Privacy Policy

This Privacy Policy explains what information CardBull collects, how we use it, who we share it with, and the choices you have. It applies to the CardBull iPhone app, the CardBull web app, our website at app.hawaiisupplyco.com, and the related services we provide (together, the “Service”).

1. Who we are

CardBull is operated by HSC Commerce LLC. CardBull is a trade name of HSC Commerce LLC, a limited liability company organized in the State of Hawaii, USA (“CardBull,” “we,” “us” or “our”). We are responsible for the personal information described in this policy. The Service is built for trading-card vendors who run a business (“you”). You can reach us using the details in the Contact us section.

2. Information we collect

Information you give us

Account details. Your email address and password, and your business name if you add one. We store your password only as a salted, one-way hash (PBKDF2), so we cannot read it.
Your name and phone number, if you add them. We ask for your name when you sign up (you can change it later in Settings > Account). You can also add a phone number in Settings > Account; that one is optional. We use them to know who we’re talking to when you contact us, and to reach you about your account, for example if our emails to you stop arriving. Account emails may greet you by name. We never use your phone number for marketing calls or texts.
Sign in with Apple. If you sign in with Apple, we receive a unique Apple user identifier and, if you choose to share them, your name and email address. Apple may give us a private relay address instead of your real one.
Passkeys. If you add a passkey, your device (or your browser) creates a key pair and keeps the private half; it never leaves your device. We store only the public half, a short label for the kind of device it was added from (for example “iPhone” or “Mac”), the date it was added and the date it was last used, so you can see and remove your passkeys in Settings. Face ID, Touch ID and any other biometric check happen on your device; we never receive biometric data, and we only learn that the check passed.
Sign-in codes. If you ask us to email you a code to sign in (or to reset your password), we send a 6-digit code to your account’s email address and keep only a hash of it, for 15 minutes or until it is used. The code works once. You can also create an account without a password, using a passkey instead; such an account signs in with its passkey or with an emailed code.
How you signed in. We record how and when your account last signed in (with a password, with Apple, with a passkey, or with an emailed code), so you can see your passkeys’ last use in Settings and so we can spot sign-in problems. Nothing about the device or its location is recorded with it. The business owner can see account-level details about your account, including how you sign in (whether you have a password, Sign in with Apple, or passkeys, the kind of device each passkey was added from, and when your account last signed in and how). The owner never sees anything inside your account: not your cards, deals, customers, prices or backups.
Your business data. While you are logged in, the app automatically backs up your data to your account so you can restore it on a new or replacement phone and use the same data in the web app. This includes your inventory, costs, prices, deals and trades (including any customer names or notes you type), shows, cash box entries, expenses, and app settings. We keep the most recent backup only.
Referral and invite details. Your referral code, who invited you (if anyone), any invite code you used, and whether a referral credit has been issued. If you joined through a friend’s invite, we also record when your account confirmed its email and started using the app, and whether the extra AI checks for that invite were given. The friend who invited you sees only how many of their invites counted, never your name, your email or anything in your account.
How you heard about us. After you sign up, we may ask “How did you hear about us?” Answering is optional, and you can skip it. If you answer, we keep your answer with your account, so we can learn which ways of finding us work, such as card shows, friends or social media.
Messages to us. If you email us, or send a message or problem report from the app, we keep the message and your email address so we can help you. See Messages, problem reports and app errors for what the app sends with it.

