Privacy Policy

Last updated August 22, 2026

ShowCase Cards LLC ("ShowCase", "we", "us" or "our") provides software for pricing, cataloging and trading collectible cards. This Privacy Policy describes the personal information we collect, why we collect it, who we disclose it to, and the choices available to you.

It applies to our website at showcasehq.io, the web application at app.showcasehq.io, our iOS and Android applications when released, and communications between you and us (collectively, the "Services").

It does not apply to third-party websites, applications or services, including those we link to. Those are governed by their own privacy policies.

Summary

The following is a summary provided for convenience. The sections that follow govern in the event of any inconsistency.

We do not sell your personal information, and we do not display advertising.
Card images are transmitted to a third-party AI provider for identification. We do not retain them unless you enable scanner training in Settings, which is disabled by default.
Analytics are not loaded until you consent to them. If you decline, nothing is collected.
Your collections and wishlists are private unless you choose to make a collection public. Wishlists are never public.
You may delete your account at any time from Settings, on the web or in the application.
We never receive your payment card number. Payments are processed on Stripe's own checkout page.

How we collect personal information

We collect personal information in three ways.

Directly from you. When you create an account, scan a card, catalog items you own, record a transaction, configure a storefront, purchase a plan, join our waitlist, or contact us.
Automatically, as you use the Services. Our servers log requests, and where you have consented to analytics, we record how the Services are used. See our Cookie Policy for details.
From third parties. Google provides your account details when you sign in with Google. Stripe provides the status of your subscription.

Personal information we collect

Account information. Your email address, a password (stored only as an irreversible cryptographic hash), and a display name if you provide one. If you sign in with Google, we receive the account identifier Google assigns to you, your email address, whether Google has verified that address, and the name on the account. We do not receive your Google contacts, photographs or any other Google data.
Catalog information. The cards, sealed products and wishlist entries you add, their condition and grade, the amounts you record paying, and any vendor inventory you maintain.
Card images. Photographs captured using the scanner. See How card scanning works below.
Transaction records. Purchases, sales and trades entered through the vendor tools, the amounts involved, and receipts you claim.
Vendor profile information. Your business name, storefront description and storefront address if you operate one, together with any payment handle you save so that a payment link can be generated at the time of sale. Payment handles are not displayed on your public storefront.
Payment and subscription information. Your plan, its status, and your billing history. Payment card details are entered on Stripe's checkout page and are never transmitted to or stored on our servers.
Technical information. IP address, browser or device type, operating system, application version, and timestamps. Our analytics provider derives an approximate location (city and region) from your IP address. We do not request location permission and do not collect precise device location.
Usage analytics, where you have consented. Screens viewed, features used, application lifecycle events, and session recordings. None of this is collected before you consent.

We do not collect your date of birth, telephone number, mailing address, government identifiers, biometric information, health information, or information about your employment or education.

How we use personal information

To operate your account and authenticate you.
To identify and price the cards you scan.
To store your collections, wishlists, inventory and recorded transactions.
To process payment for a subscription and administer it.
To send transactional email, including verification, password resets and billing notices.
To send product updates and waitlist invitations, until you unsubscribe.
To detect and resolve errors, and to maintain the security and availability of the Services.
To understand how features are used, where you have consented to analytics.
To improve the scanner, where you have enabled scanner training.
To comply with legal obligations and respond to lawful requests.

How card scanning works

When you scan a card, the image is transmitted to our servers. Part of the identification process runs on our own infrastructure, including image correction, text recognition and matching against our catalog. One stage transmits the image to a third-party AI provider (Google or OpenAI), which reads the card's name, text and artwork and returns the result.

We do not retain the image after processing unless you enable scanner training in Settings. That setting is disabled by default. Where it is enabled, we retain the image and the identification result in order to improve the accuracy of the scanner.

Card images are never displayed to other users, and we do not use them to identify you. If you delete your account, retained scans are disassociated from your account instead of being deleted. What remains is a photograph of a card that is no longer linked to any user. If you wish to have them deleted before that point, disable the setting and contact us.

You can use the Services without scanning. Searching the catalog by card name, set or number captures no image and transmits nothing.

How we disclose personal information

We do not sell your personal information and we do not disclose it for advertising purposes. We engage the following service providers to operate the Services, each of which receives only the information necessary for its function.

Stripe. Payment and subscription processing.
Google. Sign in with Google, and card identification via its Gemini models.
OpenAI. Card identification, on the alternate processing path.
Resend. Email delivery.
Railway. Application hosting and database services.
Cloudflare. Website delivery and image storage.
Sentry. Error reporting, configured to exclude personal information.
PostHog. Product analytics and session recording, loaded only where you have consented.

We otherwise disclose personal information only in the following circumstances.

Where required by law. To comply with a subpoena, warrant, court order or other valid legal process, to enforce our terms, to investigate fraud, or to protect the safety of our users or the public.
In connection with a business transfer. In a merger, acquisition, financing or sale of assets, user information may be among the assets transferred. This Privacy Policy continues to apply until the acquiring party provides notice of any change.
Aggregated or de-identified information. Information that no longer identifies any individual, which we use to understand and improve the Services.

