Privacy Policy

Effective September 24, 2026 · Last updated September 24, 2026

This policy explains how CardMint (“CardMint”, “we”, “us”) collects, uses, shares and protects information about you when you use the CardMint website at cardmint.co and its related services (the “Service”), and the choices and rights you have. If you have a question, contact us at privacy@cardmint.co.

1. Information we collect

Information you give us

• Account information: your username, email address and password. We store your password only as a salted, one-way hash, never in readable form. You may also add your first and last name, a phone number and a profile picture.
• Your cards: the photos you scan or upload (front and back) and the details of each card, including details our system identifies and any you add or correct, such as grades, notes, set hints and whether a card is public or private.
• Messages: what you send us through Questions & Feedback and our replies.
• Billing information: your plan, billing interval, scan-pack purchases, and the customer and subscription identifiers our payment processor, Stripe, gives us. Your card number, expiry date and security code go directly to Stripe and never reach our servers.
• eBay connection (only if you connect eBay): your eBay user ID and username, the access tokens eBay issues so CardMint can list for you (stored encrypted), the eBay shipping, payment and return policies you choose, the ZIP code you ship from, and the details of each listing you create (title, price, condition, eBay listing ID and status).
• Preferences: for example, whether you want your cards shown anonymously and whether you receive member emails.

Information collected automatically

• Page visits: the page you visited, the time, your browser's user-agent string (browser and device type), your account ID if you're signed in, and a one-way hash of your IP address, which we use to count unique visitors. We do not store your IP address itself in these records.
• Usage counts: how many scans and repricings you use each month, to apply your plan's limits.
• Server logs: our hosting provider automatically records technical information about requests, including IP addresses, for security, troubleshooting and abuse prevention.
• A sign-in cookie: see Cookies.

Information from other sources

• Stripe tells us whether a payment succeeded, the status of your subscription, and about refunds and chargebacks.
• eBay (if you connect it) tells us your eBay user ID and username and the status of your listings, such as whether a card sold.
• Card reference and price sources (such as eBay, PSA and public card databases) give us information about cards and their market prices, not about you.

2. How we use information

• To provide the Service: create and secure your account, store your collection, and show it to you and, for cards you make public, to others.
• To identify and value cards: we send card photos to an artificial intelligence provider to read and identify each card, and we look up market prices. This is automated, but it only describes cards. We do not use automated decision-making that has legal or similarly significant effects on you.
• To process payments for plans and scan packs, and to handle refunds and disputes.
• To list cards on eBay when you ask us to, and to keep those listings' status up to date.
• To communicate with you: account emails (such as email verification and password resets), replies to your messages, and occasional member announcements. You can opt out of announcements in your profile. Account and security emails will still be sent.
• To keep CardMint safe: prevent fraud, spam and abuse, enforce our rules (for example, suspending accounts), and protect our members and systems.
• To understand and improve CardMint: aggregate statistics about traffic and feature use.
• To comply with the law and keep required business and tax records.

We do not use your information for targeted advertising, and we do not use your card photos or messages to train artificial intelligence models.

3. How we share information

We do not sell your personal information. We share it only as described here.

Service providers

These companies process information on our behalf, only to provide their services to us:

eBay, when you choose to list

When you list a card, we send eBay the listing you approved (title, description, item specifics, price, condition and the card's photos) to publish under your eBay account. eBay's use of it is governed by eBay's own privacy notice. The buyer's details and payment stay with eBay and are not shared with us.

Other sharing

• Legal reasons: if required by law, subpoena or court order, or when we believe in good faith it is necessary to protect the rights, property or safety of CardMint, our members or others.
• Business transfers: if CardMint is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, and this policy will continue to protect it.
• With your consent or at your direction.

4. What other people can see

• Public cards: cards you mark public appear in the Community Collection with their photos, details and your username. You can show them as “Anonymous” instead in your profile or on each card.
• Reactions: reaction counts on public cards are visible to everyone.
• Private cards are visible only to you and to CardMint administrators, who may access accounts to provide support, investigate problems or enforce our rules.
• eBay listings are public on eBay under your eBay account.

5. Cookies and similar technologies

CardMint uses one cookie: a strictly necessary sign-in cookie named session that keeps you signed in for up to 7 days. It is marked HttpOnly (web page scripts can't read it) and, on our secure site, Secure. We also use your browser's session storage to remember scanner settings during a visit; it is cleared when you close the tab.

