Privacy Policy

Effective November 4, 2026 · CardGradingTracker · Questions: [email protected]

CardGradingTracker is a hosted tool card shops use to track grading submissions and consignment payouts. This page says, in plain language, what data the service holds, why, and what we never do with it.

Who holds what

There are two kinds of people in the system:

• Shop owners hold accounts with us. We store their name, email address, shop name and settings, plan, and sign-in records.
• Their customers (collectors) appear in a shop's records because the shop entered them. Those records hold the customer's name and email, the cards they submitted (titles, photos the shop uploads at intake, grades and certificate numbers when they come back), consignment items and sold prices, and payout statements.

There are no passwords in CardGradingTracker. Sign-in is by emailed link and 6-digit code; we store only cryptographic hashes of those tokens and codes, never the values themselves.

What the data is used for

• Running the service: showing each shop its own submissions, balances and payout runs, and showing each customer their own cards.
• Sending the emails the service runs on: sign-in links, stage updates, payout statements, and stall alerts to shop owners.
• Support and security: answering questions and keeping accounts separated and safe.

Email is delivered through Brevo and the service is hosted on Cloudflare. Those providers process data only to run the service.

What we never do

• We never sell personal data.
• We never use a shop's customer list to market to those customers. A shop's customers are the shop's, not ours.
• We never move money. Payouts are calculated and recorded in the system; shops pay their own customers themselves.
• We never ask for, or store, anyone's grading-company credentials.

Cookies

One essential session cookie keeps you signed in. A theme preference (dark or light) is stored so the site looks the way you left it. There are no advertising cookies.

Your choices

Shop owners: email [email protected] to export or delete your shop's data. Customers: your records belong to the shop's account — ask your shop, or email us and we will route the request to the shop and confirm the outcome. Verified deletion requests are completed within 30 days, except for records we are legally required to retain (such as basic transaction logs).

Security

Data travels over encrypted connections. Every shop's records are isolated from every other shop's, and customer access is limited to that customer's own submissions and statements.

Changes

If this policy changes in a way that affects how data is used, we will note the change here with a new effective date and email shop owners before it takes effect.