Privacy Policy

This Privacy Policy applies to personal information that the operators of My Card Wizard ("My Card Wizard", "we", "us" or "our") process in connection with www.mycardwizard.com, the My Card Wizard web and desktop applications and related services (together, the "Service"). Capitalised terms that this policy does not define have the meanings given in the Terms of Service.

This policy does not apply to the practices of third parties, including the marketplaces and other services you connect to your account. Those third parties process personal information under their own privacy policies.

Questions, requests and complaints about this policy: support@mycardwizard.com.

We collect the following categories of information.

Account information. Your email address, and your name and profile picture if you provide them. Supabase Auth handles sign-in, and we do not receive or store your password. If you turn on two-factor authentication, we send each code to you by email and store only the fact that two-factor authentication is on. When you sign up, we also record the time zone your browser reports, which we use only to decide which email rules apply where you live.

Weekly card news sign-ups. If you sign up for the weekly card news on our site, we keep your email address, the page you signed up from, and when you signed up, confirmed and unsubscribed. We send nothing to that address except one confirmation email until you press the link in it.

Profile information. Your business name and postal address, if you provide them. Both are optional. If you list on eBay and have not chosen an eBay ship-from location, we send your postal address to eBay to create one. We do not use the postal address for any other purpose.

Profile answers. Where you sell and whether you use a scanner, if you answer those questions in Profile or in the quiz on our site before you sign up. We use these answers to choose which guides the Service shows you.

Quiz answers. If you take the quiz at /quiz, your answers stay in your browser until you create an account, and for 30 days at most. If you then create an account in that browser, we store with your account the result the quiz showed, the Plan your answers needed, how many cards you list each month, how you list them today, how cards reach your computer and, if you wrote it, your answer about your week. We use them to fill in your profile answers where you have not given them, to mark that Plan when you choose a Plan, to choose which guides the Service shows you, and to learn which sellers the quiz serves. We do not send quiz answers to any advertising service.

Card scans. The images of the fronts and backs of cards that you upload.

Card and pricing data. Data derived from your scans, including each card's name, year, set, finish, number and grading details, its estimated value, and the market data behind that estimate.

Workspace data. Your batches, card statuses, your edits to titles and prices, channel assignments, and the price a card sold for, if you record it.

Connected-account credentials. If you connect eBay, Shopify, WooCommerce, CardTrader, Mana Pool or Square, the tokens or API keys that service issues, which we encrypt at rest. If you connect Discord, the webhook address. We do not receive your password for any of these services.

Billing information. If you subscribe to a Plan, Stripe processes your payment. We store your Stripe customer and subscription identifiers and the status of your Plan. Your payment card number is sent to Stripe and does not reach our servers.

Feedback and support tickets. The content you send us, the page, the app version and the browser it came from, and, for a support ticket, every message in the thread and the email address to which replies are sent. An email you send to support@mycardwizard.com is stored as a support ticket in the same way.

Error reports. When a sign-in, a checkout, a card read, a page load or a similar operation fails for you, we record what failed, the page, the time and, if you are signed in, your account. We keep error reports for 30 days to diagnose and fix problems, and we delete them with your account.

How you found us. If you arrive through one of our campaign links or from another website and then create an account, we store the tags on that link and the page on which you arrived with your account. This information is recorded once, is not shared with third parties, and is deleted with your account.

How the site is used. When you open a page, your browser sends us the page address without its query string, a random visitor number (in a browser set to a European time zone, a new one for each page until you allow analytics) and, on the first page of a visit, the site and campaign tags that referred you. When you leave a page or hide its tab, we record how many seconds the page was on screen, how far down you scrolled, and the last section you reached. We also record certain actions: pressing a named button on our public pages, sending or using a sign-up code, answering each question of the quiz and seeing its result (which answers you picked, never the words you type), viewing and completing each sign-up screen, creating a batch, starting a checkout and completing a checkout. When you try to sign up or sign in, we record that you started, whether it worked and, if it did not, the reason in one word, such as that the check that you are a person was not completed. These events never record the email address you typed or the code we sent. In the app we record which card tools you use: a card search and the card you pick from it, the Shorten button, a finish key, printing or downloading the Pull Sheet, and the eBay buttons beside a price. These events record how many cards or results were involved, and never a card name. We also record the changes you make to the fronts and backs of a batch, before and after scanning. These events record only how many scans, cards, card backs and changes were involved, and never a card name or a file name. We also record the steps of listing a batch: opening the List cards window, each step you reach in it, the step you close it on, and for each channel how many cards listed and how many did not. These events record counts and the channel's name, and never a card name, a title, a price or a message from the channel. When you connect eBay, we record whether you started, finished, declined or could not complete the connection. If you are signed in, an event is linked to your account. We do not store an IP address or browser details with these events. A Global Privacy Control or Do Not Track signal turns this recording off. From 16 October 2026, we also use these events, including those recorded in the same browser before you created your account, to choose guides for you, as described in section 4.

