CardOps is a product of Havasi Holding LLC ("we", "us"), which is responsible for the data practices described here. CardOps is built so that your business data stays yours. This policy explains what the app touches, where it goes, and the choices you have. CardOps has no accounts: we never ask for your name, email, or password, and almost nothing described below can identify you personally. The one exception is the Discord bot's free-month claim, which keeps a Discord user id (see Discord bot below). Using the app is also governed by our Terms of Service.
Your inventory and sales data
Cards, prices, sales, shows, expenses, and photos you add are stored on your device and, if iCloud is enabled, synced through your private iCloud database using Apple's CloudKit. We cannot read, access, or recover this data; it lives in your Apple account, protected by Apple's security. Deleting the app and its iCloud data removes it.
Camera and card scanning
The card scanner runs entirely on your device using Apple's Vision framework. Scanner camera frames are processed locally and are never uploaded. Photos you attach to inventory items are stored with your inventory data in your private iCloud.
AI features
Grade estimate (photos leave your device). When you use the AI condition/grade estimate, the front and back photos you take of that card are sent to our server and processed by Anthropic's Claude model to produce the estimate. We do not store your photos. Our server keeps only the resulting estimate, keyed by an anonymous fingerprint of the images, for up to 30 days so repeat requests are instant. Photos are used to generate your estimate, not to train AI models.
Deal Brain, weekly report, and portfolio questions. These features send the relevant card names and aggregate numbers (values, margins, totals; never your photos, notes, or customer information) to AI models running on our own server infrastructure (Cloudflare Workers AI). Responses are cached anonymously for up to 30 days.
Grading accuracy telemetry. To improve the grade estimator, the app can report an anonymous record when a real grade comes back for a card we estimated: the estimate, the actual grade, and a random identifier, with nothing tied to you or your device. Turn this off anytime in Settings → Privacy → "Share grading data".
Price alerts (optional)
If you turn on price alerts, we store your device's push token and the list of card IDs and names you own on our server so the nightly job can notify you of price moves. This list is keyed only by the push token, with no account or identity attached. Turning alerts off, or the token becoming invalid, removes the registration.
Discord bot
The CardOps Discord bot, in servers CardOps has approved, counts which Pokémon cards a server talks about, per hour. It never stores message text or usernames. When a message contains a link to an allowlisted card site or a photo of a card, the bot reads the link's page title or recognizes the card in the photo to count it the same way; both are processed in memory and discarded immediately, never downloaded to disk or stored. To recognize a card, the photo is sent to Anthropic's Claude API, which returns the card's name; CardOps keeps none of it. Only the resulting hourly count per card is saved. A server's admin can turn this off anytime with /cardops chatter off.
Claiming a free month. The /cardops-pro command sends your Discord user id to CardOps's code service, which keeps it stored with the code you claimed, indefinitely, solely to stop that same account from claiming a second free month. Nothing else about you is sent.
Creator codes (optional)
If you enter a creator's referral code, we store the code together with your app's random purchase identifier (see Purchases below), and we keep anonymous records of subscription transactions attributed to that code (product, price, and date) so we can share revenue with the creator who referred you. The code is also attached to your RevenueCat purchase record. None of this includes your name, email, or Apple ID, and entering a code never changes what you pay.
Card prices and catalog
When the app fetches market prices, sold listings, or the card catalog, it contacts our server with the card's identifier only. To prevent abuse, our server briefly counts requests per IP address (deleted within 24 hours). Standard technical logs may be retained briefly by our hosting provider (Cloudflare) for security and reliability.
Purchases
Subscriptions and purchases are processed by Apple. We use RevenueCat to validate purchases and manage subscription status; RevenueCat receives your purchase receipt and a random app-generated identifier, not your name, email, or Apple ID.
Crash and performance diagnostics
To find and fix bugs, CardOps can send anonymous crash reports and performance data to Sentry. These reports contain technical details about the failure (device model, OS and app version, and diagnostic traces) but no name, email, account, IP address, or your inventory, prices, or photos. It is on by default; you can turn it off anytime in Settings → Privacy → "Share crash & diagnostics".
Feedback you send. If you use the in-app feedback form, the message you write and the email address you optionally include are delivered to us through Sentry so we can respond. Feedback is only ever sent when you tap send.
Anonymous usage analytics
To understand which features get used and where people get stuck, CardOps can send anonymous product-usage events to PostHog — which screens you open, which features you run, and app open/close events. Events are tied only to a random identifier generated on your device; CardOps never identifies you to PostHog, so there is no name, email, account, or advertising identifier attached, and none of your inventory, prices, or photos is included. It is on by default; you can turn it off anytime in Settings → Privacy → "Share anonymous usage data".
On a new install, the same setting also covers a masked screen recording of onboarding only, the first-run setup screens, so we can see where people give up. Everything you type, every image, and the camera view are blacked out before the recording leaves your device. Recording stops as soon as onboarding ends or is skipped, and after 10 minutes at most; nothing after onboarding is ever recorded, and returning users are never recorded. Like the usage events, the recording is tied only to the random device identifier. With usage data turned off, no recording is made.
Website analytics
This website (cardops.app) sends page views, and clicks on App Store download, social, and Discord links, to PostHog through our own domain. It runs in cookieless mode: analytics sets no cookies and stores nothing in your browser's local storage, we never identify you, and no session recording is made. To count unique visitors, PostHog computes a hash on its servers that rotates daily, so a visit cannot be linked to you or followed from one day to the next. Events record the page, the link clicked, and any campaign tag in the link you arrived from (such as which social network sent you).
Optional email newsletters
If you sign up for a CardOps newsletter, we store your email address, selected topics, signup source, and consent and confirmation timestamps. Resend processes your address and delivery status to send confirmation links, the weekly vendor digest, and product updates you choose. We do not attach your inventory, sales, profit, or iCloud identity to these subscriptions. Email open and click tracking are disabled.
Use the links in an email or visit our email preferences page to stop newsletters or delete your subscription. Unconfirmed signups are removed after seven days. Expired access links are deleted during regular cleanup. Delivery and campaign records help us prevent duplicate sends and troubleshoot failures. A one-way email suppression record is retained after deletion, a complaint, or a permanent unsubscribe to prevent accidental resubscription.
What we don't do
- No advertising, and no ad tracking
- No cross-app or cross-site tracking, and no data brokers
- No sale of personal data; service providers process data only to provide the features described here
- No required accounts or passwords; email newsletters are optional
- No AI training on your data
Your choices and deletion
Diagnostics, usage analytics, and grading telemetry can be turned off in Settings → Privacy; price alerts and creator codes are off unless you use them. To have server-side records deleted (price-alert registration, creator-code attribution), email us and include the creator code you used, if any; we'll remove the associated records. Your inventory itself is deleted by deleting the app and its iCloud data; it never touches our servers.
Children
CardOps is not directed at children under 13 and does not knowingly collect personal information from them.
Changes
If this policy changes, the updated version will be posted at this address with a new effective date.
Contact
Havasi Holding LLC
support@cardops.app