Information created when you use the Service

Subscription details. Your plan (Founder or standard), trial dates, subscription status, and the customer and subscription identifiers our payment processor assigns to you.
Account activity. We keep a record of each day your account is used (when you sign in, or open the app or the website while logged in): the date only, not the time of day. For each day, we note the app version and the kind of device (for example, an iPhone or iPad and its model and system version, or a web browser). This record doesn’t include what you did, which screens you opened, or anything inside your account.
Approximate location when you sign up. When you create an account, our hosting provider (Cloudflare) tells our server the approximate city, region (such as the state) and country of the internet connection you are using, worked out from its IP address. We keep that city, region and country with your account, so we know roughly where our customers are. We note it once, when you sign up, and we don’t keep the IP address itself. It is only an estimate: on a phone network or a VPN it can be far off, and it can’t pinpoint an address. The app never asks for your device’s location (GPS).
Notifications. If you allow notifications on an iPhone or iPad, we keep the notification token Apple gives that device, the app build, and your notification settings, so we can send the notifications you turned on. Apple delivers them. We delete a device’s token when you log out on it, when Apple says it no longer works, or after 180 days without use.
Popular searches. We count the words people search for when looking up cards and products, so we can see which ones are popular. We keep only the words, the card or set they matched, and how many times they were searched each day, never who searched, and we keep these counts for 365 days.
Anonymous sale prices. When you finalize a sale, the app sends us the price of each card you sold, so we can show what cards really sell for at shows (“Real Sale Prices”). It sends only the card (its catalog number, game, set, card number, name, printing and language), its condition or grade, the price, the card’s market price, and the date of the sale (no time). It never sends your name, account, email, business, customer, show, location, device or the deal itself. To tell different sellers apart without knowing who they are, each device makes a random code that it replaces every month; it is never linked to your account, and we store only a scrambled copy of it. A card traded at a percentage of market, a card sold for $0, several cards sold for one total price, a voided deal and practice data are never sent, and a price more than 50% below market is never counted. A price shows in the app only once a card has at least 5 sales from at least 3 different sellers in the last 90 days, as the middle price, so no one, including us, can see who sold what or for how much. Our own dashboard shows only the same totals and middle prices. Our hosting provider’s rate limiter uses your IP address for a moment to slow down repeated requests; we don’t store it. You can turn this off at any time (see Your choices and rights).
Card pictures, if you turn on Help improve card scanning. If you turn on ‘Help improve card scanning’, we keep the cropped picture of each card you confirm, with the card it was. We use these to build and improve card recognition, including products and services we may offer to others. The pictures aren’t linked to your account, we never keep the rest of the camera view, and you can turn this off at any time.
Card shows you add. If you add a card show in the app, we keep the details you typed (the show’s name, dates, place and links) and which account sent it, so we can check it before listing it and stop misuse. If you send us a show through our organizer form, we also keep the contact name and email you give us, so we can reach you about the listing; they are never shown publicly and are deleted with the listing after the show. Listings are public; your name, account and contact details are never shown on them unless you put them in the listing yourself. If you add a show from a picture, the picture is sent to our AI provider (Anthropic) to read the details and is not kept by us. If you add a picture to a listing, it is shown publicly with the listing and deleted with it after the show.
Login sessions. When you log in, we issue a session token that expires after 90 days. Our server stores only a hashed version of it.
Technical information. When the app or website connects to our server, our hosting provider processes standard technical information such as your IP address, device or browser type, and the time of the request. We use it to deliver the Service, prevent abuse, and fix errors, and keep it only in short-lived server logs, except for the approximate city, region and country when you sign up and the app version and kind of device in your account activity, which we keep with your account as described above. We never store your IP address with your account.

Information we do not collect

Payment card details. You enter these on Stripe’s secure pages, and Stripe stores them.
Face ID, Touch ID or other biometric data. These checks are handled by Apple, Google or your browser on your device; we only learn whether the check passed.
Your device’s precise location (GPS), your contacts, or advertising identifiers. The app never asks for your device’s location; we keep only the approximate city, region and country from when you signed up, described above.

3. Information about your customers

You may choose to record details about the people you buy from, sell to, or trade with, such as a name or a note on a deal. We store that information only as part of your backup and use it only to provide the Service to you. We never contact your customers or use their information for our own purposes.

You are responsible for having a lawful basis to record your customers’ information and for meeting any privacy obligations you owe them. Card shows often include young collectors, so we recommend recording only the customer details you actually need and avoiding personal details about minors.

