1. Introduction
Welcome to CardStrata ("we," "our," or "us"). Respecting your privacy and safeguarding your personal information is a core commitment of our platform. This Privacy Policy explains how CardStrata collects, uses, stores, and protects information when you access or use our website (cardstrata.com) and web application (cardstrata.app).
2. Information We Collect
We strictly limit data collection to information necessary to provide and maintain our collection tracking platform:
- Account Credentials: When creating an account, we store your email address and password hash (secured using Argon2 password hashing).
- Collection & Binder Records: Information you explicitly enter into the platform, including binder titles, custom tags, card variant ownership statuses, and target completion goals.
- App Preferences: Settings such as default game scope view, priority hierarchy preferences, and theme choices.
- Technical & Essential Diagnostics: System logs, API error tracebacks, and essential session authentication tokens (JWT) required to keep you signed in securely.
3. How We Use Your Information
Your data is used solely for the following purposes:
- Providing, operating, and maintaining the CardStrata collection engine and market pricing services.
- Calculating set completion stats, Living Dex progress, priority warning alerts, and portfolio market valuations.
- Sending essential account communications, such as password reset tokens or critical service notices.
- Diagnosing system performance issues and improving platform security.
4. Zero Sale of Personal Data
CardStrata does not sell, rent, trade, or monetize your personal information or collection data to third-party advertisers, data brokers, or marketing networks. Your collection details remain strictly private to your account.
5. Data Security & Storage
We employ industry-standard technical safeguards to protect your information:
- Argon2id password hashing to prevent unauthorized access.
- HTTPS encryption in transit across all endpoints.
- JWT access tokens paired with rotating SHA-256 hashed refresh tokens.
- Isolated database architecture managed with secure PostgreSQL storage.
6. Third-Party Integrations
CardStrata utilizes trusted infrastructure providers to deliver its services:
- Cloudflare: Static asset delivery, DNS security, and edge caching (Cloudflare Pages & R2 CDN).
- Scrydex API: TCG catalog information and market pricing data feeds.
- Tally: Form handling for beta access applications.
7. Your Rights & Data Choices
You have full ownership of your data on CardStrata. At any time, you may request access to, correction of, or complete deletion of your account and collection history by contacting us at support@cardstrata.com.
8. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us at:
Email: support@cardstrata.com
Web: https://cardstrata.com