Privacy

Without an account, we do not know who you are: your collection is stored by your browser on your device and is never sent to us. If you sign in — which is optional — we store your email address and your collection, and nothing else. There is no advertising and no third-party tracking of any kind in this app, signed in or not. We keep our own count of what the app is used for — which pages are opened, that a search was made, that a card was added or rated — against a random session id in a cookie, never against your name, your email, your address or your device. Clause 3 lists that cookie, and clause 4 sets out every field that count holds — nothing you typed is one of them.

That is a description of how the app is built today, not a promise about every version of it. Clause 9 says what happens when that changes.

Rating a card never needs an account. Signing in exists for one purpose: your collection is stored with your account so it survives a cleared browser and follows you between devices.

• Your email address — entered for a sign-in link, or provided by Google if you sign in with Google. It is used to sign you in and for nothing else: no mailing list, no marketing.
• Your collection, as one record attached to your account, in a database hosted for us by Supabase in the United States. It is readable only by your own sign-in; it is the same data clause 3 describes, held server-side so it can be synced.

We do not ask for your name, a password or a payment method. There are no passwords anywhere in this app.

This is the complete list — plus the sign-in cookies of clause 7 when you have an account.

• Your collection, in your browser’s local storage under the name slabscore.collection.v1. It holds the cards you added, what you paid, the grade you expect, and what a submission cost when you marked one as sent. It stays on your device. It is never transmitted to us or to anyone else.
• Your settings, in one cookie named slabscore.settings — your chosen grading company, your shipping costs in each direction, and your selling-fee rate. It lasts a year, is limited to this site, and is sent to our own server with each page request so that a page rendered on the server computes the same numbers you see in the browser. It contains no identifier, no name and nothing about you personally.
• A session id, in one cookie named slabscore.sid — a random string, set the first time a page reports that it was opened or the moment you arrive by scanning one of our QR codes, kept for a year and limited to this site. It is the only identifier in our own usage count (clause 1). It is not derived from anything about you, it is not shared with anyone, and clearing your cookies discards it. If you arrived by scanning one of our QR codes, a second cookie, slabscore.venue, remembers which code — a short label such as the name of a card show — for the same year.

• Card searches and price lookups go to our server, and our server asks a third-party card catalogue. The catalogue sees a request from us, not from you — it does not receive your address, your collection or anything that identifies you. What we send is the card being asked about.
• Card photographs load directly from the catalogue’s image host, the same way any image on any website loads. That host therefore receives your IP address and your browser’s user-agent string, and we do not control what it logs. This is the one place where a third party sees your browser rather than our server, and it is worth knowing rather than glossing over.
• Our own usage notes, the count clause 1 describes. They go to our server and to no one else. One note is one row, and a row holds six things: the random session id from the slabscore.sid cookie of clause 3; the address of the page it happened on, without the part after the ?; which of 11 things happened; the catalogue’s own id for a card, when the note is about one card; the venue code of clause 3; and a short detail such as which game, or how many cards were in a submission. The 11 are: that a page was opened; that a search was made; that a card was added to a collection; that a card was priced; that a card was rated; that a submission was planned, and that one was marked as sent; that one of our printed QR codes was scanned; that a sign-in link was requested; that a sign-in completed; that someone signed out; that our own server failed on a page, and which page it was.
• What a usage note never holds: your IP address, your browser’s user-agent string, your name, your email address or your account — the notes are the same whether you are signed in or not — the identifier our browser extension uses, and anything you typed. A search term travels in the part of the address after the ?, and that part is removed before the row is written. Nothing is recorded at all for a request whose browser names itself as a bot or a link previewer.

Once a usage note is written it is kept: the record is only ever added to, and nothing in the app deletes a note or expires one. It cannot be traced back to you, because the session id is the only identifier in it and it is not derived from anything about you.

The site is served by Vercel. Its standard request logs record the request, its timing and the requesting network address, and Vercel keeps them for a short rolling period for its own operations. Our own usage notes (clause 4) hold no personal data, and we keep them without a fixed limit.

No third-party analytics. No advertising or ad networks. No third-party scripts, tag managers, embedded widgets, social buttons or session recording. No fingerprinting. No mailing list. We do not sell, rent or share data — the only data we hold at all is the account data of clause 2 and the usage notes of clause 4, and neither is anybody else’s.

This is checkable rather than asserted: the app ships with three third-party pieces of code — the web framework and the two libraries that render the page — and none of them is a tracker.

We do count how the app is used, and clauses 1 and 4 say exactly what that count holds. It runs on our own server, against a random session id and nothing else, and no other company receives it.

Without an account: clear this site’s data in your browser. That removes your collection, your settings cookie and the session id, and nothing that identifies you remains anywhere, because there was never a copy of your collection on a server. The usage notes of clause 4 stay, carrying the old session id, which from then on belongs to nobody. We cannot recover a collection you delete, and we cannot move it to another device for you.

With an account: signing out removes the sign-in cookies from your browser; your collection stays stored with your account so it is there when you return.

There is no self-serve deletion control. Email admin@slabscore.io from the address on the account and we delete the account and its collection.

The three cookies described in clause 3 — your settings, the session id behind the usage notes, and the venue code if you arrived by scanning one of our QR codes — and, only when you sign in, the sign-in cookies that keep you signed in, which are readable by our server alone and are removed when you sign out. None of them is used to follow you between sites or to advertise. There are no third-party cookies on this site.

SlabScore is operated from the United States and shows no consent banner. The cookies it sets are functional (your settings and your sign-in), and the session id behind the usage notes of clause 4 is ours, not a third party’s. Clearing them in your browser is enough to remove them; nothing in them identifies you.

SlabScore is for people aged 13 and over. We do not knowingly collect personal data from anyone under 13. If you believe a child has created an account, email admin@slabscore.io and we remove it.

Accounts and cloud sync shipped, and this page was rewritten for them — clauses 2, 6 and 7 are that rewrite. Billing is still planned and does not exist: no payment method is asked for anywhere. When it ships, a payment record becomes personal data we hold, and that is a change to this page, not just to the app.

The commitment is the ordering: this page gets rewritten before that ships, not after. A privacy page describing an architecture the app no longer has is a false statement rather than an out-of-date one.

Dead Center Studios LLC is the company behind SlabScore and is responsible for this page.

Privacy questions, data requests and complaints: admin@slabscore.io.