4. Messages, problem reports and app errors

Messages and problem reports you send. When you use Contact support or Report a problem in the app, your message comes straight to us. If you are logged in, it comes with your account email address, so we know who wrote and can reply. The app also adds the details that help us find the problem: the app version, your device and its system version, your plan, the screen you were on, and a list of the last screens you opened, the buttons you tapped and any errors in the app, with the time of each. That list never includes your cards, customers, prices, costs or other money amounts, notes, searches, or anything you typed. The app keeps the list on your device (the last 60 steps, so it is still there after the app closes on an error), and it leaves your device only with a problem report you choose to send. The app shows you what it will send before you send it.

Our replies. If you were logged in when you sent a message, problem report or idea, we may reply in the app: our reply is kept with your message, sent to your account as a notification on your devices (through Apple’s notification service, if you have allowed notifications) and shown in the app’s notifications list, and it is deleted when your message is. You can turn these notifications off in Settings > Notifications.

Anonymous app error reports. When something goes wrong inside the app, it sends us a short error report on its own: what went wrong, the screen it happened on, the app version, your device and its system version, and a random id that the app makes up when it is installed. The random id lets us count how many devices have the same problem. It is not tied to your account, and error reports are sent without your login, so we can’t tell whose device sent them. Before an error report leaves your device, and again on our server, we remove anything that looks like an email address, a phone number, a long number, or a dollar amount.

Limits on how many can be sent. So that no one can flood us with messages or error reports, our server counts how many come from each internet address. It keeps only a scrambled code made from the address with a secret key, which can’t be turned back into the address, and deletes it within a day. It is never stored with your message or with an error report.

We use all of this only to answer you and to find and fix problems in the Service. We never sell it or use it for advertising. We keep a message or problem report until we have handled it, and then for up to a year; one sent while you are not logged in, for up to 90 days. We delete error reports after 90 days.

5. How we use information

To create and secure your account, log you in (with your password, with Apple, with a passkey, or with a code we email you), and reset your password.
To run and support your account: to know who we’re talking to when you contact us, and to see which app version and kind of device you use when we help you with a problem.
To back up and restore your business data across your devices.
To look up current market prices for the cards you search for.
To run free trials, subscriptions, Founder pricing, invite codes, referral credits, and invite rewards (extra AI checks for you and a friend you invite).
To contact you about your account: account emails, such as password reset codes, billing notices, and important changes to the Service or this policy, and, if you gave us a phone number, a call or text about your account when email isn’t enough.
To understand how the Service is used, so we can improve it and plan our business. We look at account details for this: when each account was created, how it joined and how it heard about us, its plan, its approximate location (city, region and country), and which days it was used, with which app version and kind of device. We also look at counts and combined totals across all vendors, such as how many accounts, subscriptions, storefronts and offers there are and how often the card scanner and price lookups are used. A combined total that comes from inside vendors’ accounts is shown only when at least 10 vendors add to it and no one vendor makes up most of it, and it is rounded. We never look at one vendor’s deals, costs, profit, inventory or customers.
To answer your questions and provide support, and to find and fix problems in the app from problem reports and anonymous error reports.
To detect, prevent, and investigate fraud, abuse, and security problems.
To comply with the law and enforce our Terms of Service.

We do not sell your business data, and we do not use your private business records (your inventory, deals, costs and customers) to train AI models. We may use information that doesn’t identify you, such as anonymous totals, anonymous sale prices and card pictures you choose to share, to build and improve our products and services. We only email you about your account. If we ever send product news, every message will include a way to unsubscribe. We never use your phone number for marketing calls or texts, and we never use your location or account activity to target ads at you.

We use a small number of service providers to run the Service. Each receives only the information it needs to do its job for us.

