Privacy Policy

My Card Inventory ("we", "us") provides a service that reads your purchase emails to build an inventory of the sports cards you own. This policy explains what we collect, how we use it, and your choices.

1. Information we access and collect

• Account: your email address and authentication details, via Google Sign-In or email/password.
• Gmail data (read-only): with your explicit permission (gmail.readonly), we scan your messages to identify card purchase emails and extract structured purchase details (card, price, fees, date, seller/platform). We do not read messages unrelated to this purpose beyond what is required to identify purchases, and we never store or log full email bodies.
• Inventory data you create: cards, groups, notes, sale records, and settings.
• Usage/diagnostics: limited technical logs to operate and secure the service.

2. How we use it

We use your data solely to provide and improve the inventory features you asked for. Consistent with Google's Limited Use requirements, we do not sell your data, use it for advertising, or allow humans to read your email except where necessary for security, to comply with law, or with your explicit consent.

3. What we store

We store the minimum necessary: the structured purchase details we extract and an identifier of which messages were already processed (to avoid duplicates). We do not retain full email content. Access tokens are stored securely and used only to fetch your messages.

4. Sharing & subprocessors

We don't sell your data. We use trusted providers to run the service: Google (email access), Anthropic (AI parsing of email text), Supabase (database, auth, storage), and Vercel(hosting). Each processes data only to provide their function.

5. Security

Data is encrypted in transit and at rest. Each user's data is isolated with row-level security. Server-only keys never reach the browser. No system is perfectly secure, but we follow least-privilege practices and store as little as possible.

6. Your choices & rights

• Disconnect any inbox at any time to stop all future access.
• Request deletion of your account and associated data.
• Revoke our access from your Google Account security settings.
• Depending on where you live (e.g., California/CCPA, EU/GDPR), you may have additional access, deletion, and portability rights.

7. Data retention

We keep your inventory while your account is active. When you delete your account or data, we remove it from our systems within a reasonable period, subject to legal obligations.

8. Children

The service is not directed to children under 13 (or the applicable age in your region).

9. Changes & contact

We'll post changes here and update the date above. Questions or requests: privacy@mycardinventory.com.