Privacy Policy
Effective October 16, 2026 · Updated November 6, 2026
Summary: We collect what we need to run Crowd Comp: your account, your cards and your activity. Card photos and profiles are public; proof screenshots and messages are not. We don't sell your data and we don't use ad trackers.
This policy explains how Crowd Comp LLC, an Illinois limited liability company ("we", "us"), handles personal information on crowdcomps.com and the Crowd Comp iPhone and Android apps (the "Service"). Crowd Comp is for adults 18 and over.
1. What we collect
You give us:
•
Account: email address, password (stored hashed by our auth provider), collector name, favorite sport, and confirmation that you're 18 or older. If you join with someone's invite code or link, we record who invited you so they can earn invite points. If you first arrive through one of our tagged links or ads (for example crowdcomps.com/founding?src=tiktok), we keep that tag with your account to see which campaigns bring collectors. It isn't shown to anyone. They see only how many people joined with their code, not who.
•
Profile (optional): bio, city, and state or country.
•
Cards: photos, card details, grades, cert numbers, your own values, wishlists, and cards you log at a card show (with any asking price or note you add, and what the scanner read, with a short fingerprint of the photo rather than the photo itself).
•
Sold and traded cards (private): when you mark a card sold or traded, the card's title, grade and photo, what you paid, and the amount or trade value you enter, so you can track profit and loss. Only you see these.
•
Comps and proof: sale price, date, site, grade, listing number or link, and screenshots of sales.
•
Messages and trade offers you send other collectors, plus blocks and reports.
•
Feedback you send us, with an optional screenshot.
•
Imports: spreadsheet rows and photo links you choose to import.
•
Payments: which credit pack or membership you bought, the amount, and Stripe reference numbers. Your card details go only to Stripe and never reach us. In the phone apps, purchases go through Apple or Google: we get the product, the price and the store's purchase reference, never your payment details.
We create or collect automatically:
•
Activity: votes, comps, reviews, status points, credits used, notifications, trade record, and the dates of these.
•
Settings: email choices, display currency, privacy toggles, and which version of these terms you agreed to.
•
Safety checks: image fingerprints of card photos, results of photo and screenshot checks, and scam-warning flags on messages.
•
Scanner: when you scan a card, what the scanner read, which card you confirmed, whether its first match was right, any asking price you type, and a fingerprint of the photo (a short code that can't be turned back into the picture). We don't keep scan photos. If you then add the card and correct what was read, we keep what was read next to what you saved, to improve the scanner.
•
Usage limits: counts of scans, AI searches and cert lookups per day.
•
Searches: search words, logged without your account.
•
Phone apps: if you allow notifications, a push token that lets us send notifications to your device.
•
Technical data: error reports (tied to a random account ID, never your name or email), and the IP address, browser and device information that our hosting and database providers log when you connect. When you send feedback, we include the page and your browser and screen size.
2. What's public
Collector name, collector number, favorite sport, bio, badges
Private: Email address, password
Card photos and card details
Private: Proof screenshots (see section 4)
Values, approved comps (price, date, site, grade, and a link to the original sale listing)
Private: Messages and trade offers (only the two collectors)
Your city and state (or state only), if "Show my area" is on
Private: Cert numbers
Trade record (completed and backed-out trades)
Private: Credits, payments, status history, settings
Comp Reports and their verify pages
Private: Reports and feedback you send
At sign-up you choose whether to show your city and state (a box that starts unticked) so local collectors can find you. In Settings you can show your state only, turn it off, hide your PC from The Wall, or leave "Who owns this" lists.
3. How we use it
•
To run the Service: accounts, The Wall, values, Consensus Comp, Comp Reports, messages, credits and status.
•
To review comps and keep values honest: a reviewer approves every sale before it counts toward a value; we detect copied photos, edited screenshots, duplicate sales and vote manipulation.
•
To keep people safe: scam warnings in messages, handling reports, enforcing our rules.
•
To email you (section 6).
•
To fix bugs, prevent abuse, and improve the Service.
•
To meet legal obligations and enforce our Terms.
