Privacy

What we keep

• Your email address, and the account id Supabase gives it. That is how you sign in, and it’s the only personal detail we keep.
• Your collection: your binders and the cards in them, with each card’s finish, condition, language, number of copies and, if you entered it, what you paid.
• The history of your changes: each import, sync, edit and sale, with the cards before and after, so a change can be undone.
• Your sell list: which binders and printings you’re selling, and any minimum price you set.
• Your watch list with its notes, your decks with their cards, and the shelves you group your binders and decks on.
• A share link for a deck’s image, if you make one. It’s off until you turn it on in the deck’s Display window. While it’s on, anyone with the link can see the deck’s name, its list of cards and its image, without signing in, and nothing else of yours: not your email, your collection or what you paid. Turn it off, or make a new link, and the old one stops working at once; a site where you posted it may keep the preview it already showed.
• Your sales to Card Kingdom: the cards in each, what CK was paying when you started it and what you say it paid.

No name, address, payment details or location. Other people using The Stack can’t see your collection, or anything else of yours except a deck you share; the person who runs the site can reach the database, as with any website.

Who handles it

• Supabase runs sign-in (your email, the links we send you and your session) and the database that holds everything above.
• Resend delivers the sign-in and invite emails, and the daily email about Card Kingdom’s prices, so it sees your address and those emails. We keep your alerts, whether you want that email and the days it went; each one has a link to stop it.
• Vercel hosts the site. Like any web host it sees your IP address and the pages you open, in its request logs.
• GitHub runs the daily price job. It reads which printings are in collections, on watch lists and in decks, to know which prices to fetch, and nothing about whose they are.

Card data and prices

Card details and prices come from two public sources. Our server asks them for cards, never for anything about you.

• Scryfall: when you search for a card or import a file, our server looks the cards up by name or Scryfall id, and once a day it asks for the prices of the printings in collections, on watch lists and in decks. Your browser loads the card images in your lists from Scryfall’s image server, which sees your IP address the way any website does.
• Card Kingdom: once a day our server downloads Card Kingdom’s public buylist. Nothing is sent to them.

Connected apps

You can connect an app such as Claude to The Stack, so you can ask about your cards in a chat. Nothing is shared until you sign in and choose Allow on the page that asks.

• The app sees what The Stack’s tools give it. They read your email address; your binders and how many cards each holds; every card you own, by printing, finish, condition and language, and the binder it’s in; what Card Kingdom pays for them and how many it wants; their market prices; your sell list, with any minimum you set; your alerts, with whether you’ve read them; your watch list, with your notes and the same prices for each card on it; your decks, with their cards, which of them you own and in which binder, and what the missing ones cost; and your shelves, with how many binders and decks are on each and which shelf each binder and deck is on. A few make small changes you can undo, when you ask: add a single card, which shows in your collection history like one you add here; put a card or a binder on your sell list, or take it off; mark your alerts read; watch a card or stop watching it; and add a card to a deck, move it to another board or take it out. Imports, syncs and sales stay on this site, and so do making and deleting decks, and making shelves and moving binders and decks between them.
• The company behind the app, Anthropic for Claude, receives everything the app reads here, along with what you ask it. Its own privacy terms apply to that, not this note.
• Supabase keeps the connection: the app’s name and the address it sends you back to, which app you allowed and when, and the sign-in it holds for the app. The Stack keeps nothing new.

To disconnect an app, open your account page and choose Disconnect next to it. The app can’t renew its access after that, and has to ask you again to come back. Access it already holds isn’t cut off at once: it keeps working until it expires, soon after.

No ads, no tracking

No ads, no analytics and no tracking of any kind. The only cookie is the one that keeps you signed in. Your browser also remembers how you like each list of cards shown (rows, compact rows or stacks), the search results when adding a card included, and which shelves you folded; that stays on your device. Fonts are served from this site, not from Google.

Deleting your account

On your account page, choose Delete my account and type your email to confirm. Your collection, its history, your sell list, your watch list, your decks, your shelves, your email address and your sign-in are deleted straight away and can’t be brought back. Card and price data isn’t yours and stays.

Questions, or anything you’d like changed: ask the person who invited you.