Privacy policy

What we collect

Account. Your email address, the name and company you type, a hash of your password (never the password), when you verified your email, and the sessions you sign in from (browser and IP, so you can review and end them).

Billing. Stripe handles payment. We keep your Stripe customer and subscription ids, your plan and its status. We never see or store card numbers.

API usage. A hash and short prefix of each API key you make, and a count of calls per key, per endpoint, per day. We do not log the content of your requests beyond what the endpoint needs to answer.

eBay, only if you connect it. When you connect an eBay account we store your eBay username and user id, the read-only permissions you granted, and the token eBay issues us to read on your behalf. That token is encrypted before it is written and is only ever used to read your listings, orders and selling performance. We never list, edit, price, message or buy on your account. You can remove the connection on your dashboard at any time, and on eBay under Sign in and security › Third-party app access.

What we do with it

Run your account, answer your API calls, bill your plan, show you your own eBay listings next to the market data we publish, and email you about your account (verification codes, receipts, service notices). We do not sell personal data and we do not run advertising.

Who else touches it

Stripe (payments), Supabase (database hosting), Vercel (web hosting), eBay (only the connection you authorise), and our email provider for the messages above. Each sees only what its job needs.

Keeping and removing it

Account data stays while your account exists. Sessions expire after 30 days. One-time codes expire in 15 minutes. Email hello@cardmods.com from your account address and we will delete your account and everything tied to it, or just your eBay connection, usually within a few days.

Questions

Write to hello@cardmods.com. See also the terms of service.