Privacy Policy

1. Who We Are

Vaultset is a trading card collection and marketplace platform. We help collectors manage their inventory, track market values, and connect with other collectors. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

Vaultset is operated by MIEtheRED Software & Web Solutions LLC, an Idaho limited liability company, which is the data controller responsible for the information described here. You can reach us in writing at:

2. Information We Collect

We collect the following information when you use Vaultset:

• Account information — your email address, username, and password (stored securely and hashed).
• Collection data — card records you add to your inventory, including condition, grade, pricing, and personal notes.
• Usage data — basic session and authentication data required to keep you logged in.
• Subscription data — your billing status and a Stripe customer identifier if you upgrade to a paid plan. Your payment card details are handled by Stripe and are never stored by Vaultset (see Section 9).
• Scan diagnostics — when you use scan-to-add, your card photo is matched on your own device: the app computes a numeric fingerprint from the image and sends only that fingerprint to our server. We record how that match performed (match distances, the number of frames captured, image size, and your browser's user-agent string) so we can find and fix scans that fail.
• Scan photos — only if you ask us to. The photo itself never leaves your device unless you tick "Help improve scanning" on the scan screen. If you do, the cropped image is stored in a private location for up to 12 months, used solely to measure and improve match accuracy, and is never shown to other collectors. Scanning works identically whether or not you opt in. The choice starts off for every scan unless you also tick "Remember this on this device", which keeps it on for future scans in that browser. A remembered choice is still shown to you, already ticked, on every scan, and unticking "Help improve scanning" forgets it straight away. We only ever remember a "yes" — declining is the default and is not stored. Clearing your browser's site data also clears it.A small number of these images are selected into a fixed accuracy test set, which we re-run whenever the matching code changes to make sure scanning has not got worse for anyone. Images in that test set are kept for as long as we use it, which may be longer than 12 months. They are labelled by the card they show, not by who scanned them, and you can still ask us to remove yours.
• Push notification data — if you enable browser or device notifications, we store the subscription endpoint and keys your browser issues so we can deliver them. This is a per-device identifier. Turning notifications off removes it.
• Images you upload — profile avatars, and any images attached to pack reveals or listings. These are shown to other users where you choose to make them visible.

Payments for paid subscriptions are processed by Stripe; we never see or store your full card details (see Section 9). We do not collect physical addresses, and we do not collect data beyond what is described in this section.

3. How We Use Your Information

Your information is used to:

• Create and maintain your account.
• Display your collection and listings to you and, where applicable, to other users.
• Provide core platform features such as inventory management and marketplace browsing.
• Communicate with you regarding your account if necessary.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

If you are in the European Economic Area or the United Kingdom, data protection law requires us to have a specific legal reason for each use. Ours are:

4. Public Information

When you list a card for sale or trade, certain information becomes visible to other registered users — including the card details, condition, grade, and asking price. Your username is associated with your public listings. Cards you keep private (not listed for sale or trade) are visible only to you.

5. Cookies & Analytics

We use a small number of strictly necessary cookies to keep you signed in and to secure your session. These are set by Supabase, our authentication provider, and are required for the platform to function — you cannot log in without them.

To understand how the platform is used, we rely on privacy-friendly, cookieless analytics from Vercel (Web Analytics and Speed Insights). These tools measure aggregate traffic and performance without using cookies, without storing a persistent identifier, and without tracking you across other websites.

We do not use advertising, marketing, or cross-site tracking cookies. Because the only cookies we set are essential to providing the service you request, no cookie consent banner is required.

6. Data Storage, Security & International Transfers

Your data is stored securely using Supabase, a cloud database platform with row-level security enforced at the database level. Passwords are never stored in plain text. We take reasonable precautions to protect your information, but no system is completely immune to security risks.

Where your data lives. MIEtheRED Software & Web Solutions LLC is based in the United States, and our infrastructure providers (Section 9) store and process data outside the European Economic Area and the United Kingdom, primarily in the United States. If you are in the EEA or UK, this means your information is transferred internationally when you use Vaultset.

For those transfers we rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum), which form part of the data processing terms we have in place with each provider. You can ask us for more detail about these safeguards using the contact details in Section 1.

7. Data Retention & Deletion

You may delete your account at any time through the Account Settings page. Upon deletion, your account, collection data, listings, and messages are removed, along with your profile picture and any scan photos you had shared. Some anonymized aggregate data (such as total card counts used in platform statistics) may be retained, as it is no longer linked to you.

Scan photos you chose to share (Section 2) are kept for up to 12 months from the scan and are then deleted automatically. If you would like them removed sooner, email us at privacy@vaultset.app and we will delete them.

How long we keep things. Where we do not state a fixed period, we keep information for as long as your account is open and delete it when you close it.

8. Your Rights

You can exercise all of these by emailing privacy@vaultset.app or writing to the address in Section 1. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

• Access — get a copy of the personal information we hold about you.
• Correction — have inaccurate information fixed. Most of it you can edit yourself in Account Settings.
• Deletion — delete your account yourself at any time from Account Settings, or ask us to do it.
• Portability — receive your collection data in a machine-readable format. You can also export it yourself from the inventory page.
• Restriction & objection — ask us to pause or stop a particular use of your information, including anything we do on the basis of legitimate interests.
• Withdraw consent — where we rely on consent (scan photos, push notifications), you can withdraw it at any time. Untick the scan sharing box, or turn notifications off. Withdrawing does not affect what we did before you withdrew.

If you are in the EEA or UK and think we have handled your information badly, you can complain to your local data protection authority — in the UK, the Information Commissioner's Office. We would rather hear from you first so we can put it right.

We do not use your information to make automated decisions that produce legal or similarly significant effects, and we do not profile you.

9. Third-Party Services

Vaultset uses the following third-party services to operate:

Services that handle your data:

• Supabase — database, authentication, and file storage (avatars, and scan photos where you have opted in).
• Stripe — payment processing for paid subscriptions and optional donations. When you subscribe or make a donation, your email address and a user identifier are shared with Stripe so it can process the payment and, for donations, credit your Supporter status. Your full payment card details are entered on Stripe's own secure checkout and are never seen or stored by Vaultset.
• Ko-fi — processes optional donations made through the Ko-fi button.
• Vercel — hosting, deployment, and privacy-friendly, cookieless analytics (see Section 5).

Card data sources. These supply card catalogues, imagery, and market pricing. No personal information is shared with them — we request card and price data, not anything about you:

• Pokémon TCG API — card data and imagery.
• JustTCG — market pricing and promo card data.
• TCGdex — supplemental card and set data.
• RapidAPI (cardmarket-api-tcg) — graded card pricing.
• TCGplayer — card images served from its content network.

We also use GitHub to host our code and run scheduled price-refresh jobs. It holds no user data.

10. Contact

If you have questions or concerns about your privacy, please reach out through our contact page, or write to privacy@vaultset.app or the postal address in Section 1. Requests to access or delete your data should go to the email or postal address, which reach us as written notice.

Reporting copyright infringement instead? See our Copyright & DMCA Policy.