Privacy Policy

Who we are

Cardexa is an independently operated service based in Ontario, Canada. Our Privacy Officer is responsible for privacy matters and for compliance with this policy, and their identity is available on request. Privacy and support contact: cardexatcg@gmail.com.

Information we collect

Account information (required). An email address and a username. If you sign in with email and password, we also require a password; accounts created with Sign in with Google have no Cardexa password unless you add one in Settings. Any password is stored by our authentication provider only in hashed form — we never see or store it in plain text.

Profile information (optional). A display name and an avatar image, if you choose to add them.

Sign in with Google (optional). If you sign in with or link a Google account, we receive your Google account’s email address, name, and profile photo from Google.

Collection data. The cards you add to your collection, with their quantities, and the cards you add to your wishlist — just which cards you saved and when.

Preferences. Display, theme, and notification settings.

Technical information. Like any website, requests to Cardexa carry standard technical data such as your IP address and browser type, which our service providers receive and log (see “Service providers” below). We use an authentication cookie to keep you signed in and your browser’s local storage to remember your theme.

Support messages. If you contact us, we receive your message and email address.

We do not collect your birth date, phone number, or payment information. We do not keep a history of your searches or browsing tied to your account, and we do not build advertising profiles. (Anonymous performance beacons do include the path of the page being measured — see Cookies and local storage.)

How we use your information

We use your email to create your account, verify your identity, send security messages (such as password resets and email-change confirmations), and respond to support requests. More broadly, we use the information above to:

• provide the service — your account, collection, and wishlist, synced across devices;
• keep the service secure — for example, a bot check (Cloudflare Turnstile) protects the sign-in and sign-up forms from automated abuse;
• measure site performance using anonymous, cookieless page-speed metrics (see Cookies and local storage below);
• comply with legal obligations.

We do not sell or rent personal information, we do not send marketing email, and we do not share your information with advertisers.

Cookies and local storage

This is the complete list of what Cardexa stores in your browser — no advertising cookies, no analytics cookies, no cross-site tracking:

• Supabase authentication cookies (names starting with sb-…-auth-token, sometimes split into numbered parts) — keep you securely signed in. Created when you sign in, removed when you sign out or your session ends. If you never sign in, Cardexa sets no cookies at all.
• theme (local storage) — remembers your appearance choice so pages don’t flash the wrong theme while loading. Stays until you clear your browser data or switch the theme back to System.

Two tools run without cookies or device identifiers. Vercel Speed Insights sends a small beacon with performance timings, the page path, and coarse technical context (device type, operating system, browser, country, and connection speed) so we can see how fast pages load; the beacon is cookieless and we cannot identify you from it. Cloudflare Turnstile, the bot check on the sign-in, sign-up, and password-reset request forms, analyses technical browser signals to tell people from bots and runs only on those forms.

Everything above is strictly necessary to provide the service, so there is nothing to opt in or out of and no cookie banner. If we ever add optional analytics or advertising technologies, we will ask for your consent first. You can clear or block cookies and site data in your browser settings at any time — removing the authentication cookies signs you out, and clearing local storage resets your theme.

Service providers and sharing

These providers process personal information on our behalf to run Cardexa:

• Supabase — database, authentication, and file storage; holds account, collection, and preference data.
• Vercel — website hosting; receives standard request logs, runs our scheduled account-deletion job, and collects the cookieless performance metrics described above.
• Cloudflare — the Turnstile bot check on sign-in, sign-up, and password-reset pages; processes technical browser signals to tell people from bots.
• Google — only if you choose Sign in with Google.
• Resend — sends account email such as sign-up confirmations, password resets, and email-change confirmations from no-reply@auth.cardexa.app; processes recipients’ email addresses and message metadata.
• Upstash — hosts our rate-limiting store; processes short-lived request counters keyed by IP address (for anonymous requests) or account ID (for signed-in requests). No other personal data is stored there.
• Card-image hosts (images.pokemontcg.io, images.scrydex.com) — most card artwork is served from our own storage, but some images and fallbacks load from these third-party servers, which then receive standard image-request data such as your IP address and browser type. Set logos are fetched by our server and resized before delivery, so those requests don’t reach the third party from your browser. No account data is shared with any image host.

Each provider receives only what it needs to supply its service. Beyond this list, we would disclose personal information only if required by law (for example, a court order) or where necessary to protect the safety and integrity of the service.

Where your data is stored

Our providers store and process data primarily in the United States. While your information is outside Canada, it is subject to the laws of the jurisdiction where it is held, and courts and authorities there may be able to compel access to it. We use established providers that commit to contractual and technical safeguards for the data they process.

A note on avatar images

Avatar images are stored in a public storage bucket and served from a direct URL, so anyone who has the link can view the image without signing in — treat your avatar as public. Before upload, your browser crops and re-encodes the image, and our server then decodes and re-encodes it once more before storing it, so only the picture itself is kept — hidden metadata such as camera details and GPS location is removed. Please don’t upload an image you wouldn’t want to be publicly visible.

How long we keep it, and deleting your account

We keep your information for as long as your account exists. You can delete your account yourself at any time in Settings → Danger Zone. Deletion is scheduled with a 30-day recovery window: to cancel, sign back in and choose Cancel Deletion in the same place before the deadline. After 30 days, an automated job permanently deletes your account, collection, wishlist, preferences, and uploaded files. Copies may persist briefly in provider backups and logs before being purged in their normal cycles: our hosting provider retains request logs only briefly, database backups are kept on a rolling daily cycle, and rate-limiting counters expire on their own within minutes to hours.

How we protect your information

Traffic to Cardexa is encrypted in transit (HTTPS). Passwords are stored only as cryptographic hashes. Every collection, wishlist, and preference record is protected by database row-level security, so it can be read or changed only by the signed-in account that owns it. Authentication endpoints are protected against automated abuse. No online service can promise perfect security, but if we learn of a breach affecting your personal information we will notify you as required by law.

Access, correction, and your choices

You can view and change most of your information directly in Settings: email address, username, display name, avatar, password, connected Google account, and notification preferences. Optional information can be withdrawn the same way — remove your avatar or display name, disconnect Google (after adding a password), turn notification toggles off, or delete individual collection and wishlist entries.

We don’t yet offer an automated data export. To request a copy of the personal information we hold about you, or to correct something you can’t change yourself, email cardexatcg@gmail.com. We may need to verify your identity, and we aim to respond within 30 days.

Age requirement

Cardexa accounts are for people aged 14 or older, and the service is not directed to children. Age is confirmed by self-declaration when you create an account — we do not independently verify it, and we do not knowingly collect personal information from anyone under 14. If you believe someone under 14 has created an account, contact us at cardexatcg@gmail.com and we will delete it.

Changes to this policy

We may update this policy as Cardexa evolves. The “Last updated” date above always identifies the current version. If we make a material change — for example, collecting a new category of information or adding a new kind of processing — we will announce it prominently on the site, and by email where appropriate, before it takes effect.

Questions and complaints

If you have a question, concern, or complaint about how your information is handled, contact our Privacy Officer at cardexatcg@gmail.com. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.