AI tools. We use Anthropic's Claude models through their API. AI only suggests; people make the decisions. We send:
Card scan when adding a card or at a card show
What's sent: The card photos you take (not kept after the scan)
Condition check before grading
What's sent: The card photos you take (not kept after the check)
Market context summaries
What's sent: Totals from our reviewed sales for one card (no personal data)
Visual match when the scanner isn't sure
What's sent: Your scan photo and catalog photos of the possible cards
Photo check (copied, stock or screen-captured photos)
What's sent: Your card photo, and a matching photo if a fingerprint matches
Screenshot check
What's sent: Your proof screenshot and the comp details you typed
Filling in a comp from its screenshot
What's sent: The screenshot you attach (it's only kept if you send the comp)
Scam warnings
What's sent: Text of messages that mention payment, contact or shipping (no names)
Nightly card checkup
What's sent: Card photos and card details
Same-card checks (Link Hunt, "not my card" on eBay listings)
What's sent: Card photos, card details and eBay listing photos
AI search help
What's sent: Your search words
Spreadsheet import cleanup
What's sent: The spreadsheet rows you import
Expert Review drafts for staff
What's sent: Card details and sales from our own data
Summaries for staff
What's sent: Feedback text and appeal details
Weekly recap
What's sent: Totals only, no personal data
Under Anthropic's commercial API terms, what we send isn't used to train Anthropic's models, and Anthropic keeps it only for a limited time for safety and abuse checks. Scanner results are marked "AI-assisted" in the app. Don't treat any AI result as a professional opinion.
4. Proof screenshots
•
Stored privately. Seen only by you, Crowd Comp reviewers, and the card's owner (after the card's turn ends). Never shown publicly.
•
Sent to our AI provider for the screenshot check.
•
Please crop out usernames. Screenshots can still contain other people's usernames or sale details from public listings.
•
Images are deleted after 2 years (a monthly job removes them), or when you delete your account. Sale facts from approved comps (price, date, site, grade, listing number and Card ID) stay in our comp archive indefinitely, without your name.
5. Who we share it with
We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We have no ad trackers or third-party analytics.
We share data only with:
Supabase
What for: Database, sign-in, file storage
Vercel
What for: Website hosting
Cloudflare
What for: Domain name (DNS)
Stripe
What for: Card payments (gets your email and payment details)
Resend
What for: Sending email (gets your email address)
Anthropic
What for: AI tools (section 3)
Sentry
What for: Error reports (account ID only)
PriceCharting (and its SportsCardsPro site)
What for: Card details used to find price estimates; no personal data
Apple and Google
What for: Purchases in the phone apps (App Store, Google Play) and delivering push notifications
RevenueCat
What for: Records in-app purchases and memberships (your account ID and what you bought)
Expo
What for: Delivering push notifications (your device's push token)
eBay (Browse API)
What for: Card details used to search listings; no personal data
eBay Partner Network
What for: eBay links are tagged with our partner ID, so eBay knows a visit came from Crowd Comp and pays us a commission if you buy. We don't send eBay your name or account
Card game databases: Scryfall (Magic), YGOPRODeck (Yu-Gi-Oh!)
What for: Card search words
Frankfurter (European Central Bank rates)
What for: Exchange rates; no personal data
Images from eBay and card game databases load straight from their servers, so they can see your IP address.
Affiliate links. Crowd Comp is a member of the eBay Partner Network and may earn a commission when you buy through an eBay link on Crowd Comp. It doesn't change the price you pay.
We may also share information: with other collectors as the Service is designed (section 2); if the law requires it or to protect someone's safety, our rights or the Service; and with a buyer or successor if our business is sold or merged, under this policy.
6. Email
•
Account emails: sign-up confirmation, password resets, security notices, receipts. You can't turn these off.
•
Alerts and morning digest: results, offers, comps, messages, price alerts and a daily digest on days with news. On by default; turn each off in Settings. Comp hunter alerts are off unless you turn them on.
•
Newsletter: only if you opt in. Every newsletter includes our postal address and a way to unsubscribe.
Every alert, digest and newsletter email has a one-click unsubscribe link that works without signing in, and you can manage all emails in Settings.
7. Browser storage and cookies
We keep your sign-in session and preferences (such as theme and display currency) in your browser's local storage, or on your device in the phone apps. We don't use advertising or tracking cookies. Our hosting and payment providers may set cookies needed for security and checkout.
