Privacy

The cards you enter, their condition, your submission plans and every verdict you have seen are stored in your own browser using local storage. Without Pro they stay there: they are not sent to a server and not visible to anybody else. With Pro, your box plan, your trades and your tracked submissions are also saved to your account, so they follow you between devices; the table at the bottom of this page says exactly what. The one other exception is yours to make: if you answer “Would you use this again?” under a verdict, that card's name and its verdict go with your answer.

The practical consequence, without Pro, is that clearing your browser data deletes your lists, and they will not follow you to another device. That is a real limitation and it is the trade made for not holding your data at all.

Your settings are kept the same way, in your browser and nowhere else. Among them, gradeornot:feedback remembers whether vibration and sound are switched on or off, and gradeornot:banner remembers whether you paused the moving cards, and gradeornot:use-again remembers when you last answered “Would you use this again?”, so you are not asked again for thirty days. The sounds, if you turn them on, are made by your browser at the moment they play: no sound file is downloaded, nothing is recorded, and the site has no access to your microphone. It tells your browser so with every page it sends, in a Permissions-Policy of microphone=(), which means no script on this site could open the microphone even if one tried.

The single card tool asks for nothing. No email, no signup, no login. That does not change.

Pro needs an account, because a subscription has to belong to somebody. Signing in takes an email address and nothing else: there is no password, and a sign in code is emailed each time. The account is held by Supabase, the database this site runs on, and the code is emailed through Resend. Signing in creates the account even if you never subscribe, and starting checkout also gives Stripe your email address. Either can be removed on request, as below.

While you are signed in, the site sets two cookies that hold your session. They are marked so that no script on the page can read them and no other site can use them to act on your behalf, and they exist only to keep you signed in. Signing out deletes them. Nobody who has not signed in gets any cookie at all.

Pro is sold by Stripe as the seller of record, so payment is handled entirely by Stripe under its own privacy policy (and Link's, if you use it). Your card details go to Stripe's own page and never reach this site. To set up the subscription, this site gives Stripe your email address and your account number here, so the two can be matched. What this site keeps about a subscription is your email address, its Stripe references, its status, which plan it is, when it renews, and whether it is set to cancel, so it can tell whether Pro is on.

Your account page can download your lists and your watchlist as one file you keep. For anything else the site holds about you, your subscription record and your alert settings, ask through the contact form. To have your account deleted, cancel Pro first from your account page, then ask through the contact form from the same address. The account and its subscription record are removed together; Stripe keeps its own record of past payments.

The site runs no analytics, sets no advertising cookies, and embeds no third party tracking pixels. Nothing follows you off the site. Nobody is told what cards you looked up.

The site also has no affiliate relationship with any grading company, which matters here because it removes any incentive to nudge you toward submitting.

Five things. An account and its subscription record, described above. The lists a Pro account saves: box plans, trades, tracked submissions, the watchlist and the alert settings. The contact form's messages and the answers to “Would you use this again?”, both below. And a cache of public market prices for cards, kept so the site does not have to buy the same price from a data provider repeatedly. A row holds a card identifier, a grading company, the prices at each grade and when they were fetched. It contains no information about you and is not linked to any person.

If you use the contact form, what you write, the email address you choose to give and your browser's name and version (so a reported problem can be reproduced) are stored so a reply is possible. Nothing else from your session is attached to it, and every message is deleted one hundred and eighty days after it arrives.

If you answer “Would you use this again?” under a verdict, your answer, anything you type in its box, the card's name, the verdict and the page you were on are stored so they can be read. There is no email, no account and no address with it, so it is not linked to you.

The limits that stop somebody running up the bill do not hold addresses. Counting requests needs something stable per caller; it does not need to know who the caller is. So an address is turned into a salted hash the moment it arrives, the salt is generated fresh every time the server starts, and what is counted is a number that cannot be turned back into an address or matched against one from anywhere else. It is held only in the server's memory, counted over a minute, never written down, and gone when the server restarts.

The site is hosted by Vercel, which means Vercel handles the requests your browser makes and keeps standard server logs, including IP addresses, for a limited period. The database holding the price cache, the contact messages, the feedback answers, Pro accounts and the lists a Pro account saves (box plans, trades, tracked submissions, the watchlist and alert settings) is run by Supabase. Payments are run by Stripe. Emails, the sign in codes, the confirmation when a plan starts and Pro alerts, are delivered by Resend, which receives your address and the email's contents. Card and price data comes from third party market data providers, which receive card identifiers rather than anything about you.

Card pictures load from the provider. A picture of a card comes straight from whichever data provider is configured rather than through this site, so that provider's server sees a request from your browser. It is sent no referrer, which means it is told which picture to serve and not which page you were on or what else you were looking at.

Merch photos and checkout are Printful's. The merch pages are read from our Printful store, and their photos load straight from Printful's photo server, sent no referrer, the same way card pictures are. Nothing is bought on this site: the button on a piece opens it on our Printful store, which takes the order, the payment and the address it ships to, under its own privacy policy.

These providers are infrastructure, not partners. None of the data providers are sent your lists; only Supabase stores them, and only for a Pro account.

Measuring centering happens in your browser. The image is read, the borders are found and the percentage is worked out on your own device. Nothing is uploaded and nothing is stored, including locally: only the resulting percentage is kept, and only until you close the page.

Photographing a card to identify it does send the photo. A photograph leaves your device only when you tap one of two camera buttons: photographing a card to identify it, or, with Pro, photographing a graded card's label to read its certificate. It is worth being exact about. The picture is shrunk in your browser first, then sent to the same card data provider that answers the search box, to answer one question: what card is this, or what does this label say. It comes back as a list of cards, or a certificate, for you to choose from. The photograph is not stored by this site, not attached to anything about you, and not kept after the answer comes back. What the provider does with it is their policy rather than ours.

The photo goes with nothing else. No address, no identifier, no session, nothing about what else you have looked at. The provider receives an image and this site's own key, so what reaches them is a photograph from this site rather than a photograph from you. That is not a policy promise, it is the shape of the request, and the request is one function in src/data/recognition.ts.

The whole list, in one place, so the claims above can be checked against it rather than taken on faith. Anything not on this list does not leave your device.

Without Pro, your collection, your submission plans, the trades you have built and your verdicts are never sent anywhere, apart from the one card and verdict you choose to answer “Would you use this again?” about. With Pro, the lists are saved to your account as the rows above say.

The site is not aimed at children. Checking a card asks for nothing about you. The only personal detail the site ever asks for is an email address, and only for two things: to sign in to Pro, or so a reply can reach you when you write in.

If you think a child has given the site an email address, write to support@gradeornot.app and the account or the message will be deleted.

If this policy changes, the date at the top changes with it. If something here is unclear or you want to know what the site holds about you, which is nothing unless you have signed in or written in, email support@gradeornot.app or use the contact form.