Privacy Policy

1. Information we collect

Account information

When you create an account through our authentication provider (Clerk), we receive your email address and, if you provide them, your name and profile picture. You also choose a public handle and may add a short bio and banner image.

Collection data

If you track cards in your portfolio, we store the card identifier, grade, quantity, price paid, acquisition date, purchase venue, and certification number you enter. We also store your wishlist selections and any notes you attach.

Social activity

When you post updates, like or comment on activity, or follow other collectors, we store those interactions so they appear in feeds and notifications.

Device information

We collect basic analytics through Vercel Web Analytics and Speed Insights, which record page views, performance metrics, and broad device categories. We also use PostHog for product analytics — tracking which features you use, funnel completion, and aggregated engagement so we can improve the product. PostHog is configured to capture exceptions for error monitoring and may record session replays of anonymized interactions (no password, email, or payment fields are captured). We do not use cookies for tracking or advertising. The only cookies on our site are strictly necessary authentication cookies set by Clerk and a first-party PostHog session cookie.

Push notification tokens

If you opt in to push notifications, we store the subscription endpoint, cryptographic keys, and platform name needed to deliver messages.

Camera (iOS app)

The card scanner uses your device camera to identify cards. Images are processed on your device and are not uploaded to our servers unless you explicitly confirm.

2. How we use your information

• Provide the service: display your portfolio, deliver your activity feed, send notifications you opted into.
• Generate card intelligence: card summaries and market analysis are produced by sending card metadata (name, set, price) to Google Gemini. No personal data is included in those requests.
• Improve the product: we use Vercel Analytics and PostHog to understand which pages are visited, how features are used, where users drop off in funnels, and how the site performs.
• Communicate with you: service emails, optional weekly digests, and product updates you can toggle off in Settings.

3. Who we share data with

We do not sell your data. We do not share it with advertising networks or data brokers. The third-party services that process data on our behalf are:

• Clerk— authentication and session management.
• Supabase— database hosting with row-level security.
• Vercel— hosting, analytics, and performance monitoring.
• Google Gemini— card-level AI summaries (receives card metadata only, never personal data).

4. Data retention

We keep your data for as long as your account is active. Holdings, wishlist items, and activity remain until you delete them individually or delete your entire account.

5. Your rights and choices

• Export your data. Settings → Data & Privacy → Export My Data downloads everything as JSON.
• Delete your account. Settings → Data & Privacy → Delete My Account permanently removes all your data from our systems.
• Manage notifications. Toggle price alerts, weekly digest, and product updates on or off at any time in Settings.
• Control visibility. Set your profile and activity to public, followers-only, or private.

6. Children's privacy

PopAlpha is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us and we will delete it.

7. Security

All data is transmitted over HTTPS. Database access is governed by row-level security policies that scope every query to the authenticated user. Authentication tokens are managed by Clerk and are never stored in plain text on our servers.

8. Changes to this policy

If we make material changes, we will update the date at the top of this page and, where practical, notify you in-app.

9. Contact

Questions or requests? Email us at contact@popalpha.app.