Privacy policy
Last updated: September 27, 2026
Cardsteward (“Cardsteward”, “we”, “us”) runs the website at scout.cardsteward.com, which finds graded Pokémon cards listed below their estimated market value. This policy explains what personal information we collect, how we use it, who helps us handle it, and the choices you have. It covers the website and the invite list for our private beta. Your use of Cardsteward is also governed by our terms of service.
The short version
- We collect very little: your email address, a password (stored only in hashed form), the want list and setting you save, and any issue reports or feedback you send. If you ask for an invite, we collect only your email address.
- The website has no analytics, advertising or tracking scripts. We don't sell your personal information or share it for advertising.
- The only cookies we set are the ones needed to sign you in and to reset a forgotten password.
- To see, correct or delete your information, email support@cardsteward.com.
Who we are
Cardsteward is the operator of this website and is responsible for your personal information. For any question or request about privacy, email support@cardsteward.com.
What we collect
Your account
Cardsteward is in private beta, and we create each account when we invite someone. Your account holds:
- your email address, which is also how you sign in;
- your password. Our sign-in provider stores it only in hashed (scrambled) form. Passwords you type pass through our server on their way to it; we don't store them or write them to any log. We choose a starting password when we create your account and give it to you; because we know it, please change it on the Account page when you first sign in. After that, you can change it at any time, or reset it by email if you forget it;
- basic records kept by the sign-in system, such as when your account was created and when you last signed in.
We don't ask for your name, postal address, phone number, date of birth or payment details, and we never ask for your logins to any marketplace.
What you add
- Want list: the cards you add, any grading companies and minimum grade you choose for each, and when you added them.
- Your setting: the minimum % off a deal must have before we show it to you.
- Issue reports and feedback: the kind of problem or suggestion, any note you write, the address of the page you filed it from (including any search or filter choices in that address), and, for a report about a particular listing or card, which one and a snapshot of what the site showed for it at the time, such as the price, estimated value, grade and marketplace. We also record when you sent it and our review of it. Please don't put sensitive personal information in a note.
Invite requests
If you ask for an invite on our landing page, we collect only your email address, and we pass it to MailerLite, which keeps our invite list (see Email). To stop the form being flooded, our server holds your IP address and the times of your requests in its memory and refuses more than five requests in ten minutes. That IP address is never saved to our database or sent to MailerLite, and it is discarded when the server restarts.
Technical information
- Sign-in and password-reset cookies, described under Cookies.
- As with any website, each request to Cardsteward reaches our hosting provider, Vercel, with your IP address, browser details and the address of the page requested. Vercel may keep logs of these requests. Search terms and filter choices are part of page addresses, so they can appear in those logs; apart from a report's page address, we don't save them anywhere.
- Your browser never connects to our database or sign-in provider directly: signing in, resetting a password and every read or save go through our server. Our sign-in provider may keep its own logs of those requests.
- When something goes wrong, our server logs a short error message so we can fix it.
What we don't do
- The website has no analytics, advertising or tracking scripts, pixels or similar tools, and loads no web fonts from other sites.
- We don't sell your personal information, and we don't share it for targeted advertising.
- We don't send your want list, setting, reports or feedback to marketplaces or to the services we use to value cards. Those services receive listing and card information only, never information about you.
- Other users can't see your want list or your setting. Your reports and feedback, with the email address of the account that sent them, are seen only by Cardsteward's administrators, who review them with the help of AI (see AI-assisted review of reports and feedback).
How we use your information
- to create your account, sign you in and keep you signed in;
- to show you the deals that match your want list and your minimum % off;
- to review your reports and feedback, fix wrong cards, wrong values and other problems, and consider your suggestions for improving the service;
- to send the password-reset emails you ask for and, if you asked for an invite, your invite and occasional Cardsteward news;
- to answer messages you send us;
- to keep the service secure and prevent abuse; and
- to meet our legal obligations.
Who we share it with
Apart from the image hosts described under Images and links to other sites, we share personal information only with the service providers that run Cardsteward for us, listed below. Each handles it under its own terms and privacy policy.
- Vercel
- Hosts the website and runs our server. It handles every page request and every form you submit, including your sign-in details on their way to Supabase.
- Supabase
- Our database and sign-in system. It stores your account (email address, hashed password and sign-in sessions), your want list, your setting and your reports and feedback, and sends password-reset emails.
- Resend
- Delivers the password-reset emails that Supabase sends. It receives your email address and the email itself, including the one-time reset link.
- MailerLite
- Keeps the invite list and sends invite and news emails. From us it receives only your email address.
- SiteGround
- Hosts our email, including support@cardsteward.com, and cardsteward.com, which forwards visitors to this site. It receives any message you send us.
- Anthropic
- Its AI, Claude, helps us review issue reports and feedback (see below).
- Microsoft OneDrive
- Stores our working files, including the notes we keep while reviewing reports.