Information you make public

Your collections, wishlists, recorded transactions and inventory are private by default. Wishlists cannot be made public.

Two categories of information may be published at your election. A collection you mark public appears on your profile and in Discover, together with your display name. A vendor storefront is a public page listing the inventory you offer for sale, under your business name and storefront address. Both are removed if you disable them or delete your account.

Information you publish is accessible to anyone with the link, including users who are not signed in. You should treat it as public.

Links to third-party sites

Certain pages link to card listings on third-party sites. Where those are affiliate links, we may receive a commission if you make a purchase, and the link carries parameters identifying ShowCase and the card the link relates to. Those parameters do not identify you. Once you reach the third-party site, that site's privacy policy governs your visit.

Cookies and similar technologies

We use browser and device storage to keep you signed in, to record your response to the analytics prompt, and, where you have consented, to operate analytics. A full description, together with instructions for changing your choice, appears in our Cookie Policy.

Retention

Account information. For as long as you maintain an account, and for up to one month after deletion, which is the period required for backups to cycle.
Financial and transaction records. For up to seven years, where required by tax and accounting law.
Scans retained for training. For as long as they remain useful for improving the scanner. Where you delete your account, they are first disassociated from it.
Waitlist email addresses. Until you are invited or request removal.
Analytics data. For the retention period configured with our analytics provider.

Your choices

Analytics. Decline at the prompt and nothing is loaded. If you consented and wish to withdraw that consent, a Product analytics setting is available under Privacy in Settings, and takes effect immediately.
Scanner training. A setting in Settings, disabled until you enable it.
Marketing email. Every marketing email contains an unsubscribe link. You cannot opt out of transactional email relating to your account while the account remains open.
Public collections and storefront. You may enable or disable these at any time.
Access, correction and deletion. You may request a copy of the personal information we hold about you, request that we correct it, or request that we delete it. We respond to such requests from all users, regardless of where you reside, within 45 days.

Deleting your account

You may delete your account from Settings, on the web or in the application. On deletion we cancel any paid subscription at the end of the period already paid for, and we delete your collections and their contents, your saved sign-in methods, your sessions, your follows, and your vendor profile, which removes your storefront.

Your user record is retained in de-identified form. Your email address, name and password are removed, and the account cannot be signed into again. The record is retained because transactions have two parties: a sale you took part in is the other party's business record as well as your own, and deleting your record outright would remove it from their books. Your side of those records is de-identified.

Children

The Services are intended for users aged 13 and over, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at privacy@showcasehq.io and we will delete it. Where a higher age of consent applies in your jurisdiction, that age applies instead.

Security

Passwords are stored as Argon2 hashes and are never held in readable form. Sign-in attempts are rate limited. Sessions can be revoked server-side. Card images are stored in a private bucket with no public URLs. Traffic is encrypted in transit. Our error reporting service is configured to exclude personal information.

No system is completely secure, and we do not represent otherwise. We recommend that you use a password unique to this service and contact us if you notice unusual activity on your account.

International transfers

We are established in the United States and our servers are located in the United States. Each service provider identified above processes data in the United States. If you access the Services from outside the United States, your personal information is transferred there, where privacy laws differ from those of your own jurisdiction and where local authorities may be able to obtain access to it. Where transfers from the EEA or the United Kingdom are covered by the European Commission's Standard Contractual Clauses, we rely on those clauses.

United States state privacy rights

Depending on your state of residence, you may have the right to know what personal information we hold about you, to obtain a copy of it, to correct it, to request its deletion, and not to be discriminated against for exercising those rights. We extend these rights to all users, regardless of residence.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable state law. The categories of personal information we collect, the purposes for which we collect them, the parties to whom we disclose them, and our retention periods are described above.

To exercise any of these rights, contact us at privacy@showcasehq.io or use our contact form. We may need to verify your identity before acting on a request. Where we are unable to comply with a request, we will inform you of the reason.

EU and UK rights

Where the GDPR applies to you, you additionally have the right to object to processing, to restrict processing, to withdraw consent at any time (which does not affect processing carried out before withdrawal), to data portability, and to lodge a complaint with your local supervisory authority.

We rely on the following legal bases: performance of our contract with you (operating your account, providing the Services, processing payment); your consent (analytics, scanner training and marketing email); our legitimate interests (security, fraud prevention, error resolution and understanding how the Services are used); and compliance with legal obligations (tax records and responses to lawful requests).

Changes to this Privacy Policy

We may update this Privacy Policy as the Services change. The date at the top of this page indicates when it was last revised. Where a change is material, you will be asked to accept the revised version the next time you use the Services.

Contact

Privacy enquiries and requests should be directed to privacy@showcasehq.io. For all other enquiries, contact support@showcasehq.io or use our contact form.

ShowCase Cards LLC
424 Veranda Rd NW, Unit 6861, Albuquerque, NM 87197