Privacy

When you make an account: your email address and a password, which is encrypted by our database provider and never visible to anyone, including me.

When you use the app: your username, display name and bio, the cards you mark as owned with their quantity and printing, your chase list, a daily snapshot of what your collection is worth, who you follow, the groups you join and the events you say you are going to.

If you message another collector, the messages are stored so you can both read the thread. Only the two of you can see them, although I can reach them as the site administrator if I need to look into a report of abuse. You can switch messages off entirely in your profile.

There is no analytics, no advertising and no tracking of what you look at. Nothing is sold or shared with anyone for marketing.

Your collection is private by default. Nobody sees it unless you switch on public sharing in your profile, and even then you choose which parts show: value, sets, top cards, chase list and history are separate switches.

Groups you join, events you say you are going to, and anything you post as a shop organiser are public by design.

I can see everything, including private profiles, because I administer the site. I will only look when I need to, for example to fix a problem you have reported or to deal with abuse. Moderators can manage shops and events but cannot see your email address or a private collection.

A cookie keeps you signed in. That is the only cookie, and there is no consent banner because there is nothing else to consent to.

Your browser also stores card data so pages load quickly, and small preferences such as whether you dim cards you do not own. Signing out clears the card data. All of it stays on your device.

TCGdex and pokemontcg.io serve the card images and prices. OpenStreetMap serves the map, but only on pages that show one. postcodes.io is used once when a shop organiser types a postcode, to find the map pin.

Those services will see your IP address, in the same way any website you visit does. The site itself is hosted by Vercel and the database is Supabase. Both may process data outside the UK.

You can export your whole collection as a spreadsheet at any time from the Collection page.

Email danny@dannyjordan.uk and I will delete your account and everything attached to it. No forms, no waiting period, and I will confirm when it is done.

Pokémon is a game plenty of children play. Cardstock is not aimed at young children and an account needs an email address. If you are a parent and would rather your child's account or profile did not exist, email me and I will remove it.

The site is still being built. I back the database up, but treat your collection here as a handy record rather than the only copy, and use the CSV export now and then.

If this ever changes in a way that matters, for example if analytics were ever added, I will say so on this page and put a notice in the app.

Questions, complaints, or anything that looks wrong: danny@dannyjordan.uk.