Cloudflare hosts our website, server, and database, where your account and backup are stored. It also tells our server the approximate city, region and country of the connection you sign up from (see Information we collect).
Stripe processes subscription payments and runs the billing page where you manage or cancel your subscription. Stripe receives your email address and the payment details you enter on its pages.
Apple provides Sign in with Apple and distributes the app.
Resend delivers our account emails, such as password reset codes. It receives your email address and the message content.
JustTCG provides the market prices in the Service. When you look up a price, we send card details such as the game, card name, set, number, and condition. We do not send personal information.
Anthropic will power card photo scanning, a feature that is coming soon. When you use it, the photo you take is sent to Anthropic solely to identify the card. Under its commercial terms, Anthropic does not use this data to train its models. If you use Find with AI when importing, we send the card names, sets and numbers from your file to our AI provider to match them. We never send what you paid, your notes or anything about you.

We may also share information when the law requires it, to protect the rights, safety, or property of our users, the public, or us, or as part of a merger, acquisition, or sale of our business, in which case this policy will continue to apply to your information. We will share information for any other purpose only with your consent.

We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.

7. Cookies and similar technologies

Our website does not use advertising cookies, analytics cookies, third-party analytics, or third-party tracking scripts. It uses your browser’s local storage for one purpose: to keep you logged in. Logging out removes it. The web app also keeps your business data in your browser’s storage, so it works like the iPhone app and syncs with your account; when you log out, it is removed from that browser once everything is saved to your account. It also keeps the random id used for anonymous error reports, which is not tied to your account, any error reports waiting to be sent, and the short list of the last screens and buttons you used, which leaves your browser only if you send a problem report (see Messages, problem reports and app errors). While you move between our sign-up and log-in pages, it may also keep an invite code, or the email you typed, in your browser’s session storage so you don’t have to type it again. Your browser clears that when you close the tab.

The website loads fonts from Google Fonts, so your browser connects to Google’s servers, which receive your IP address as part of that request. When you subscribe or manage billing, you are taken to pages run by Stripe, which may use cookies for security and fraud prevention under its own privacy policy.

The app contains no advertising or third-party analytics software. The account activity and approximate location described in Information we collect are noted by our own server when you sign up or use the Service, not by cookies, tracking scripts or analytics software.

8. How long we keep information

Account and backup data are kept while you are subscribed, and for 2 years after your subscription ends, so everything is still there if you come back. If you never subscribed, the 2 years start when your free trial (or free access from an invite) ends. We keep your latest backup and a few recent versions (about a week) so a lost save can be recovered.
After those 2 years, we delete your account and its data the same way as when you delete your account yourself (see “Deleted accounts” below). If we have a working email address for you, we email you at least 30 days before we do, so you can resubscribe or ask us for a copy. If we can’t email you (for example, we have no email address for your account, or the address no longer works), your data is still deleted after the 2 years. Resubscribing any time before then cancels the deletion. You can also delete your account yourself at any time.
Your optional details, sign-up location and account activity (your name, phone number and answer to “How did you hear about us?”, the approximate city, region and country from when you signed up, and the record of the days you used the Service) are kept while your account exists, and deleted with it. When you remove your name, phone number or answer in Settings, we delete it right away, apart from copies in our hosting provider’s encrypted backups, which are overwritten after a limited period (typically no more than 30 days). We may keep counts and totals that aren’t linked to any account, such as how many accounts were used each day or signed up from each state. We keep those only as counts and don’t try to work out who is behind them.
Password reset codes are stored only as a hash and expire after 15 minutes.
Messages and problem reports you send from the app are kept until we have handled them, and then for up to a year. One sent while you are not logged in is deleted after 90 days.
Rate-limit counts (the scrambled codes made from internet addresses, described in section 4) are deleted within a day.
Anonymous app error reports are deleted after 90 days.
Server logs are kept for a short period and then deleted automatically.
Deleted accounts. When you delete your account, we immediately remove from our database your account (including your name, phone number, how-you-heard answer, sign-up location and account activity records), cloud backup, login sessions, passkeys, referral records, and the messages and problem reports you sent from the app. Anonymous error reports aren’t linked to your account, so they stay until they are deleted after 90 days. Copies may remain in our hosting provider’s encrypted backups for a limited period (typically no more than 30 days) until they are overwritten.
Billing records are kept by Stripe for as long as tax, accounting, and other laws require, even after you delete your account.
Data on your phone stays on your device until you delete it or remove the app. Deleting your account does not erase it.
Anonymous sale prices are kept for 13 months. After that, only each day’s middle price and number of sales for each card is kept, without the random device codes.
Old email addresses. After you delete your account or change its email address, we keep a scrambled code made from the old address for 12 months, only to prevent repeated free trials. It can’t be turned back into your email address, and it isn’t linked to anything else.
Card pictures from Help improve card scanning are kept for as long as they are useful for card recognition, at most 50 per card. They are stored with the card and the day, not with your account, so deleting your account does not remove them.