We may also disclose information when the law requires it, or when it's needed to protect the rights and safety of Cardsteward, our users or others. If Cardsteward is ever sold or merged, your information may pass to the new owner, who must keep to this policy or tell you about any change.
AI-assisted review of reports and feedback
We use Claude, an AI model made by Anthropic, to help review issue reports and feedback and fix the problems they describe. Each day, an automated session on our own computer reads what has come in, checks it against our catalogue, and records a finding on each one, such as confirmed, duplicate or not a problem or, for a suggestion, a short summary. We may also use Claude when working on a specific report or suggestion. Claude sees everything in a report or message, including the note, the page, the snapshot and the email address of the account that sent it, so Anthropic processes that information.
The review is about the site (whether its data is right, or what a suggestion asks for and what it would take); it isn't used to make decisions about you. The notes it writes may quote what a report or message says, but they don't include email addresses.
Images and links to other sites
On signed-in pages, card pictures load directly from TCGplayer's image server (tcgplayer-cdn.tcgplayer.com), and set logos load from the image hosts used by the Pokémon TCG API, such as images.pokemontcg.io and images.scrydex.com. To show an image, your browser connects to that host, which receives your IP address, your browser details, the image's address (which identifies the card or set) and usually our site's address. We don't control what these hosts log or whether they use cookies; their own policies apply. Pages you can open without signing in, such as the landing page, don't load these images.
Deals link to the listing on the marketplace (Fanatics Collect, Arena Club, Courtyard or ALT), and card pages link to TCGplayer. We add no tracking or affiliate codes to these links. When you follow one, you are on a site we don't control, and its own privacy policy applies.
Password resets. If you use “Forgotten your password?”, we email a one-time reset link to that address from no-reply@cardsteward.com, sent by Supabase through Resend. These are the only emails the site itself sends.
The invite list. If you request an invite, MailerLite may first email you to confirm your address. After that, we'll email you when a place in the beta opens and, now and then, with news about Cardsteward. Every email has an unsubscribe link. Unsubscribing stops the emails; to have your address deleted from the list, email support@cardsteward.com. Like most email services, MailerLite may record when our emails are delivered, opened or clicked, and the IP address and device used when you confirm your address, open one of our emails or click a link in it.
How long we keep it, and deleting your account
- Your account, want list, setting, reports and feedback are kept for as long as your account exists. A card you remove from your want list is deleted straight away.
- Your address stays on the invite list until you ask us to delete it. Unsubscribing stops the emails.
- If you email us, we keep the message and your address so we can reply.
- Our service providers keep their own logs and backups for their own periods.
There is no delete button yet. To delete your account, email support@cardsteward.com from the address on your account. We'll delete it from our sign-in system, which also deletes your want list, setting, reports and feedback from our database.
Some copies are not removed automatically: your address on the invite list, if you joined it; notes and records from reviews of reports and feedback, kept on our own computer and in our file storage; and our providers' logs and backups. When you ask us to delete your account, we'll also remove you from the invite list and delete what we can of these copies.
Security
We take reasonable steps to protect your information. Connections to the site are encrypted (HTTPS); passwords are stored only in hashed form; your browser never talks to our database; the database lets each account read and change only its own want list and setting; other users can't read your want list or setting, and only our administrators can read reports and feedback. No system is perfectly secure, so we can't promise that your information will never be accessed without permission. If a breach affects your information, we'll tell you as the law requires.
Your choices and rights
You can change your want list and your minimum % off at any time, and change your password on the Account page. You can also ask us to:
- tell you what personal information we hold about you and give you a copy of it;
- correct it, including changing the email address on your account, which you can't do yourself yet;
- delete your account and your information; or
- remove your address from the invite list.
Depending on where you live, US state privacy laws may give you further rights, such as the right to know how your information is used or to opt out of its sale or its use for targeted advertising. We don't sell personal information or use it for targeted advertising.
To make a request, email support@cardsteward.com from the address on your account, or from the address you gave us for the invite list. We may need to confirm that the request comes from you before acting on it. We'll reply as soon as we can, within the time the law requires, and we won't treat you differently for making a request.
Children
Cardsteward is only for people aged 18 or older, and we don't knowingly collect personal information from anyone younger. Please don't request an invite if you are under 18. If you believe someone under 18 has given us their information, email support@cardsteward.com and we'll delete it.
Where your information is processed
Cardsteward is run from the United States, and our database is hosted in the United States (Oregon). Our service providers process information in the United States and may also do so in other countries where they operate. If you use Cardsteward from outside the United States, your information will be transferred to and processed in the United States.
Changes to this policy
We'll update this policy when Cardsteward changes how it handles personal information, and change the date at the top when we do. If a change significantly affects how we handle your information, we'll let you know on the site or by email before it takes effect.
Contact us
Questions, requests or complaints about privacy: support@cardsteward.com.