We do not use advertising cookies, cross-site tracking, or third-party analytics services. Because we don't track you across other websites or sell or share your information for advertising, browser “Do Not Track” and Global Privacy Control signals don't change how CardMint works. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing, which we already don't do.

6. How long we keep information

We keep information only as long as we need it for the purposes above:

• Account, cards and messages: for as long as your account is open. You can delete individual cards at any time, which deletes their photos. When your account is deleted, we delete or anonymize your personal information within 30 days, except as described below.
• Billing and transaction records: as long as required for tax, accounting and legal purposes, usually up to 7 years.
• eBay tokens: until you disconnect eBay, your account is deleted, eBay tells us your eBay account was closed, or the token expires, whichever comes first.
• Page-visit records: kept in the pseudonymized form described above for traffic statistics.
• Backups and logs are overwritten on a rolling schedule.

We may keep information longer where the law requires it, or to resolve disputes, prevent fraud and abuse (for example, to keep a banned account from returning), or enforce our agreements.

7. How we protect information

We use reasonable administrative, technical and physical safeguards, including encryption in transit (HTTPS), salted one-way password hashing, encryption of eBay access tokens at rest, limits on repeated sign-in attempts, and restricting administrative access to authorized staff. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as required by law.

8. Your rights and choices

Things you can do yourself

• View and update your account details and profile picture in My Profile.
• Make cards public or private, show your cards anonymously, and delete cards.
• Opt out of member announcement emails in your profile.
• Disconnect eBay at any time from Listed on eBay.
• Cancel your subscription from your profile.
• Delete your account from My Profile (Account). This deletes your cards, photos, messages and eBay connection and cancels any subscription straight away.

Requests you can make

Depending on where you live, you may have the right to:

• Know and access the personal information we hold about you, and receive a copy in a portable format;
• Correct inaccurate information;
• Delete your information and your account;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Opt out of the sale or sharing of personal information, targeted advertising, or profiling (we don't do any of these).

To make a request, email privacy@cardmint.co from the email address on your account, or message us through Questions & Feedback while signed in. We will verify your request by confirming it comes from your account's email address, and respond within 30 days (or within the time your local law requires, which we may extend where the law allows, telling you why). We won't discriminate against you or charge you more for exercising your rights.

Authorized agents: you may have someone make a request on your behalf. We'll ask for proof of their authority and may ask you to confirm your identity directly.

Appeals: if we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We'll respond within the time required by law. If you're not satisfied, you may contact your state attorney general.

9. Additional information for U.S. state residents

This section applies to residents of California and other U.S. states with comprehensive privacy laws. In the past 12 months we have collected the following categories of personal information, for the business purposes described in section 2, and disclosed them only to the service providers and recipients described in section 3:

We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only to provide the Service, so there is no need to limit its use. We do not disclose personal information to third parties for their own direct marketing (California “Shine the Light” law).

10. Additional information for the EEA, UK and Switzerland

CardMint is the controller of your personal information. We rely on these legal bases:

• Performance of a contract: to provide the Service you signed up for, including card identification, billing and eBay listing you request.
• Legitimate interests: security and abuse prevention, service improvement, aggregate statistics, staff notifications and member announcements. You may object at any time.
• Legal obligation: tax, accounting and responding to lawful requests.
• Consent: where we ask for it. You can withdraw it at any time.

You have the right to lodge a complaint with your local data protection authority.

11. International transfers

CardMint is based in the United States, and our service providers process information in the United States and other countries. Where the law requires, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for transfers of personal information from the EEA, UK or Switzerland.

12. Children

CardMint is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you are under 18, use CardMint only with the permission and supervision of a parent or guardian; purchases must be made by an adult. If you believe a child has given us personal information, contact us and we will delete it.

13. Third-party services

CardMint links to and works with services we don't control, including Stripe (payments) and eBay (listings and price information). Their own privacy policies govern how they handle your information, and we encourage you to read them.

14. Changes to this policy

We may update this policy from time to time. We'll change the “Last updated” date above, and if a change is material we'll tell you by email or with a notice on CardMint before it takes effect. Please review this policy periodically.

15. Contact us