The Hoard Privacy Policy

1. Information We Collect

The Hoard collects the following types of information:

• Account information (email, display name, profile photo)
• Collection data you input (card names, sets, purchase prices, condition, grades, and notes)
• Card photos you capture or select when using scanning and collection features
• Profile, binder, badge, and social information you choose to share
• When you report a collector: your account ID, the reported account ID, the reason and details you provide, the profile section being viewed, app platform and version, and a server-generated snapshot of the visible profile (plus the relevant page and visible cards for binder reports)
• Device identifiers, platform, app version, and push-notification tokens used for trials, compatibility, and notifications
• Usage information such as sessions, foreground activity, feature interactions, and cards or marketplace listings you open

2. Camera and Image Processing

When you use card scanning, the image is sent to Google Gemini AI to identify the card and relevant details. Images used only for an unsaved scan are not intentionally retained by us after processing. If you save a card with an original photo, that photo is stored with your collection in Firebase and may appear in your binder according to your sharing settings. We do not intentionally attach your name or email to images sent for AI processing.

3. How We Use Your Information

We use your information to:

• Provide and maintain our service
• Identify cards, maintain your collection, and provide estimated valuations
• Display profile or binder information according to your privacy choices
• Review user reports, investigate objectionable content or abusive behaviour, enforce our terms, and protect the community
• Operate trials, process subscription status, and manage your account
• Send notifications you enable and important service messages
• Personalise buying recommendations using your interactions with listings in the app
• Improve our services and user experience
• Comply with legal obligations

4. Data Storage and Security

Your account and collection data are hosted using Firebase. We use technical and organisational safeguards intended to protect that data, including:

• Data is encrypted in transit and at rest
• Access is controlled by authentication and your profile-sharing choices
• Firebase Security Rules and server-side access controls
• Security updates to the app and its supporting services

Moderation reports and their evidence snapshots are stored in a server-controlled collection that App users cannot read or write directly. Access is limited to authorised moderators through protected administrative tools. Reports are retained only as long as reasonably necessary to investigate, document and enforce safety decisions or meet legal obligations, then deleted or de-identified. If a reporter deletes their account, reports they submitted are deleted; where a reported account is deleted, necessary moderation evidence may be retained with account identifiers and image links removed.

No method of electronic storage or transmission is completely secure.

5. Data Sharing

We do not sell or rent your personal information. We disclose information only as needed to provide the service, including:

• When you choose to make profile, binder, badge, or rank information visible to others
• To the service providers described below
• With your consent or at your direction
• To comply with law, prevent fraud or abuse, and protect rights and safety

6. Your Rights

Depending on where you live, you may have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your account and personal data through the app's settings or Support
• Change your profile-sharing choices and notification permissions
• Object to or restrict certain processing where applicable

Some de-identified moderation evidence may be retained after account deletion where necessary for community safety, dispute handling, fraud prevention, or legal compliance.

7. Local Storage and Analytics

The app and website use local storage and similar technologies to:

• Maintain your session
• Remember preferences such as currency
• Maintain a device identifier used to administer the free trial
• Measure sessions and feature usage; Firebase Analytics is enabled on the web version

Browser privacy settings can limit local storage or analytics, but doing so may affect sign-in and saved preferences.

8. Third-Party Services

We use the following third-party services to operate The Hoard. We do not sell your personal data. The Buy feature may contain eBay affiliate links, as described below.

• Firebase (Google LLC): Processes account identifiers, collection data, card photos, moderation reports, device and push tokens, and usage events for authentication, cloud storage, notifications, server functions, and web analytics.
• Google Sign-In (Google LLC): If you choose Google Sign-In, Google receives your authentication request and shares your email address, display name, and profile photo with us to create your account.
• Sign in with Apple (Apple Inc.): If you choose Apple sign-in, Apple processes the authentication request and shares the account information you authorise, which may include a private relay email address.
• Google Gemini AI (Google LLC): When you use scanning, identification, grading, or buying-report features, card images, descriptions, and related prompts are sent to Google Gemini AI. We do not intentionally include your name or email in those requests.
• Trading-card data providers: Public card and market data is retrieved from services such as TCGPlayer and supported game databases. We do not send those providers your account details.
• eBay: The Buy feature retrieves listings from eBay. Links may include our affiliate campaign identifier, and we may earn a commission from a qualifying purchase. We record which listing titles signed-in users open or follow to personalise the Buy feed; we do not send eBay your Hoard account details. When you open eBay, eBay receives the normal device and network information associated with visiting its service.
• Country and exchange-rate services: The app requests an approximate country and current currency rates from public APIs. Those providers receive ordinary network information such as your IP address, but we do not send them your Hoard account details.
• Apple App Store (Apple Inc.) — iOS only: When you purchase a subscription on iOS, Apple processes your payment. We receive a transaction confirmation and subscription status from Apple; we do not receive your full payment card details.
• Google Play (Google LLC) — Android only: When you purchase a subscription on Android, Google Play processes your payment. We receive a purchase token, order information, and subscription status from Google; we do not receive your full payment card details.
• Stripe — Web only: When you purchase a subscription on the web, Stripe processes your payment. We receive a subscription status confirmation; Stripe handles all payment card data under its own PCI-compliant systems.

Each provider processes information under its own privacy policy.

9. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Visit our Support page for assistance.