Privacy Policy

This policy explains what personal information Oberdex (TODO: legal entity name (e.g. "Borza Labs LLC"), "we", "us") collects when you use oberdex.com, why we collect it, who it is shared with, and the choices you have. It applies to the website and the app. Our Terms of Service apply alongside it.

1. What we collect

Information you give us

• Account details: your email address, name, and profile picture URL (from Google if you sign in with Google), an optional display name, and your username.
• Your collection: the cards and sealed products you add, with quantities, condition, grading company and grade, purchase price, purchase source, notes, sale price, sale platform and fees, and when you bought or sold them.
• Lists and goals: binders, mastersets (including ones you build yourself and the cards you mark), the wishlist (including target prices and monthly budget), tracked sets, species and artists, sealed product watches, release reminders, and price alerts.
• Sealed product openings you log, and the badges and achievements you earn.
• Requests and feedback: your email if you request access, any invite code you redeem, and anything you type into the feedback form.
• Sharing choices: whether your binders have a share link, whether your profile is public, whether friends can see your collection, and friend connections.
• Friends, crews and trades: friend requests, the crews you start or join, trade offers you send or receive (the cards and any message), and ratings and comments you leave after a trade.
• Email invites: if you invite someone by email, their address. We send that one invite on your behalf and keep only a scrambled (hashed) form of the address, so the same person is not emailed twice. We do not email them for anything else.

Information collected as you use the app

• Activity history: a log of actions in your account (for example "added a card" or "created a binder"), shown to you in the Activity feed.
• Notifications: the in-app notifications we create for you (for example a friend request or a price alert). If you turn on phone or browser notifications, we store that device's push address.
• Usage counts: which days you used the app and which main sections are opened, and, while the app is open, that you are online, which section you are in and since when (kept only as your latest visit). The site owner can see who is online right now. We use this to see what is used; it is not used for advertising.
• Scan diagnostics: when you scan a card, we record how the match went (for example confidence and timing) and which card you chose, to improve scanning. Diagnostic records are kept for about 30 days.
• Technical data: like most servers, ours process your IP address and browser details to deliver pages and keep the service secure.

Card photos

Photos you take or upload for scanning are processed on servers we operate (card detection, image matching, text reading and a vision model that runs on our own hardware). Photos are not sent to third-party AI or image services and are not kept after the scan is processed.

If you choose to save your own photo as a card's picture, we keep a small copy of it to show you. Only you see it. It is deleted when you remove it or delete your account.

Payments

Paid plans are processed by Stripe. Stripe collects your payment card details directly; we never see or store your full card number. We keep your Stripe customer ID and your plan status.

2. How we use it

• To provide the service: sign you in, store your collection, value it, and show your portfolio, reports and tax summaries.
• To send emails you need: sign-in codes, access approvals, price-alert notices, and, unless you turn it off in Settings, a weekly digest.
• To send phone or browser notifications, if you turn them on.
• To run the social features you use: friends, crews, trade offers and email invites you send.
• To run paid plans: billing, receipts, and enforcing plan limits.
• To improve and secure the product: fixing bugs, tuning card recognition, preventing abuse.
• To meet legal obligations (for example tax records for payments).

Where the GDPR applies, our legal bases are performing our contract with you (running your account), our legitimate interests (security, improving the product), your consent (optional emails where required), and legal obligation.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not show ads.

3. Who we share it with

Only the service providers needed to run Oberdex, and only what each needs:

Price and catalog providers (such as PokéWallet, Pokémon Price Tracker, TCGdex, TCGCSV and eBay links) are queried by our servers using card identifiers only. They do not receive your personal information. When you click an outbound link to TCGplayer or eBay, that site's own privacy policy applies.

Other people. You control what others see. By default your collection is private. If you create a binder share link, anyone with the link can see that binder (and its values only if you enabled that). If you set friend visibility to "binders" or "all", your friends can see what that setting describes.

Your username and display name can be seen by other users, for example on your profile page at /u/your-username, in friend requests and in trades. Your stats and shared binders appear on that page only if you turn on "Public profile". Members of a crew see which of the crew's masterset cards each member owns, never prices or quantities. People you trade with see the offer, and ratings and comments left after a trade show on the rated person's profile.

We may also disclose information if required by law, to protect rights and safety, or in a merger or sale of the business (with notice to you).

4. Cookies and local storage

We use cookies that are strictly necessary: they keep you signed in and complete the sign-in flow (including a cookie that holds your invite code for ten minutes while you sign up). We also use your browser's local storage to remember preferences such as theme, view mode and dismissed tips. We do not use advertising or third-party analytics cookies, and we do not load third-party tracking scripts. Because of this, we do not show a cookie consent banner.

5. How long we keep it

• Your account and collection data: until you delete your account.
• Scan diagnostics: about 30 days.
• Email addresses you invite: kept only in hashed form, until you delete your account.
• A record of which version of the Terms and this policy you accepted, and when: for as long as you have an account.
• Payment records: as long as tax and accounting law requires (kept by Stripe and by us).
• Backups may retain deleted data for a short period before they are overwritten.

6. Your choices and rights

• Access and export: you can export your collection from within the app. Email us for a copy of other data we hold about you.
• Notifications: turn phone or browser notifications off in Settings; signing out also turns them off on that device.
• Correction: edit your details and collection in the app.
• Deletion: use "Delete account" in Settings to remove your collection data and profile. Some records (for example your sign-in identity and payment records) are not removed by that button; email us and we will complete deletion within 30 days, except where the law requires us to keep something.
• Emails: turn off the weekly digest in Settings, or use the unsubscribe link. We will still send essential account emails like sign-in codes.
• Sharing: turn off binder share links, turn off your public profile, set friend visibility to private, or leave a crew at any time.

If you are in the EU, UK or a similar region, you also have the right to object to or restrict processing, to data portability, and to complain to your data-protection authority. If you are a California (or other US state) resident, you have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. To use any right, email [email protected]. We may need to verify it is you before acting.

7. International transfers

Oberdex is operated from the United States. If you use it from elsewhere, your information is transferred to and processed in the United States, and by the providers above in their locations. Where required, we rely on appropriate safeguards such as standard contractual clauses.

8. Security

We use access controls, encrypted connections and per-user data separation. No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as the law requires.

9. Children

Oberdex is not for children under 13 (or under 16 in the EU/UK). We do not knowingly collect their information. If you believe a child has given us personal information, email us and we will delete it.

10. Changes

We may update this policy. For significant changes we will notify you in the app or by email before they take effect. The date at the top shows the latest version.

11. Contact

TODO: legal entity name (e.g. "Borza Labs LLC")
TODO: mailing address
Privacy requests: [email protected]
Everything else: [email protected]