Legal

Chrome Extension Privacy Policy

Last updated: October 12, 2026

This policy covers the Card Index — Whatnot card scanner Chrome extension (Chrome Web Store item ID impoppkbagmiajilcfbnbepdohahjmff), published by ConsulTech Ventures LLC (“Card Index,” “we,” “us”). It explains what the extension collects, how that data is handled, where and for how long it is stored, who it is shared with, and how you can delete it. It supplements our general Privacy Policy, which also applies.

What the extension does

The extension has a single purpose: while you watch a live stream on whatnot.com, it identifies the trading card being shown and displays its market value, graded prices, population data, and a suggested maximum bid. It runs only on whatnot.com, only after you open it from the Chrome toolbar, and only captures anything when you ask it to.

Data collection

The extension collects the following, and nothing else:

• Website content — video frames. When you click “Identify Card,” draw a capture rectangle, or switch on auto-scan, the extension captures one or more still frames of the live-stream video on the whatnot.com page you are viewing. If the video element cannot be read directly, it captures a screenshot of the visible tab cropped to the video player instead. Nothing is captured while the panel is closed or before you trigger a scan.
• Website content — pinned item title. The title of the item the seller has pinned on the stream is sent with the frames, because it often names the card’s printing (for example “Reverse Holo”).
• Authentication information. Your Card Index account session token, so that scans are counted against your account. You sign in with your email address, or Apple or Google sign-in, through cardindex.com; the extension never sees your password. If you are already signed in on cardindex.com, the website may pass that session to the extension so you do not have to sign in twice.
• Scan records. For each identified card we record which card it was, the selected game, and the time. This is how your free scan allowance and your scan history work. This is not activity monitoring: the extension does not log clicks, keystrokes, scrolling, mouse movement, or network traffic.
• Preferences. Your display currency, the selected card game, whether auto-scan is on, and where you dragged the panel. These stay in Chrome’s extension storage on your device and are not sent to us.
• Technical information. The extension version is sent with each request so we can tell outdated installs to update.

The extension does not collect health information, financial or payment information, personal communications, location, web browsing history, keystrokes, or any content from websites other than whatnot.com and cardindex.com. On whatnot.com it does not read chat messages, bids, purchases, other users’ profiles, or any part of the page other than the video frames and pinned item title described above. It contains no advertising, analytics, or tracking code.

Data handling

Captured frames and the pinned item title are used solely to identify the card on screen and return its pricing and population data to you. They are sent over an encrypted HTTPS connection to our API at cardindex.com, which forwards them to our own card-identification model, matches the result against our card catalog, and returns the answer to the extension. While a frame is retained (see below), we may look at it to diagnose a failed identification, and we may use it to improve the accuracy of our own card-identification model. Frames are processed to recognise trading cards; they are not used to identify people and are never run through facial recognition.

Your session token is used only to authenticate your requests to our API. Scan records are used to count your scan allowance and to show your scan history in the Card Index app and website.

We do not sell any of this data, do not use it for advertising or advertising targeting, do not use it to determine creditworthiness or for lending purposes, and do not use it for any purpose unrelated to identifying cards and operating your Card Index account. We do not transfer it to third parties except as listed under Data sharing.

Data storage

• Video frames and screenshots. For each identified auction, one representative frame is stored on our servers (Supabase Storage, in a private bucket) together with the scan record. Frames are deleted automatically within 7 days. Frames from scans that did not identify a card are not stored at all.
• Scan records (card, game, time, result) are stored in our database (Supabase) for as long as your account exists, because your scan allowance is counted from them.
• Session token and preferences are stored in Chrome’s extension storage on your own device. They are removed when you sign out or uninstall the extension. The token is never written to any website’s cookies or local storage.
• Account information (email address, profile) is stored in our database for as long as your account exists.

All data is transmitted over encrypted (HTTPS) connections. Stored data is held by the providers named below, which may be located in the United States or other countries where they operate, and access is limited to the systems and people who need it to operate the Service.

Data sharing

Data collected by the extension is shared only with the following service providers, each of which processes it on our behalf to provide the Service:

• Vercel — hosts cardindex.com and our API. Every request from the extension (frames, pinned title, session token) passes through it.
• Modal — hosts our own card-identification model. Frames are sent there to be matched against our card catalog.
• Supabase — authentication (your account and session), database (scan records, account, preferences), and storage (retained frames).
• Scrydex, CardSight, PriceCharting, and eBay — pricing, population, and sold-listing data. The extension sends them card identifiers and names only, never your frames or personal information.
• Stripe — if you upgrade to a paid plan from the extension’s Upgrade button, checkout happens on cardindex.com and is processed by Stripe. The extension itself never handles payment details.

No other party receives data from the extension. We may disclose information if required by law or to protect the rights, safety, and security of our users or the Service.

Data deletion

• Retained frames are deleted automatically within 7 days. To have them removed sooner, email us at the address below.
• Signing out of the extension, or removing it from Chrome, deletes the session token and preferences stored on your device.
• You can delete your Card Index account and all associated data — scan records, retained frames, collection, and profile — at any time by following the steps at cardindex.com/delete-account or by emailing us. We delete or anonymise your personal data on deletion, except where we must retain it for legal or accounting purposes.

Permissions

The extension requests only the permissions it needs for its single purpose:

• Host access to whatnot.com — to show the panel on the stream page and read the video frames you ask it to identify.
• Host access to cardindex.com — to pick up a session you already have on our website, so you need not sign in twice.
• activeTab and scripting — to add the panel to the Whatnot tab you opened it on, and to take the screenshot fallback when the video cannot be read directly.
• storage — to keep your session and preferences on your device.
• alarms — to check periodically whether a newer version of the extension is available.

Limited Use

Our use and transfer of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: data is used only to provide and improve the card-identification feature you see, is not sold, is not used for advertising, and is transferred to third parties only as necessary to provide that feature, to comply with law, or as part of a merger or acquisition with notice to you.

Changes to this policy

We may update this policy from time to time, and will revise the “Last updated” date above when we do. Material changes to what the extension collects will also be noted in the extension’s Chrome Web Store listing.

Contact us

Questions or deletion requests: ConsulTech Ventures LLC, info@cardindex.com.