Privacy

Your collection is private. What you paid, what you own, where you shop and what you write in your notes are never shown to anyone else. The only things that become public are the ones you explicitly publish: a rip you post to the community, a card you add to your showcase, and the display name you post under.

Your email address. To sign you in, to confirm your account, and to send watchlist alerts you asked for. Never shown to other users and never sold.

Your password. Stored only as a scrypt hash with a per-account salt. We cannot read it, and a stolen copy of our database would not reveal it.

Your collection and activity. Cards and sealed product you add, what you paid, your watchlist, and the rips you log — including where you bought them and your notes. Private by default.

Age range and state. A coarse age bucket and a state, given at signup. We use these only to report audience totals to advertisers, which is how the site stays free. We never ask for your date of birth or street address.

Basic technical data. Your IP address is used briefly to rate-limit sign-in attempts and account creation, so one person cannot brute-force accounts or mass-register.

• Rips you post. Publishing shows the sealed product and the cards you pulled. It does not show what you paid, when you bought it, or your notes. You can take a post down at any time.
• The shop you credit. Where you bought something is private unless you tick the credit box, which names that shop on your post and on its page.
• Your showcase. Cards you hand-pick for your profile. Featuring a card says nothing about the rest of your collection.
• Your display name and bio. The byline on anything you post.

None of the following appears on your profile, in the community feed, on a shop page, or in any API response we serve:

• your email address
• your holdings, their quantities, or your cost basis
• your collection's total value
• your watchlist
• what you paid for a sealed product, or when you bought it
• the notes on a rip
• where you bought something, unless you credited a shop
• your age range or state

We set exactly one cookie: a session token that keeps you signed in. It's httpOnly (JavaScript can't read it) and strictly necessary — there's no way to turn it off and stay signed in. We don't run analytics or advertising cookies today. If that changes, we'll ask first via the cookie banner (or Cookie settings) before turning either on.

PokéStocks shows ads to stay free. Advertisers receive aggregate totals only— for example “38% of our audience is 18–34”. They never receive your email, your name, your collection, or a list of users. Where a group is small enough that a count could identify someone, we report it as a range instead of a number.

Users under 18 are not shown personalised or behavioural advertising.

You must be at least 13 to create an account, and signup enforces this. We do not knowingly collect information from children under 13. If you believe a child under 13 has created an account, email us at privacy@pokestocks.app and we will delete it.

• Unpublish any rip at any time from your rip log — it disappears from the feed and from any shop page immediately.
• Change or clear your display name, bio, showcase, age range and state in settings. Clearing your display name takes your public profile offline.
• Ask us to delete your account and everything in it by emailing privacy@pokestocks.app. Deletion removes your holdings, watchlist, rips and posts.

Card data and images come from the Pokémon TCG API. Sealed product and graded prices come from PriceCharting. Confirmation and alert emails are delivered by Resend. These providers receive only what is needed to do their job — the email provider receives your address to deliver a message to you; the price providers receive no information about you at all.

If we change what we collect or what becomes public, we will update this page and the date at the top. Material changes will be announced in the app.