EFFECTIVE AUGUST 10, 2026

PRIVACY NOTICE

This page explains what information we collect, why we collect it, and the choices you have.

What we collect

If you create an optional account, we save your email address, a protected password record, active login sessions, short-lived password-reset records, the collection information you choose to sync, and a small saved-card price snapshot used to compare one dashboard visit with the next. We never store your plain-text password or the reset link itself. When paid membership opens, we will save Stripe customer and subscription identifiers, membership status, and billing-period dates. Stripe handles your payment details; Cardboard Capital does not store your full card number. If you join the newsletter, we save your email address and signup date. We also save whether you agreed to receive email and whether you later unsubscribed. If you contact us, we save the name you provide, your email, your topic, and your message so we can reply. Our system logs may record the time of a request and whether it worked. We do not ask public visitors for PSA certification numbers.

Simple site measurement

We count page views and basic site events to learn which pages are useful. We do not save your raw IP address in the analytics table. The site creates a random number in your browser and turns it into a one-day anonymous code on the server. We save the page path and, when available, the outside website that sent you to us. We do not save search terms or full referring page addresses. The tracker does not run when your browser sends a Do Not Track or Global Privacy Control signal.

How we use it

We use account information to sign you in, sync your collection between devices, show what changed in your saved cards since your previous dashboard visit, and determine whether your membership is active. We use newsletter information to manage subscriptions and send approved emails. We also use it to stop emails when you unsubscribe, answer messages you send, understand which pages are useful, and keep the site safe and working.

Service providers

Railway hosts the site and database. Card Ladder supplies market data. Beehiiv sends the newsletter. Resend sends transactional account and alert emails when enabled. Stripe will process membership payments and provide billing management. Each company has its own terms and privacy rules.

Your choices

Every newsletter will have an unsubscribe link. When you unsubscribe, we save the date so we know not to email you again. Signed-in members can download a copy of their account data or permanently delete their account from the account page. You can also use our contact form if you need help with your information.

Security

Customer passwords are protected using a slow password-hashing method. Login cookies are HTTP-only, secure in production, and expire automatically. Changing or resetting a password signs the account out on other devices. We do not show API keys, admin passwords, or PSA certification numbers on public pages. Admin tools require a separate login. No website can promise perfect security.

Questions about your privacy

If anything in this notice is unclear, or you want help with your information, please use our privacy contact form.