Privacy Policy

1. Who We Are

Vaultset is a trading card collection and marketplace platform. We help collectors manage their inventory, track market values, and connect with other collectors. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

2. Information We Collect

We collect the following information when you use Vaultset:

• Account information — your email address, username, and password (stored securely and hashed).
• Collection data — card records you add to your inventory, including condition, grade, pricing, and personal notes.
• Usage data — basic session and authentication data required to keep you logged in.
• Subscription data — your billing status and a Stripe customer identifier if you upgrade to a paid plan. Your payment card details are handled by Stripe and are never stored by Vaultset (see Section 8).

Payments for paid subscriptions are processed by Stripe; we never see or store your full card details (see Section 8). We do not collect physical addresses or any data beyond what is necessary to operate the platform.

3. How We Use Your Information

Your information is used to:

• Create and maintain your account.
• Display your collection and listings to you and, where applicable, to other users.
• Provide core platform features such as inventory management and marketplace browsing.
• Communicate with you regarding your account if necessary.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Public Information

When you list a card for sale or trade, certain information becomes visible to other registered users — including the card details, condition, grade, and asking price. Your username is associated with your public listings. Cards you keep private (not listed for sale or trade) are visible only to you.

5. Cookies & Analytics

We use a small number of strictly necessary cookies to keep you signed in and to secure your session. These are set by Supabase, our authentication provider, and are required for the platform to function — you cannot log in without them.

To understand how the platform is used, we rely on privacy-friendly, cookieless analytics from Vercel (Web Analytics and Speed Insights). These tools measure aggregate traffic and performance without using cookies, without storing a persistent identifier, and without tracking you across other websites.

We do not use advertising, marketing, or cross-site tracking cookies. Because the only cookies we set are essential to providing the service you request, no cookie consent banner is required.

6. Data Storage & Security

Your data is stored securely using Supabase, a cloud database platform with row-level security enforced at the database level. Passwords are never stored in plain text. We take reasonable precautions to protect your information, but no system is completely immune to security risks.

7. Data Retention & Deletion

You may delete your account at any time through the Account Settings page. Upon deletion, your personal information and collection data are permanently removed. Some anonymized aggregate data (such as total card counts used in platform statistics) may be retained.

8. Third-Party Services

Vaultset uses the following third-party services to operate:

• Supabase — database and authentication.
• Stripe — payment processing for paid subscriptions and optional donations. When you subscribe or make a donation, your email address and a user identifier are shared with Stripe so it can process the payment and, for donations, credit your Supporter status. Your full payment card details are entered on Stripe's own secure checkout and are never seen or stored by Vaultset.
• Vercel — hosting, deployment, and privacy-friendly, cookieless analytics (see Section 5).
• Pokémon TCG API — card data and imagery. No personal information is shared with this service.

9. Contact

If you have questions or concerns about your privacy, please reach out through our contact page.