Cookie Policy

My Card Wizard sets a single cookie, named cw_ebay_oauth_nonce, and only when you connect your eBay account. It holds a short random value. We put a matching value in the link that sends you to eBay, and we check that the two match when eBay sends you back. That is what proves the connection was started in this browser, and without it someone could trick you into connecting your eBay account to their My Card Wizard account.

The cookie is strictly necessary and carries no tracking. It is marked HttpOnly, so page scripts cannot read it. It is sent only to the eBay connection address, it expires within ten minutes, and it is deleted as soon as the connection finishes. Because it is strictly necessary for something you asked for, no consent banner is required.

Everything else the app keeps on your device is browser storage. Unlike a cookie, it is never sent to our server on its own. It stays in your browser until it is cleared.

One other check can set a cookie, and that cookie is not ours. When bot protection is on, the sign-in, sign-up and password reset forms load a check from Cloudflare Turnstile. The check runs in a frame on challenges.cloudflare.com, and Cloudflare can set a cookie on that domain to complete it. It sets no cookie on mycardwizard.com.

One analytics service, PostHog. Your browser loads it from our own address, and it sets no cookie. Section 3 lists what it keeps in your browser. In a browser set to a European time zone it keeps nothing.

No advertising. No advertising pixel, no conversion tracker, no remarketing tag, and no data broker.

Screen recording outside Europe only. PostHog records what a page showed while you used it, so we can see where the app confuses people. Everything you type is hidden in a recording. No heatmaps are made.

No cross-site tracking and no third-party tracking script. The walkthrough video on the front page uses YouTube's privacy-enhanced player, which stores nothing in your browser until you play it.

A Global Privacy Control or Do Not Track signal from your browser turns off both our own visit counting and PostHog. The app then sends no analytics events at all.

Your signed-in session (local storage, a key beginning sb- and ending -auth-token). Set by Supabase, our login provider. It is what keeps you signed in. Strictly necessary, and clearing it signs you out.

cw_2fa_proof, set only if you turn on two-factor authentication. It records that this browser already entered its emailed code, so you are not asked again on every page. It stops working when you sign out.

cardmatic:workspace, one key per account. Your working state for a batch: draft edits, titles, prices and selections, saved as you go so a refresh does not lose your work. Also synced to your account.

mcw:memo, several keys, one set per account. The answers the app fetched last, kept so a reload draws at once: how many cards your account holds, and the printings we looked up for each card you opened. It is cleared when you sign out.

mcw-memo, a database rather than a key. The same store, in IndexedDB, where the larger answers go: your account totals, the newest 200 cards, and the rows of the last twelve batches you opened. It is cleared when you sign out.

cardmatic:listing-defaults. Your eBay store category and the card defaults applied to a new batch.

cardmatic:listing-rules. Your title and description templates, pricing bands, best-offer thresholds and default listing quantity.

cardmatic:listing-profiles. Your saved batch profiles, each a named category, pricing rule, title template and name prefix.

cardmatic:whatnot-template, one key per account. The Whatnot export settings you chose.

cardmatic-buy-target-pct. Your preferred buy-offer percentage in the offer calculator.

cardmatic:prefs. Your General settings, and the two answers you gave last in List cards: which photos a listing carries, and the photo size.

cardmatic:nav-open. Whether the sidebar is expanded or collapsed.

ebay:auto-sale-sync (this tab only). Whether your Sold Sync switch is on, so List cards can offer Cross-List without asking eBay tools again.

cardmatic:phone-notice. Set only if you dismiss the Phone photos notice, so it stays dismissed on that device.

cardmatic:newsletter-optin. Set only if you tick the newsletter box while signing up, so the answer survives the emailed code. It is cleared as soon as your account records it, and it expires after an hour.

cardmatic:chunk-reload (session storage). A one-shot flag that recovers from a failed script load after a new version ships. It is removed as soon as the page loads.

cardmatic:return-to. Set only if you start signing up from our ScanStore page, or pick a paid plan before you have an account. It brings you back to that page, or opens checkout for that plan, once you are signed up. It is cleared as soon as it is used, and it expires after an hour.

cardmatic:acquisition. If you arrive through one of our own campaign links, or from another site, this remembers the tags on that visit and the page you landed on. It stays on your device and is attached to your account only if you sign up. If you never sign up it is never sent anywhere.

cardmatic:visitor. A random number that lets us count visits and see where people leave a page or stop during sign-up. It is sent to our own server with the name of each page you open, and never to anyone else. It holds nothing about you, and it is not set when your browser sends Global Privacy Control or Do Not Track.

Keys beginning ph_ (local storage and session storage). Set by PostHog outside Europe. A random number for this browser, the current visit and, once you sign in, your account number, so PostHog can link one visit's pages. They are not set in a browser set to a European time zone, or under Global Privacy Control or Do Not Track.

Signing out clears the session key. Clearing site data for www.mycardwizard.com in your browser settings removes everything listed above.

None of it is needed to read the marketing pages, the Changelog, or these legal pages. The signed-in app needs the session key, because that is what proves who you are.

Clearing browser storage while signed in signs you out and discards any workspace edits that have not yet synced.

Some steps happen on a page run by someone else, and that page follows its own policy rather than this one.

Paying for a plan takes you to Stripe Checkout. Connecting a marketplace takes you to eBay or Shopify to sign in and approve access. Those companies may set their own cookies on their own pages, which we do not control and cannot see.

The links on our recommended scanners page go to Amazon and carry our Amazon Associates tag, so Amazon can pay us a commission if you buy. The tag is in the link itself, we add nothing to your browser for it, and we learn nothing about what you looked at or bought.

If we add another cookie, or anything that tracks usage, we will update this page before it ships, say what it is and why, and add a consent step where one is required. The date at the top shows the current version.

Questions about anything on this page: support@mycardwizard.com.