Privacy Policy

1. Information We Collect

When you create a Slabfy account, we collect your email address and any profile information you provide. When you use the platform, we collect data about your card portfolio, transactions, and usage patterns to provide and improve our services.

We also collect standard technical data such as IP addresses, browser type, device information, and cookies to operate the platform securely. On our website we also use analytics and advertising cookies; see Cookies, Analytics, and Advertising below.

In the Slabfy iOS app we also collect: photos you scan or add, including card fronts and backs; your approximate town, only when you tap Use my location to find card shows; the contacts you save in your own buyer and seller address book (name, email, phone number, and mailing address); messages you send in deal rooms and orders; payment handles you choose to show buyers (such as Venmo or PayPal); and your purchase history. We use this data only to provide the app's features, and we don't use it to track you across other companies' apps or websites.

Card photos you scan are sent to our AI partners to identify the card and its price. A scan photo of a confirmed card can become that card's public catalog photo after quality and identity checks; it never shows your name.

2. How We Use Your Data

We use your data to provide Slabfy's core features: portfolio tracking, AI-powered pricing and analysis, card show management, consignment tracking, and storefront services. Your portfolio data is used to power personalized features like Ask Fy (our AI agent) and BUY/SELL/HOLD recommendations.

We never sell your personal data for money. We do use advertising cookies and pixels on our website, which some US state laws treat as "selling" or "sharing" personal information; you can opt out at any time (see Cookies, Analytics, and Advertising below). We never share your portfolio, cards, contacts, or transaction data with advertisers, and we do not share your portfolio or transaction data with other users unless you explicitly choose to (e.g., public storefronts).

If you create an account and start checkout but don't finish, we may send you one reminder email about it. Every reminder has an unsubscribe link, and we never send it after you subscribe or unsubscribe.

3. Data Security

Your data is stored securely using industry-standard encryption. We use Supabase (PostgreSQL) for data storage with row-level security policies. Authentication is handled via secure OAuth 2.1 flows with PKCE.

4. Third-Party Services

Slabfy uses these third-party services to operate. Each processes data only as necessary to provide its service to us:

Railway, Vercel, and Cloudflare (hosting and delivery); Supabase (database, file storage, and sign-in); Stripe (web payments); Resend (email); Apple (Sign in with Apple and App Store purchases); RevenueCat (App Store subscription records); OneSignal (push notifications); Cerebras and CardHedger (identifying and pricing the cards you scan); and eBay (only when you connect your eBay account to list cards). On our website only, Google (Analytics and Ads), Meta, TikTok, and Reddit receive analytics and advertising data as described below.

5. YouTube API Services

Slabfy uses YouTube API Services to find and display relevant public videos for trading-card, player, set, grading, and hobby research. By using Slabfy's YouTube-powered features, you also agree to be bound by the YouTube Terms of Service. Google's handling of information is described in the Google Privacy Policy.

Slabfy accesses public, non-authorized YouTube API Data, including video IDs, titles, channel names and IDs, publication dates, thumbnails, durations, and public view counts. We use this data only to select, organize, and display relevant videos inside Slabfy. Slabfy does not request or store YouTube login credentials, access private YouTube account data, or insert, update, or delete content on a user's behalf.

Limited public YouTube API Data may be cached to improve performance and reduce duplicate API requests. Cached data is refreshed or deleted within 30 calendar days and is protected using the same administrative and technical safeguards as other Slabfy data. Slabfy does not sell YouTube API Data or share it with third parties except service providers acting on our behalf as necessary to operate Slabfy.

You may request deletion of data associated with your Slabfy account through the in-app account-deletion controls or by contacting privacy@slabfy.com. We process valid deletion requests as soon as possible and within 30 days. Deleting data from Slabfy does not delete data stored by YouTube; YouTube data must be managed through YouTube or another authorized client. You can review or revoke Google account permissions from Google's security settings.

The YouTube embedded player may share basic device and usage information with YouTube when it loads and additional playback information when a video plays. Pulse videos autoplay by default when they become visible; you can turn off video autoplay in Slabfy's personalization settings.

6. Your Rights

You can request access to, correction of, or deletion of your personal data at any time by contacting us. You can export your portfolio data from within the platform. You can delete your account in the app under Account & settings, then Delete Account. Deleting your account signs you out, takes your profile off public view at once, and permanently removes your data from our systems within 30 days.

7. Cookies, Analytics, and Advertising

We use essential cookies for sign-in and session management. These are always on because the site doesn't work without them.

On slabfy.com (our website and the web version of the app) we also use analytics and advertising cookies and pixels from Google (Analytics and Ads), Meta, TikTok, and Reddit. They collect information such as the pages you visit, your device and browser, your IP address, and steps you take, like creating an account, starting checkout, or starting a subscription. We use this to measure how people find Slabfy, to learn which ads work, and to show Slabfy ads to people who have visited. These companies may combine it with information they already have about you under their own privacy policies.

The Slabfy iPhone app does not use advertising cookies or pixels and does not track you across other companies' apps or websites.

Your choices: you can turn analytics or advertising off at any time on our Your Privacy Choices page (also linked in the footer of every page); turning advertising off opts you out of the sale or sharing of your personal information. If your browser sends a Global Privacy Control signal, we treat it as that opt-out automatically. If you are in the European Economic Area, the United Kingdom, or Switzerland, we only use analytics and advertising cookies after you allow them in our cookie banner, where you can accept all, reject all, or choose analytics and advertising separately, and you can change your choice on the same page. You can also block or delete cookies in your browser settings.

Residents of California and other US states with privacy laws have the right to know what personal information we collect, to access, correct, or delete it, to opt out of its sale or sharing, and not to be treated differently for using these rights. To make a request, use the options above or email privacy@slabfy.com. We may need to verify your request, and you may use an authorized agent.

8. SMS / Text Messaging

If you provide your mobile phone number at checkout — by entering it and choosing "Text receipt" on a Slabfy seller's point-of-sale or online storefront — we use it to send you transactional SMS messages about that purchase, such as your order receipt and a link to view your order and save your cards. Consent is collected per transaction at the point of sale; we never purchase or upload phone numbers.

These messages are one-time and transactional — we do not send marketing or recurring text messages on this number. Message frequency is tied to your purchases. Message and data rates may apply. Reply STOP at any time to opt out of further messages, or HELP for help.

Mobile phone numbers and SMS consent are never sold or shared with third parties or affiliates for their own marketing or promotional purposes. We share your number only with our messaging provider, and solely to deliver the messages you requested.

9. Contact

For privacy-related questions, contact us at privacy@slabfy.com or through our support channels.