Which version of a page you saw. We may show different visitors different versions of a public page, such as a different order of sections on the front page, to learn which version works best. If we do, your browser stores which version it was shown, so that it shows you the same version again, and tells our server which version a page showed. We do this only outside Europe, and not when your browser sends a Global Privacy Control or Do Not Track signal.

Your answer on the plan screen. If you answer the question at the bottom of the screen that asks you to choose a Plan, we store your answer with your account and review it.

Analytics collected by PostHog. Your browser also sends PostHog the events described above, the buttons and links you click, page load performance, and errors a page encounters. Outside Europe, and in Europe after you allow analytics, PostHog also records where on a page people click and scroll. When you are signed in and use the app (the pages under www.mycardwizard.com/app), PostHog also records what the page displayed while you used it, and it masks everything you type in that recording. It never records our public pages, or any page while you are signed out. If you are signed in, PostHog receives your account number, your email address and your Plan. Our server notifies PostHog when you use a scan, when your Plan changes and when you make a payment, with the Plan but not the amount. Our server sends none of these for an account whose browser has sent a Global Privacy Control or Do Not Track signal or that is set to a European time zone without allowing analytics. It also sends none for an account we place in the European Economic Area, the United Kingdom, Switzerland or Canada, unless you allowed analytics in a browser set to a European time zone. PostHog receives your IP address and browser details and uses them to estimate your country and device type. In a browser set to a European time zone, we ask once whether to allow analytics. Until you allow it, PostHog stores nothing on your device, records no screen and does not receive your account details. A Global Privacy Control or Do Not Track signal turns PostHog off.

Operational logs. Errors, request timing and integration status, which we use to operate the Service and diagnose failures.

We do not collect payment card numbers. Stripe collects them.

We do not use advertising pixels or cross-site tracking scripts. PostHog, described in sections 2 and 5, is our only analytics service, and your browser reaches it through our own address. The Cookie Policy lists everything the Service stores in your browser.

We do not buy personal information from third parties, and we do not collect personal information about other people's marketplace accounts.

Card scans should show cards only. You must not upload an image that shows a person, a personal document, an identity card or other sensitive information.

We use personal information for the following purposes:

To provide the Service: to identify and price your cards, show you your inventory, and create listings on a connected marketplace when you instruct us to.

To operate, secure, support and debug the Service, to prevent fraud and abuse, and to respond to you when you contact us.

To draft replies to your support messages, from 12 November 2026. When you open a support ticket, write on one, send the contact form or email support@mycardwizard.com, a model drafts a reply for us. One of us reads every draft, changes it if needed and decides whether to send it. Nothing is sent to you without a person.

To understand how the Service is used, including which pages people use and where they stop during sign-up, so that we can improve it.

To process payments and manage your subscription.

To send service communications: sign-up and sign-in codes, two-factor codes, receipts, the confirmation of a new Plan, trial and renewal reminders, one email during a trial with how to scan your first batch if you have not scanned a card, payment notices, security notices, an acknowledgement when you send us feedback, open a support ticket or email support@mycardwizard.com, and a note when we close it. These communications are necessary to operate your account, and you cannot opt out of them while you hold an account.

To send a weekly summary of your own account while you are on a trial or a paid Plan, in a week you scan, list or sell a card, or when cards you marked ready and recently scanned are not listed yet: how many cards you scanned, listed and sold, the total price of the cards you sold, how many cards are ready and not listed, and how many scans you have left. It carries no offer, and you may turn it off in Settings or with the link in the email.

