Privacy Notice

Vault Tracker is operated by Vault Tracker, which acts as the data controller for the personal data described in this notice. Contact: downsouthtradingcards2@gmail.com.

• Account data: your email address and sign-in credentials
• Collection data: the card records, notes, prices and photos you add
• Support messages: anything you send us when you contact us
• Usage and device data: basic telemetry such as IP address, browser/device type and error reports, used to keep the service reliable and secure

Website payment details are collected and processed by Paddle (our Merchant of Record) — we never see or store your card number.

When Apple subscriptions are available, Apple processes in-app payments. We send Apple your Vault Tracker account identifier as a purchase account token, and verify your purchase and subscription status directly with Apple. We store the original transaction identifier and its association with your Vault Tracker account; we do not receive your Apple payment-card details.

• To create and secure your account (performance of our contract with you)
• To provide the service — syncing your collection across your devices
• For security and fraud prevention (our legitimate interest)
• To improve the product and fix bugs (legitimate interest)
• To respond to your support requests
• To meet legal obligations where required

• Service providers that help us run Vault Tracker, such as our hosting and database provider
• Paddle, our Merchant of Record, for the sale of subscriptions, payment processing, tax compliance and invoicing
• Professional advisers (legal, accounting) where needed
• Apple for App Store purchase verification and subscription status, when you use an Apple subscription
• When you choose Scan photo, that photo is sent to Lovable AI for card-detail recognition. Scanning is optional; you can enter details manually instead.
• Authorities, where required by law

We do not sell your personal data.

We keep your data for as long as your account is active. When it's no longer needed — for example after you delete your account — we delete or anonymise it within a reasonable period, unless the law requires us to keep it longer.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent. To exercise any of these, email us and we'll respond within one month. If you're in the UK/EEA, you also have the right to complain to your data protection authority. Where your data is transferred outside the UK/EEA, we rely on appropriate safeguards such as standard contractual clauses.

We use appropriate technical and organisational measures — including encryption in transit and access controls — to protect your data. Your card photos are stored privately and are only visible to your signed-in account.

Vault Tracker uses essential browser storage only — to keep you signed in and remember your session. We don't use analytics or marketing cookies, so there's nothing to opt out of. Clearing your browser storage will sign you out.