text on request |
| PSA | A grading certificate number you search | Verifying a card's grading certificate |
Other users of the marketplace. Your vendor profile (if you are a vendor), public listings, and reviews are visible to other users by design — that's how a marketplace works. Buyers and sellers involved in the same order can see each other's necessary contact and shipping information to complete that transaction.
Payments (when enabled). Online payments are handled by a third-party, PCI-compliant payment processor. CardDojo does not and will not store your full card number.
Legal and safety. We may disclose information if required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of CardDojo, our users, or the public — including responding to stolen-property reports.
Business transfers. If CardDojo is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction; we'll notify you before your information becomes subject to a different privacy policy.
We do not sell your personal information, and we do not share it with advertisers or data brokers.
5. Cookies
See our Cookie Policy for the full list of cookies and local storage we use, and how to manage your preferences.
6. Data Retention
We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Cookie consent records are retained indefinitely as an audit trail of what you agreed to and when, but do not themselves identify you beyond an anonymous ID unless you are signed in.
Individual dynamic QR code scan records are deleted after approximately 400 days. Deleting a QR code deletes its scan history immediately and permanently.
7. Your Choices and Rights
- Access and correction: you can review and update most of your account information directly from your account settings.
- Deletion: you can request deletion of your account and associated personal information by contacting us at the address below. We may retain certain records where required by law (e.g., order history for tax purposes) or to protect against fraud.
- Marketing communications: you can opt out of marketing emails using the unsubscribe link in any such email.
- Cookies: you can change your cookie preferences at any time — see "Cookie preferences" in the site footer or our Cookie Policy.
8. Children's Privacy
CardDojo is intended for users age 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we've collected personal information from someone under 18, we will delete it.
9. Data Security
We use industry-standard technical and organizational measures to protect personal information, including encrypting data in transit, hashing sensitive identifiers such as IP addresses, and restricting internal access to what each system needs. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
10. International Users
CardDojo is operated from, and its infrastructure is located in, the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Effective" date at the top of this page and, where appropriate, provide additional notice.
12. Contact Us
Questions about this Privacy Policy or your personal information? Contact us at privacy@carddojo.app.