To send product email: a welcome email, a one-time note if you sign up and do not pick a Plan, and at most one other email a week. That weekly email is our card news, which links to trading card news on other websites with a line from us about each story, our news about the Service, or, from 16 October 2026, a guide we choose for you as described below. Until 29 October 2026, we send product email only after you turn it on. From 29 October 2026, if you created your account on or after 14 October 2026 and live in the United States, we send it unless you turn it off. We treat you as living in the United States only when the country in your profile or the time zone your browser reported when you signed up is in the United States. We do not, when any of these is in the European Economic Area, the United Kingdom, Switzerland or Canada: the country in your profile, that time zone, or the country ending of your email address. Every other account gets product email only after you turn it on. Product email comes from news@mycardwizard.com or accounts@mycardwizard.com. We record when you turned it on and which version of the wording you agreed to. Each such email contains a one-click unsubscribe link and our postal address. Turning it off does not affect any other part of your account.

To choose guides for you, from 16 October 2026. We use your profile answers, the pages of our site you read, and how you use the Service, such as the games you scan, when you last scanned a card, the channels you have connected and whether you hold a Plan, to choose which of our published guides the Service shows you and, if you have turned on product email, which guides we email you. We use this information only to choose guides. We do not use it for advertising, and we do not sell or share it. You may object to this use as described in section 10.

To price sports cards, as described in section 8.

To improve how the Service identifies cards and chooses their finish, using the card records described in section 9.

To build our catalog of card photos, only if you turn Photo Rewards on, as described in section 7. Photo Rewards is off by default.

To comply with legal obligations, enforce the Terms of Service, and establish, exercise or defend legal claims.

Automated processing. The Service identifies cards and estimates prices automatically. This processing does not produce decisions with legal or similarly significant effects on you: no listing is created until a card is marked ready, you can change any identification or price, and no automated process changes what your account can access or what you are charged. From 16 October 2026, the Service also chooses guides for you automatically, as described above. That choice changes only which guides we show or email you, and it does not produce decisions with legal or similarly significant effects on you. From 12 November 2026, a model also drafts replies to support messages. A person reads and sends every reply, so a draft does not decide anything about you. We do not use personal information for targeted advertising on other websites or services.

We disclose personal information to the following third parties, for the purposes described.

Supabase. Hosts our database, the file storage for your scans, and our sign-in system. It holds almost all of the data in your account.

Railway. Hosts our application server.

Resend. Delivers our email, including sign-in codes, security notices and product email. It receives your email address and the content of the messages we send you, and tells us whether each one was delivered.

OpenRouter. Receives your card scans and the instructions for reading them. Our requests restrict routing to providers that do not use your data to train models. Those providers may keep a request for a limited time to prevent abuse, and temporary prompt caching may also occur. From 16 October 2026, OpenRouter also receives, under the same controls, a description of how you use the Service together with the titles and descriptions of our published guides, so that a model can help choose guides for you. That description does not contain your name, email address, IP address, card scans or any message you sent us. From 12 November 2026, OpenRouter also receives, under the same controls, the text of your support messages and of our earlier replies in the same conversation, so that a model can draft a reply for us. Before it is sent, we remove email addresses, links, account identifiers, IP addresses and long numbers such as phone and order numbers. It does not receive your account details or your card scans. Anything else you write in a message, such as your name, is sent as you wrote it.

Google. Reads your card scans with its Gemini model through OpenRouter and, from 16 October 2026, the description used to choose guides for you and, from 12 November 2026, the support messages described above, subject to the routing controls described above.

Google, directly. A backup route. We may manually switch card reading to Google's Gemini API without OpenRouter if OpenRouter is unavailable. The Service does not switch automatically.

Anthropic. A backup identification service. We may manually switch card reading to Anthropic's Claude model if OpenRouter is unavailable. The Service does not switch automatically. Anthropic's commercial API terms prohibit training on content submitted through its API.

eBay. Receives a card description, such as its name, year, set and number, when we search eBay's current listings to price a card, which today we do for sports cards. That search uses our own eBay credentials and contains no information about you. eBay also receives a listing when you choose to create one and, when you have not chosen an eBay ship-from location, the postal address on your profile. If you connect your eBay account, we act on your behalf using the tokens eBay issued.

Stripe. Processes payments and receives the billing details you enter.

PostHog. Our analytics service, described in section 2. Your browser sends data to it through our own address, www.mycardwizard.com/ingest, and our server forwards the events. PostHog stores the data in the United States.

Shopify, WooCommerce, CardTrader, Mana Pool and Square. If you connect one of these services, it receives the listings you choose to send.

Discord. If you connect a webhook, Discord receives the alert messages we post to it, such as a card that needs review or a card that has sold.