9. Your choices and rights

See and export your data. Your data is always visible in the app, and you can export your inventory and show reports as spreadsheet files.
Correct your data. You can edit your data in the app at any time.
Optional details. Your name, your phone number and your answer to “How did you hear about us?” are optional. You can skip them, and change or remove them in Settings > Account at any time. If you would like us to remove the approximate location we noted when you signed up, contact us and we will.
Delete your account. On the website, go to Your account > Delete account, or in the app go to Settings > Your account > Delete account, or contact us. This permanently deletes your account and cloud backup. If you have a paid subscription, cancel it first under Manage subscription; if you have already deleted your account, contact us and we will cancel it for you.
Emails. Account emails are part of the Service and cannot be turned off while your account is open.
Anonymous sale prices. Sharing your sale prices is on unless you turn it off. You can turn it off at any time in Settings > Your business > Share sale prices anonymously. From then on, nothing more is sent, and any sales waiting on your device to be sent are dropped. Prices already sent can’t be removed, because they aren’t linked to you.
Help improve card scanning. This is off unless you turn it on. You can turn it on or off at any time in Settings > Scanning and prices. Pictures already sent aren’t linked to you, so they stay.

State privacy rights. Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of certain profiling. We do not sell personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects.

To make a request, contact us from the email address on your account. We may need to verify your identity before acting on it. You may also use an authorized agent where the law allows. We will respond within the time the law requires, and we will not treat you differently for exercising your rights. If we decline your request, you may appeal by replying to our decision, and if you are still not satisfied, you may contact your state attorney general.

10. How we protect information

All connections between the app, the website, and our server are encrypted (HTTPS).
Passwords are stored only as salted PBKDF2 hashes. Session tokens, email confirmation codes, password reset and sign-in codes, and passkey sign-in challenges are stored only as hashes. A sign-in code works once and expires after 15 minutes; a passkey challenge is used once and expires after 5 minutes.
Password reset codes expire after 15 minutes and allow only a limited number of attempts.
Our hosting provider encrypts stored data at rest.
On your phone, you can lock the app with Face ID and use privacy mode to hide costs and profit from customers.
Access to production systems is limited to the people who need it to run the Service.

No method of storing or transmitting information is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law. Please use a strong password that you do not use anywhere else.

11. Children

The Service is for adults, 18 or older, who are using it for their business. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

12. Where information is processed

We are based in the United States, and the Service is intended for use in the United States. Your information is stored and processed in the United States and in other countries where our service providers operate. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy as the Service changes. When we do, we will post the new version on this page and update the “Last updated” date. If a change materially affects how we handle your personal information, we will tell you by email or in the app before it takes effect. When an update adds a new kind of information we collect, we start collecting it only after the update takes effect.

14. Contact us

Questions, requests, or concerns about your privacy can be sent to:

HSC Commerce LLC, doing business as CardBull
State of Hawaii, USA
Email: [email protected]

The short version