Privacy Policy

CardYield is a personal card and sealed wax tracker operated under the sandman.cards brand. When we say "we," "us," or "CardYield" below, we mean the site at sandman.cards. Questions? Email help@sandman.cards.

We keep the smallest amount of data we can while still running the product. Specifically:

• Account info: your email address, an optional display name, and a securely hashed password (we never see your plaintext password).
• Your collection: cards, sealed wax, breaks, and collections you add. Values you enter (purchase price, notes, etc.) belong to you.
• Pricing snapshots:when we fetch a market price from eBay or another source, we cache the result on your card so we don't re-query every page load.
• Photos you upload:images used for card scanning are sent to our image-recognition provider and to eBay's visual search API. We do not currently store the original photos on our servers. If we start storing them in the future, we will update this policy first.
• Server logs: standard web-request logs (IP address, timestamp, route) are retained for security and debugging. We do not sell or share these.

We do not use third-party analytics, ad networks, or behavioral tracking pixels.

Running CardYield relies on a small stack. Here's what leaves our servers and why:

• Supabase hosts our database and authentication. Your account record and everything you save lives there.
• Anthropic processes card photos for scanning and grade estimates. Photos are sent to their API and are not used for model training per their zero-retention terms.
• eBay receives search queries (card metadata or a photo) so we can look up market prices. eBay may log these requests per their own policy.
• Resend delivers transactional email (invites, password resets, newsletter opt-ins) on our behalf.
• Vercel hosts the application code and runs scheduled jobs.

You can export everything you've added at any time from the Settings page. The export is a single XLSX file with all your cards, wax, breaks, and collections. If you delete your account, we remove your records from our database within 30 days.

We use exactly one kind of cookie: the session cookie that keeps you logged in. It expires when you sign out or when the session lapses. No advertising cookies, no cross-site tracking.

CardYield is not directed to children under 13. If you believe a child has created an account, email help@sandman.cards and we'll remove it.

If we change how we handle data (for example, if we start storing your original scan photos), we'll update this page and note the effective date. Material changes will also trigger an email notice to registered users.

Questions, corrections, or data-deletion requests: email help@sandman.cards. We'll respond within 7 days.