In short

CardVault stores what a family puts into it and nothing more: the account’s email address and password (kept only as a hash), the collectors’ first names and emoji, the cards, wish lists, binders, decks and themed sets, and the photos the scanner took. There is no advertising, no analytics and no third-party tracker. Everything can be exported and deleted from the app itself, at any moment.

Who is responsible

The controller of this data is truck8.ai, Pater Beckerstraat 21, 4731 AK Oudenbosch, the Netherlands, registered with the Dutch Chamber of Commerce under number 97413402. Any question about your data goes to hello@truck8ai.com, which is also the address of the person responsible for data protection.

What is stored

The account: an email address, a password stored only as a hash, the chosen language and settings, and which plan the account is on.

The collectors: a first name and an emoji per profile. No email address, no date of birth, no photograph of a person.

The collection: cards with their quantity, condition and variant, wish lists, binders and their pages, deck lists, themed sets, badges, the share links you create, and the log of changes that makes undo and the value history work.

A shared page: whoever has one of your links sees the collector's first name and emoji and the cards that page is about — on a trade list the spare cards with their condition and the wish list, with catalogue prices; on a binder the cards in their pockets, the empty pockets of a set binder, and prices only when the link's owner has switched them on. On a shared wish list you see the collector's first name and emoji, the list's name and the cards on it, with prices only when the link's owner has switched them on; the note on a wished card never leaves the app. No email address, no other collector and no value of the collection reaches a shared page, and the page is gone the moment the link is stopped.

The scanner: the flattened photograph of each scanned card, and what the app made of it.

Payments: the events a payment provider sends about a subscription or a purchase. A card number is never among them; the app never sees one.

The server: no access log with addresses. The sign-in rate limit counts attempts per IP address in memory for ten minutes and then forgets them; the application log notes the path, status and duration of each request, without the address, and is discarded with each new release.

Scan photos

A scan keeps the flattened picture of the card itself, cropped and straightened to the card — not the table, the room or the person holding it. It exists so a scan that went wrong can be understood and corrected. The nightly job deletes every scan photo older than fourteen days. A photo that a family used to teach the scanner a card, or that was corrected by hand, becomes that card’s reference picture and is kept until the account is deleted.

Why we may store it

All of it is needed to provide the service the account holder asked for: article 6(1)(b) of the GDPR, the performance of a contract. There is no advertising and no profiling. The one processing that rests on a legitimate interest, article 6(1)(f), is keeping the service running and secure: the sign-in rate limit and the application log described above. Billing records are kept because Dutch tax law requires it: article 6(1)(c), a legal obligation.

How long it is kept

Until the account is deleted, with two exceptions: scan photos go after fourteen days as described above, and billing records are kept for seven years because the tax law says so, with the link to the account removed. Deleting the account deletes everything else at once — no waiting period, no archive copy. Server backups are kept for fourteen days and then roll over.

The AI features, and what they send

Three things in the app send data to Anthropic PBC, and nothing else does.

A scan that is still unsure after the local match, the set symbol and the corner number: the flattened photo of the card is sent so that the name and the number can be read. On the free plan this happens at most ten times a day.

A themed set written in your own words, on Family Plus: the sentence you typed.

“Build me a deck” in the deck helper, on Family Plus: the deck list and the names of the cards it may use.

No email address, no account name and no profile name is sent with any of them. The requests go under Anthropic’s commercial API terms, which keep them out of model training, and CardVault trains nothing of its own on a family’s data.

Who else processes it

A hosting provider in the European Union: the server the app runs on and its backups.

Stripe Payments Europe: payments and subscriptions bought on the web.

RevenueCat and Google: purchases made through the Google Play Store.

Anthropic PBC: the three requests described above.

Resend: the verification and password-reset emails.

Each is a processor under a data processing agreement and receives only what it needs for its part. There is no other recipient, and nothing is ever sold or handed to an advertiser.

Your rights

You can see and take everything at any moment from Settings → Your data: a CSV of the collection and the wish list, a backup file of the whole household, or the complete account as one JSON file. You can erase everything from Settings → Account → Delete account.

Beyond that you have the rights the GDPR gives you — access, rectification, erasure, restriction, portability and objection — and you exercise them by writing to hello@truck8ai.com. If you think your data is handled wrongly, you may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Children

The account holder is an adult and holds the account on behalf of the household. The children in it are profiles, not accounts: a first name and an emoji chosen by the family, with no email address, no date of birth, no login of their own and no way of being contacted. There is no chat, no feed and no contact with anyone outside the family, so a child cannot be reached through the app. A parent can rename or remove a profile at any time.

Cookies and tracking

CardVault sets no cookies. The browser’s localStorage holds the session and the settings you chose — language, theme, price source — because that is what keeps you signed in and keeps the app looking the way you left it. There is no analytics, no advertising network, no fingerprinting and no third-party script, neither in the app nor on this website.

Transfers outside the EU

The server and its backups are in the European Union. Three processors are in the United States: Anthropic PBC, Resend Inc. and RevenueCat Inc.; Google may process a Play purchase there too. Each of those transfers rests on the European Commission’s standard contractual clauses in the data processing agreement with that company, or on the company’s certification under the EU-US Data Privacy Framework where it holds one. What reaches them is only what its paragraph above says: a card photo or a typed sentence, an email address for a verification mail, a purchase record — never the collection as a whole.

Changes to this notice

If something material changes, the account holder is told by email before it takes effect and the date at the top of this page changes. The English text is the binding one; the ten translations are there for convenience.