Privacy Policy

Card Ally is inventory management software for trading card stores. This policy explains what information the application collects, how it is used, and the choices available to you. Card Ally is operated by the store that deploys it ("we", "us"); it is not a consumer service and does not sell data.

Account information. A username, an encrypted (hashed) password, and a role (owner or employee) for each staff member authorized to use the system. We never store passwords in readable form.

Business records. Inventory data — card names, sets, conditions, acquisition costs, market prices, sale prices, and timestamps. These are records about trading cards and store transactions, not about individuals. Card Ally does not collect names, contact details, or payment information from customers who buy or sell cards at the store.

Session cookie. A single, strictly necessary cookie that keeps you signed in. It contains a random token, expires after 14 days, and is removed when you sign out. We do not use analytics, advertising, or tracking cookies.

If you create a customer account to use the Card Ally customer portal (for example, to build a buy list / wish list or to submit a sell list before visiting the store), we collect:

Contact and account details. Your name, email address, optional phone number, and an encrypted (hashed) password. We use these to operate your account, identify your lists when you visit the store, and contact you about your submissions.

List contents. The cards you add to buy lists, wish lists, or sell lists, including quantities, conditions, and any notes you attach. Store staff can view submitted lists in order to prepare quotes and serve you in person.

Transaction history. If the store buys cards from you or fulfills items from your lists, records of those transactions are kept for normal business and tax purposes. Where local law requires secondhand dealers to verify seller identity for purchases, the store may record the identification details that law requires.

Customer information is used only to provide these services. You may request a copy of your information, correction of inaccurate details, or deletion of your account and lists by contacting the store; we will honor deletion requests except where records must be retained by law.

Information is used solely to operate the application: authenticating staff, enforcing role-based access, tracking inventory, pricing, and generating business reports. It is not used for advertising, profiling, or any purpose unrelated to running the store.

We do not sell, rent, or trade any information. Data may be shared only with service providers strictly necessary to host the application (for example, a cloud hosting provider), or if required by law.

Account and transaction records are retained while the store uses Card Ally, and as required for normal business and tax record-keeping. Staff accounts can be removed by an owner at any time, which prevents any further access by that account.

Passwords are stored using industry-standard one-way hashing (scrypt with per-user salts). Sessions use HTTP-only cookies, and all access to data requires authentication with role-based authorization. In production deployments, traffic is encrypted in transit with HTTPS.

Staff members may ask an owner to update or delete their account. Signing out removes the session cookie from your browser. Because the only cookie used is strictly necessary for sign-in, there is nothing further to opt out of.

Card Ally is a business tool for store staff and is not directed to children under 13. We do not knowingly collect personal information from children.

If this policy changes, the updated version will be posted on this page with a new effective date.

Questions about this policy can be directed to the store owner operating this installation of Card Ally.