Cloudflare and Google. Cloudflare Email Routing forwards email sent to an address on mycardwizard.com to mailboxes hosted by Google. Both companies process the message and its sender.

Cloudflare Turnstile. The check that you are a person runs on the sign-in, sign-up and password reset forms and on the card news sign-up form. Your browser loads it from Cloudflare, which receives your IP address and browser details. It sets no cookie on our site.

YouTube. The walkthrough video on the front page uses YouTube's privacy-enhanced player. YouTube receives your IP address when the page loads, and stores nothing in your browser until you play the video.

Google, as a sign-in provider. If you sign in with Google, Google learns that you signed in to My Card Wizard and sends us your name, email address and profile picture.

tcgcsv.com. Publishes the TCGplayer catalog and daily market prices, which we download once a day into our own price table. We request whole price files and send no information about you or your cards.

thecardapi. A market-data provider. It is switched off today, and we may switch it on again. When it is on, it receives a card description, such as Charizard Obsidian Flames 125/197, and no information about you, your scans or your account.

RapidAPI. A second market-data provider, used in the same way. It is also switched off today, and when on it would receive the same card description and no information about you.

The Pokémon TCG API (pokemontcg.io). Receives a card name and collector number to confirm which set a card belongs to.

HaveIBeenPwned. When you choose a password, your browser hashes it and sends the first five characters of the hash to our server, which relays them to api.pwnedpasswords.com. That service returns a set of hashes, and your browser checks the set itself. Your password is not sent to HaveIBeenPwned. Supabase receives your password when you set it or sign in with it.

PSA (Collectors Universe). We do not send certificate numbers to PSA. The Service reads a graded card from your scan of its label, and to check a certificate number we link you to PSA's public page, which you visit yourself.

Card picture hosts. We store smaller copies of some catalog pictures in Supabase. Your browser loads other reference artwork directly from these hosts: images.pokemontcg.io, images.scrydex.com, tcgplayer-cdn.tcgplayer.com, assets.tcgdex.net, cards.scryfall.io, cards.lorcast.io, optcgapi.com and stock-photos.gletech.com. Listing pictures in the finish picker are loaded from i.ebayimg.com, thumbs.ebaystatic.com and galleryplus.ebayimg.com. The still image of the front-page video is loaded from i.ytimg.com, and a Google profile picture from lh3.googleusercontent.com. Each of these hosts receives your IP address and may receive a referrer, subject to your browser's settings and our referrer policy. We send them no other information, and none of them is an advertising or analytics service.

File exports for Whatnot, TCGplayer and Square. We send nothing to these services on your behalf. An export produces a file for you, and any upload of that file is made by you under that marketplace's terms.

Legal and business transfers. We may disclose personal information where required by law or legal process; to protect the rights, property or safety of users, the public or us; to enforce the Terms of Service; or in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, in which case the information may be transferred to the successor.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Card scans are stored at unguessable web addresses. We do not publish those addresses, but they are not protected by sign-in. Anyone who obtains an address can view the image.

The Service can also store scans privately. That setting is currently off, so no scan is stored privately. When it is on, the Service checks your account and any required two-factor proof before it issues a link to a private scan, and each link remains valid for up to one hour.

When you list a card online or export its photos, the marketplace or file retrieves the photos from addresses that do not require sign-in. For a privately stored scan, we create public copies of the photos you selected.

Each scan is stored at several sizes, from a small thumbnail to a high-resolution copy used for listings.

When you delete a card or your account, we delete our copies of its scans and listing photos. Marketplaces and other people may keep copies they have already downloaded, and cached copies may remain available for a period after deletion.

Your inventory is not public. Access to your cards, prices, edits and the rest of your workspace is restricted so that an account can read only its own data.

Photo Rewards is off unless you turn it on in Free scans. This section applies only to accounts that have turned it on. Turning it on does not change how your cards are identified or priced.

While Photo Rewards is on, a scan you have already made may be offered to our card photo catalog, but only where no catalog we use has a picture of that card or of the finish you selected. Only the first scan of a printing is offered, a scan of a card marked as an Error is never offered, and nothing more is uploaded.

We review each offered scan before accepting it. If we accept it, we credit scans to your account, and the picture becomes the catalog photo that other users see beside that card, labelled as a seller photo. We do not display your name, your account details or your prices with it.

