Legal

Privacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how ConsulTech Ventures LLC (“Card Index,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Card Index mobile app, the Card Index website at cardindex.com, and the Card Index Chrome extension (together, the “Service”). By using the Service, you agree to the practices described here.

Information we collect

Account information

When you create an account, we collect your email address and, if you sign in with Apple or Google, the basic profile information those providers share with us (name and email). You may optionally add a display name, username, and profile photo. We also store your preferences, such as your display currency and the card game you have selected.

Card scans and images

When you scan a card in the mobile app, the app captures a photo using your device camera. When you use the Chrome extension on Whatnot, it captures still frames of the live-stream video (see Chrome extension below). In both cases the image is sent to our servers and to our card-identification providers so we can recognize the card and return catalog and pricing information. Images are processed to identify trading cards; they are not used to identify you, and we do not run facial recognition on them.

We keep a record of each scan (the card identified, the game, the time, and the result) for as long as your account exists, because your free scan allowance is counted from it. The images themselves are retained only briefly: frames captured by the Chrome extension or the live scanner are deleted within 7 days, and photos taken with the camera are deleted within 30 days. While retained, images may be reviewed by us to diagnose a failed identification and used to improve the accuracy of our own card-identification model.

Collection, listings, and orders

We store the cards you add to your collection, along with related details such as quantities, conditions, notes, and estimated values, so we can sync your collection across sessions and devices. If you list cards for sale or buy cards through the Service, we store the listing (including photos you upload), the order, and the shipping name and address needed to fulfil it.

Purchase information

Subscriptions bought in the mobile app are processed by the Apple App Store or Google Play and managed through RevenueCat. Subscriptions and purchases made on the website are processed by Stripe. We receive your subscription status, order totals, and related transaction identifiers, but we do not collect or store your full payment card details.

Usage and diagnostic data

We collect limited technical information such as device or browser type, operating system, app or extension version, and crash and error reports (via Sentry) to keep the Service reliable and to improve it. The website uses Google Ads conversion measurement, which sets cookies on cardindex.com; the mobile app and the Chrome extension contain no advertising or analytics trackers.

Chrome extension

The Card Index Chrome extension identifies trading cards shown during Whatnot live streams. This section describes exactly what it collects and does, in addition to the general practices above. A standalone version covering only the extension — its data collection, handling, storage, sharing, and deletion — is at cardindex.com/privacy/chrome-extension.

What it collects

Stream frames. When you click “Identify Card,” draw a capture rectangle, or turn on auto-scan, the extension captures one or more still frames of the live-stream video on the whatnot.com page you are viewing. If the video cannot be read directly, it captures a screenshot of the visible page cropped to the video player instead. These frames are sent over HTTPS to our servers for identification.
Listing context. The title of the item the seller has pinned on the stream is sent with the frames, because it often names the card’s printing. The stream page URL is used locally to tell one auction from the next; it is not sent to us.
Account session. To sign you in, the extension stores your Card Index session token in Chrome’s extension storage. If you are already signed in on cardindex.com, the website can hand that session to the extension so you do not have to sign in twice.
Preferences. Your display currency, selected game, auto-scan setting, and the panel’s position on the page are stored in Chrome’s extension storage on your device only.

What it does not collect

It does not read, record, or transmit anything from websites other than whatnot.com and cardindex.com, and it only runs on whatnot.com after you open it from the toolbar.
It does not collect your browsing history, keystrokes, chat messages, bids, purchases, or any other content of the Whatnot page beyond the video frames and pinned item title described above.
It does not capture anything until you click Identify Card, draw a rectangle, or turn on auto-scan, and nothing is captured while the panel is closed.
It does not contain advertising, analytics, or tracking scripts.

How it uses and stores the data

Frames are used solely to identify the card on screen and return its market value, graded prices, population, and a suggested maximum bid. For each identified auction, one representative frame is stored on our servers for up to 7 days, then deleted automatically; the record of the scan (card, game, time) is kept with your account for your scan allowance and scan history. Frames are shared only with the providers listed under “How we share information” below, and are never sold, used for advertising, or used to determine creditworthiness.

How we use information

Provide, maintain, and improve the Service.
Identify cards and return catalog, pricing, population, and market data.
Sync and back up your collection; list, sell, and ship cards.
Manage your subscription, scan allowance, and entitlements.
Improve the accuracy of our own card-identification model, using scan images during the short retention period described above.
Diagnose problems, prevent abuse, and secure the Service.
Respond to your support requests.

We do not sell your personal information, and we do not use it for advertising targeting, for determining creditworthiness, or for any purpose unrelated to the Service.

How we share information

We share information only with the service providers below, each of which processes it on our behalf to operate the Service:

Supabase — authentication, database, and file storage for your account, collection, scans, and listings.
Vercel — hosts the website and the API that the mobile app and Chrome extension talk to; all requests pass through it.
Modal — hosts our own card-identification model. Scan images and stream frames are sent there to be matched against our card catalog.
Scrydex and CardSight — card-identification and pricing providers. Camera photos may be sent to them to recognize a card when our own model cannot; they also supply catalog, price, and population data.
Google (Gemini, via OpenRouter) — vision models used to read card details from some scan and listing images.
PriceCharting and eBay — pricing and sold-listing data. We send card names and identifiers, not your personal information.
Stripe — payments on the website. RevenueCat, Apple, and Google — subscriptions in the mobile app.
Shippo — shipping labels for orders; receives the buyer’s name and shipping address.
Cloudflare — storage for photos you upload to listings and for scan photos uploaded from the mobile app, and delivery of catalog images.
Sentry — crash and error diagnostics.
Google Ads — conversion measurement on the website only.

We may also disclose information if required by law or to protect the rights, safety, and security of our users or the Service. If Card Index is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

Data storage and security

Your data is stored on servers operated by the providers above, which may be located in the United States or other countries where they operate. All data is transmitted over encrypted (HTTPS) connections, and access to stored data is limited to the systems and people who need it to operate the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data retention

Account, collection, listing, order, and scan records: for as long as your account is active.
Scan images: stream frames from the Chrome extension and live scanner for up to 7 days; camera photos for up to 30 days.
Session tokens and preferences in the Chrome extension: on your device until you sign out or remove the extension.

You may delete your account at any time, after which we delete or anonymize your personal data, except where we are required to retain it for legal or accounting purposes (for example, order records).

Your choices

Access and update your profile within the app or website.
Revoke camera or photo permissions in your device settings.
Sign out of the Chrome extension, or remove it from Chrome, to clear the session and preferences it stores on your device.
Delete your account and associated data from Settings, by following these steps, or by contacting us.

Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can remove it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy, contact us at info@cardindex.com.

Card values, price estimates, and market data shown in Card Index are provided for informational purposes only and do not constitute financial, investment, or appraisal advice.