Privacy

Slabhold stores the account and collection details you give us so you can use the app.

When you sign up we collect your email and the account details you enter: a password, a username, and a display name. You can also add a bio, a profile photo, and a cover image.

If you use Sign in with Apple or Google, we receive your email address and, if you share it, your name from that service. With Apple you can choose Hide My Email, and we then get a private relay address that forwards to you. We never see your Apple or Google password. Your name only fills in the display name you see while picking your @handle, and you can change it. Our login provider also keeps the basic profile details the service sends with the login, such as a link to your Google profile photo. We don't show that photo; your profile photo is only one you upload.

Cards you add include the details you type in (player, year, set, grade, and the rest) and any photos you upload.

A card stays off your public profile unless you turn on "Show this card on your public profile." Private cards and their photos stay off your public profile and card share links. If you include a private card in a post, its name and the photos you attach show on that post. What you paid is optional. It is not shown on your public card. On that post it shows only if you choose, and never when the card is private.

We don't sell your data.

Services we use

Supabase stores accounts, the database, and photos. Vercel hosts the app. Recent sold prices come from Trawl, a third-party sold-listing service. Those requests send card details (player, year, set, number, parallel, serial, and grade) to Trawl. They do not send your email, username, or account id.

Apple handles Sign in with Apple and sends notifications in the iPhone app. Google handles Google sign-in.

We use Vercel Web Analytics and Speed Insights to count page views and measure performance, with no ads and no cross-site tracking. Page views record the page type (no usernames, ids or search text) plus the referrer, country and device type.

We use Cloudflare Turnstile on sign-up, log-in and password reset forms to block bots. Cloudflare processes your IP address and browser signals for this check.

Notifications

Notifications are off until you turn them on. When you do, we store a push address for that device: a browser push subscription on the web, or an Apple push token in the iPhone app. We use it only to send the notification types you picked in Settings > Notifications. Notification text goes through your browser's push service or Apple's push service (APNs).

Turning notifications off in a browser, or logging out there, removes that browser's push address. We also remove an address when the push service tells us it no longer works, and keep at most 10 browsers per account. Deleting your account removes every push address we stored.

Cookies and this device

In a browser or the iPhone app, signing in stores the login session in cookies. This browser's local storage keeps the posts you liked, recent searches, whether you dismissed the daily collection summary, and the PC or Flipping category for a card. If you open Slabhold from a campaign link, this browser keeps that link's source, medium, and campaign for 7 days. Liking, reposting, or deleting a post also saves the comments, reposts, and notifications loaded at that moment. A scan or a photo for a post is held in session storage until the next screen reads it.

To limit price checks from visitors who aren't signed in, we store a one-way hash of your IP address. We keep that hash for up to two days.

The iPhone app

The iPhone app shows slabhold.app, so this whole policy applies to it the same way, including Vercel Web Analytics. The camera and photo library are used only when you choose to take or pick a photo for a card or a post; we don't read your library otherwise. The app does no ad tracking and doesn't use the advertising identifier.

What is public

Posts, comments, reposts, profiles, follows, and cards you mark public can be read by anyone, including people who are not signed in. Hidden posts are left out. If either account blocks the other, they do not see each other's posts or comments. Hunters is opt-in.

How long we keep data

We keep account data until you delete it. There is no automatic expiration.

You can delete your account from Privacy & safety in the menu. Type DELETE to confirm. That removes your login, profile, cards, posts, comments, reposts, likes, follows, messages you sent or received (for both people), want list, want alerts, notifications sent to you, collection and price history, flags you filed on a sold listing, and uploaded photos (card photos, avatar, cover, and post images). Blocks, mutes, and reports tied to the account go with the login. Notifications you caused for other people stay in their inbox, but your name and any preview of what you wrote are removed. Deleting your account or logging out does not clear this browser's storage: liked posts, recent searches, card categories, whether you dismissed the daily collection summary, and the comments, reposts, and notifications saved here stay until you clear site data.

Slabhold is for people 13 and older.

Contact: slabholdapp@gmail.com, or see Support.