We record when you turned the program on and which version of the wording you agreed to.

You may turn Photo Rewards off at any time in the same place. Any scan awaiting review is withdrawn when you do. An accepted picture remains in the catalog, as the Terms of Service describe, and we will remove it if you ask us to.

A scan must show the card only. We reject a scan that shows a person, a screen or an address.

A sports card is priced from eBay's current listings rather than from a market price, and the Service applies a discount because listing prices are generally higher than sale prices on completed transactions.

The discount depends only on the listing price. If you record the price a card sold for, we store it with your account. We do not combine sold prices from different accounts, and no other user can see your prices, cards, scans or identity. Recording a sold price is optional.

We keep your inventory, scans and workspace data until you delete them or your account, or until we delete an inactive account as the Terms of Service permit. Deleting a card deletes its record and its scans. Disconnecting a channel deletes the stored tokens or keys for it.

A photo waiting in the phone tray is deleted after 30 days if no batch has used it.

We keep the record of how many scans you have used until you delete your account, because your Plan is measured against it.

We keep the scores we give our guides for your account until you delete your account.

We keep a record of each email we send you: the address, the subject, the date, whether it was delivered, and the words of any reply a person on our team wrote to you. We use it so that we do not write to you twice and so that we answer you with the earlier messages in front of us. We keep it until you delete your account, or for two years if you have no account.

We delete a weekly card news sign-up that is not confirmed within 30 days of the confirmation email. We keep a confirmed sign-up until the person unsubscribes. After that we keep only the address and the fact that it unsubscribed, so that we do not email it again, unless the person asks us to delete it.

We keep operational logs for a short period, only as long as they are needed to diagnose problems.

We delete visit, sign-up and in-app events after 13 months, or when your account is deleted, whichever is earlier.

PostHog keeps events for one year and screen recordings for 30 days. Deleting your account does not automatically delete this data from PostHog. You may ask us to delete it.

Card records. When you confirm or correct a card's identification, choose its finish, mark it ready, or list it, we keep a record of that choice. The record holds the card's details, what our identification service read from the scan, the finish and identification we suggested, and the price you listed it at. It does not hold your name, email address, scans or batch names. It is linked to a random code, not to your account, and we delete the link between that code and your account when you delete your account. We keep the record after you delete the card or your account, and we use it in aggregated form to improve how the Service identifies and prices cards, as section 10 of the Terms of Service permits.

An accepted Photo Rewards picture remains in the catalog while it serves as that card's reference picture, including after the account that provided it is deleted. It is not linked to a name or an account, and we will remove it on request.

We keep feedback and support tickets, including email sent to support@mycardwizard.com, as a record of reported problems until you ask us to delete them. When you delete your account, we remove the account and email address from the tickets opened from it. A ticket sent from an email address other than the one on your account, or through the contact form while signed out, is not linked to your account and keeps that address; ask us and we will delete it.

We keep a drafted reply to a support message for 30 days and then delete it. A reply we send becomes part of the ticket.

Deleted data may remain in backups maintained by our service providers for a limited period until those backups are overwritten. We may also keep information for longer where required by law or to establish, exercise or defend legal claims.

Subject to verification of your identity and to the exceptions permitted by applicable law, we respond to the following requests from any user, wherever you live. We respond within the period required by applicable law.

Access and portability. You may request a copy of the personal information we hold about you. Send the request from the email address on your account.

Correction. You can edit your cards, prices and profile in the Service, and you may ask us to correct other personal information.

Deletion. You can delete a card in the Service, which deletes the card and its scans. You can delete your account from Security, which deletes your cards, batches, scans, saved settings and marketplace connections and then closes your sign-in. Account deletion cannot be undone. It does not end listings already live on a marketplace, which only that marketplace can end.

Connected accounts. You may disconnect any marketplace or store at any time, which deletes the stored tokens or keys.

Product email. You may stop product email using the unsubscribe link in any such email or in Settings. Service communications, including sign-in codes, two-factor codes and receipts, continue while you hold an account.

Guides chosen for you. You may object to our use of how you use the Service to choose guides by emailing support@mycardwizard.com from the address on your account. We will then stop choosing guides for you from it, in the Service and in email, and show you our standard guides. Turning product email off stops every email that carries a guide chosen for you.

Drafted support replies. You may ask us not to draft replies to your support messages with a model. Email support@mycardwizard.com from the address on your messages, and we will answer you by hand from then on.