8. How long we keep it
Account, profile, cards, photos
How long: Until you delete them or your account
Messages and trade offers
How long: Until both collectors in the chat delete their accounts. If one deletes theirs, the other keeps the conversation, with the deleted side shown as "Deleted account"
Proof screenshots
How long: 2 years, or until you delete your account
Card scan photos
How long: Not kept: used for the scan, then discarded
Scanner records (what was read, your answer, the photo fingerprint)
How long: Until you delete your account
Sold and traded records
How long: Until you delete them or your account
Sale facts from approved comps
How long: Indefinitely, without your name
Comp change log (staff only)
How long: Indefinitely, without your name after account deletion
Feedback and reports you send
How long: Kept without your name after account deletion
Payment records
How long: 7 years for accounting and tax. When you delete your account they're kept without your name or account attached. Stripe keeps its own records
Search log
How long: 12 months, not tied to any account
Usage and email logs (AI feature use, alerts and newsletters sent)
How long: 12 months, or until you delete your account
Cached lookups (no personal data)
How long: eBay listings and cheapest ask: up to 3 hours (we keep no eBay price history). Cert results: up to 30 days, then deleted. Card price data from PriceCharting, including its daily history: while our subscriptions last, then deleted
Error reports
How long: Per Sentry's retention settings
Backups
How long: Overwritten on our database provider's schedule
9. Your choices and rights
•
See and fix: edit your profile, cards and settings in the app.
•
Export: download your collection as a CSV file from your PC page.
•
Delete: delete your account in Settings (see "When you close your account" below).
•
Requests: email maxschroeder1400@gmail.com to ask for a copy of your data, a correction, or deletion. We'll verify it's you (usually by replying from your account email) and respond within 45 days. You can use an authorized agent; we may ask for proof they act for you.
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas and other US states), you may have the right to know, access, correct, delete and get a copy of your personal information, and to opt out of its sale, targeted advertising or profiling. We don't sell, share for targeted ads, or profile you in ways that produce legal or similarly significant effects. We won't treat you differently for using your rights. If we deny a request, you can appeal by replying to our answer; we'll respond within 45 days.
When you close your account
•
Deleted right away: your profile, collector name, cards, card photos, wishlist, saved finds, sold and traded records, scanner records, comps that weren't approved, proof screenshots and other uploaded files. Any membership is cancelled first, so you're never billed again. Unused credits are lost (the app warns you first).
•
Kept without your name: sale facts from your approved comps (so other cards' values don't change), the comp change log, and feedback and reports you sent.
•
Kept by the other collector: your messages and finished trades in their conversations, shown as from "Deleted account".
•
Kept because the law requires it: payment records for 7 years, without your name or account attached.
•
Backups: copies in our database provider's backups are overwritten on its schedule.
California notice at collection. In the past 12 months we collected these categories: identifiers (email, collector name, account ID, IP address); customer records (payment references); commercial information (credits bought and used); internet activity (use of the Service, error reports); general location (city and state you enter); and audio/visual information (photos and screenshots). Sensitive personal information: account login (email and password), used only to run your account. Sources, purposes, recipients and retention are in sections 1, 3, 5 and 8. We disclose these categories to the service providers in section 5 for business purposes only.
10. Security
We use encrypted connections, access rules in our database so people only see what they're allowed to, private storage for proof screenshots, and limits on automated use. Card payments are handled by Stripe. No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires, including under the Illinois Personal Information Protection Act (815 ILCS 530): we'll tell you what happened and what kind of information was affected, in the most expedient time possible and without unreasonable delay.
11. Children
Crowd Comp is not for anyone under 18. We don't knowingly collect personal information from children under 13. If we learn an account belongs to someone under 18, we close it and delete its data. If you think a child under 13 has given us information, email maxschroeder1400@gmail.com and we'll delete it promptly.
12. Where data is stored
We're based in the United States, and our providers store and process data in the United States and possibly other countries.
13. Changes
We'll post updates here and change the effective date. If a change is significant, we'll tell you in the app or by email before it takes effect.
Contact
Crowd Comp LLC 28262 Diehl Road, Unit 362, Warrenville, IL 60555 maxschroeder1400@gmail.com