⚖️ Draft — pending legal review. This is a plain-language draft written to describe what ChaseTrackr actually does today. It has not been reviewed by qualified legal counsel and is not legal advice. Review and finalize before public launch. [TODO: set a real, monitored contact address before launch.]

Privacy Policy

Last updated: 2026-08-12 · Draft v1

ChaseTrackr is a price-intelligence and portfolio tracker for trading card games. This policy explains what we collect, why, and who we share it with. ChaseTrackr is not a marketplace — we do not process payments, and we do not collect payment-card or bank details.

Information we collect

Account data: the email address you register with, and your password (stored only as a salted argon2 hash — we never store your password in plain text) and whether your email is verified.
Data you create in the app: the portfolios, holdings (card, quantity, purchase price, condition), watchlists, and price alerts you choose to save.
Limited technical data: your IP address is used transiently for rate-limiting and abuse prevention. We do not use advertising or cross-site tracking cookies.

Cookies

After you sign in, we set a single httpOnly authentication cookie so your session stays logged in. It is used only to keep you signed in — not for advertising or tracking. We do not use third-party advertising cookies.

How we use your information

To create and secure your account and keep you signed in.
To store and show the portfolios, watchlists, and alerts you create.
To send transactional email you request or that is required for your account (email verification and password reset). We do not send marketing email at this time.

Service providers we share data with

We use a small number of providers to run the service, and share only what each needs:

Render — application hosting and the managed database that stores your account and app data.
Resend — sends our transactional email (verification and password-reset messages).

Card catalogue data and images come from public trading-card data sources; that content is not personal data about you. We do not sell your personal information.

Data retention & your choices

We keep your account and app data until you ask us to delete it. You can request access to, correction of, or deletion of your data by contacting us. Deleting your account removes your portfolios, watchlists, and alerts.

Security

Passwords are hashed with argon2 and never stored in plain text. Sessions use an httpOnly cookie to reduce exposure to cross-site scripting. No system is perfectly secure, but we aim to follow reasonable, current practices.

Children

ChaseTrackr is not directed to children under 13, and we do not knowingly collect their personal data.

Changes

We may update this policy as the product evolves; we will update the date above when we do.

Contact

Questions about this policy or your data: [TODO: real contact address before launch].