Analytics. If your browser sends a Global Privacy Control or Do Not Track signal, the Service sends no analytics to us or to PostHog. In a browser set to a European time zone, you may allow or withdraw analytics at any time with the Privacy choices link at the foot of every page, or in Settings under General.

Photo Rewards. You may turn Photo Rewards off at any time in Free scans, which withdraws every scan awaiting review. We remove an accepted picture on request.

We may decline a request where the law permits, including where we cannot verify your identity, where the request is manifestly unfounded or excessive, or where we must keep the information to comply with a legal obligation. We will not discriminate against you for exercising any of these rights.

This section applies to residents of California and of other US states with comprehensive consumer privacy laws, including Colorado, Connecticut, Virginia, Texas, Oregon and Utah.

Categories of personal information. In the last 12 months we have collected the categories of personal information described in section 2: identifiers, such as your name, email address and account number; commercial information, such as your Plan and subscription records; internet or other electronic network activity, such as the page and usage events described in section 2; and the content you upload. We collect this information from you, from your browser, and from the services you connect. We use it for the purposes in section 4, and we disclose it for business purposes to the recipients in section 5.

Your rights. Depending on your state, you may have the right to know what personal information we collect and how we use and disclose it, to obtain a copy of it, to correct it, to have it deleted, and not to be discriminated against for exercising these rights. Residents of some states also have the right to opt out of targeted advertising, the sale of personal data and profiling with legal or similarly significant effects. We do not engage in any of those three activities.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not use or disclose sensitive personal information for any purpose other than providing the Service.

To make a request, email support@mycardwizard.com from the address on your account. You may use an authorised agent, and we may require the agent to provide proof of authorisation and may require you to verify your identity directly. If we decline your request, you may appeal by replying to our decision, and we will review the appeal and respond within the period required by law.

My Card Wizard is the controller of the personal information described in this policy. The services named in section 5 act as our processors, except the marketplaces and sign-in providers you choose to use, which are independent controllers of the information you send them.

Legal bases. We process personal information to perform our contract with you, which covers operating your account, storing, identifying and pricing your cards, creating the listings you instruct, and sending service communications. We rely on our legitimate interests to secure the Service, prevent fraud and abuse, fix faults, measure how the Service is used without storing anything on your device and, from 16 October 2026, choose which guides the Service shows you and, from 12 November 2026, draft replies to your support messages so that we can answer you sooner. Product email rests on your consent where the law where you live requires consent, and otherwise on our legitimate interest in telling account holders about trading cards and the Service. Either way, you may turn it off at any time in Settings or with the unsubscribe link. The weekly card news for a person without an account rests on the consent given by pressing the confirmation link. The guides we choose to email you rest on that consent too. Storing an analytics identifier on your device, recording your visits and linking them to your account rest on your consent, which you give with the analytics question. Photo Rewards also rests on your consent, which you may withdraw at any time. Withdrawing consent does not affect processing that took place before withdrawal. We also process personal information where needed to comply with a legal obligation.

Your rights. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. You also have the right to lodge a complaint with a supervisory authority. In the UK that is the Information Commissioner's Office.

We and the service providers named in section 5 operate mainly in the United States, and your personal information is processed there. The United States may have data protection laws that differ from those of your country. By using the Service from outside the United States, you understand that your information is transferred to and processed in the United States.

Where we transfer personal information from the UK or the EEA, the safeguards depend on the provider and the agreement that applies to it. Contact support@mycardwizard.com for information about the safeguards that apply to your data.

We use technical and organisational measures designed to protect personal information. The Service is served over HTTPS. Marketplace tokens are encrypted before they are stored. Database access is restricted so that an account can read only its own data, and changes to account data require authentication. Public forms have abuse controls, and payment and authentication webhooks verify the provider's signature.

You can turn on two-factor authentication and end all active sessions in Security settings. We recommend both if you connect a marketplace account.

No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. If we become aware of a security breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

The Service is intended for adults. You must be at least 18 years old to create an account.

We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, email support@mycardwizard.com, and we will delete the account and its data.

We may update this Privacy Policy from time to time, including when we add a service that receives personal information. If we make a material change, we will notify you by email or by a notice in the Service before the change takes effect. The date at the top of this page shows when this policy was last changed.

Questions about this policy, or requests about your personal information: support@mycardwizard.com. Send requests from the email address on your account so that we can verify them.