Privacy Policy

1. Who we are

Sleevz ("Sleevz", "we", "us") is the operator of the Sleevz mobile app and website. For the purposes of the UK/EU GDPR we are the data controller for the information described here. You can reach us at privacy@sleevz.app.

2. What we collect

Everything below is either given to us by you or created by you using the product. We do not buy data about you, and we do not enrich your account from outside sources.

Account information

• Email address — your login identity, and how we send password-reset links.
• Password — stored only as a salted hash by our authentication provider. Nobody at Sleevz can read it.
• Display name — optional, used to greet you in the app.

The records you create

This is the substance of the product: the cards you buy, sell, and trade, and the figures derived from them.

• Inventory rows — card name, set, number, condition, grading company and certification number, quantity, market value, and cost basis.
• Transactions — buys, sells, trades, lots, opening stock, and the cash on each side.
• Shows and expenses you log, and the profit-and-loss attached to them.
• Consignment partners you create, and which cards belong to them.
• Price alerts you arm.

A consignment partner is a record you write about someone else. Only enter a person's details if you have a reason to hold them — those rows are your responsibility as much as ours.

Billing information

If you choose a paid plan, we keep the Stripe customer and subscription identifiers, the plan you chose, payment status, and renewal or cancellation date. Stripe collects and processes your payment method, billing address, and transaction details directly; your full payment credentials never pass through Sleevz.

Technical information

Our hosting and database providers keep short-lived operational logs (IP address, timestamp, request path, error traces) as a normal part of running a service securely. We use them to diagnose faults and detect abuse. We do not build behavioural profiles from them and we do not use them for advertising.

We run no advertising or cross-site tracking. There is no Meta pixel, no ad network, and no data broker involved in the app or on this website, and we do not run Google Analytics.

We do measure aggregate usage of this website — how many people visit a page, and which links they arrived from — using Vercel Web Analytics. It is counts and totals only: it sets no cookies, builds no profile about you, does not follow you to other websites, and never sees anything inside your account. This is why the site shows no cookie banner: there is no tracking cookie to ask you about.

3. Why we hold it

We process your information to provide the service you signed up for: to authenticate you, to store and display your records across your devices, to compute cost basis and profit, to fill in market prices, to provide and administer paid plans, and to keep the service secure and working. Under the UK/EU GDPR our lawful bases are performance of a contract (running the product for you) and legitimate interests (keeping it secure and diagnosing faults).

We do not use your records for advertising, we do not sell or rent them, and we do not share them for anyone else's marketing.

4. What stays on your device

Some things deliberately never reach our servers:

• Display preferences. Theme, the advanced-stats toggle, the tax-report toggle, and pricing presets are per-device settings held in local storage.
• The offline queue. Deals you enter without a connection are held in your browser's on-device database until they sync. Logging out or deleting your account clears it.

We use no cookies for tracking. The only client-side storage we rely on is what is needed to keep you signed in and to hold the preferences above.

5. Camera and permissions

Sleevz asks for camera access for three features: scanning a QR code to record a deal, scanning a graded slab's label, and scanning a raw card's face. If you decline the permission, all three simply fall back to typing the details in by hand. No photo taken by any of the scanners is saved to your device or your photo library.

QR scanning sends nothing. Frames are decoded on your device, in the live preview, and discarded immediately.

Slab scanning sends one photo of the slab's label. A graded slab has its card's year, set, name, number, and grade printed on the label beside the barcode. When you scan one, we send a single still image of that label so the printed text can be read back and filled into the form for you, instead of you typing it. That image shows the label, not you and not your surroundings; it is used for that one reading and is not kept as a picture. What we do keep is the text read from it — the card's name, set, year, number, and grade — stored against the slab's certification number so nobody, including you, has to have the same slab read twice.

Card scanning sends one photo of the card's face. Scanning a raw, ungraded card reads its printed name and collector number so we can look the card up in the catalogue and show you a short list of real cards to pick from. Your device tries to read it first, and a photo is sent only when that reading is too thin to search with. That image is used for the one reading and is not kept — nothing about a card scan is stored on our servers at all.

Both readings are done by a third-party service on our behalf; see section 6. If it is unavailable, a slab scan still fills in the certification number and a card scan falls back to the card-name search box, and you type the rest, exactly as before.

When a slab scan succeeds, the certification number alone — not an image — may also be sent to the relevant grading company to look up the card's identity. See section 6.

6. Who else sees it

We share data only with the providers that make the product run. Each is listed with what it actually receives.

Price and certification lookups are about cards, not about people: the request carries the card or cert being looked up and nothing identifying you or your account.

Beyond these providers, we disclose data only where we are legally required to, or where it is necessary to establish or defend a legal claim. If Sleevz is ever involved in a merger or acquisition, we will give notice on this page before your data becomes subject to a different policy.

7. Shared accounts

Sleevz lets an account owner invite other people into one shared workspace. Everyone in a workspace can see all of that workspace's records — that is the point of the feature. Before you accept an invitation, understand that the account owner can see everything you enter there, and that the records belong to the workspace rather than to you individually. Invitation links are single-use and expire after seven days.

8. How long we keep it

We keep your records for as long as your account exists, because a ledger is only useful with its history intact. When you delete your account, the data described in section 9 is removed from our live database immediately. Routine encrypted backups may retain copies for up to 30 days before they age out, and provider request logs age out on their own retention schedules, typically within 30 days.

Stripe retains payment and transaction records under its own legal, fraud-prevention, and financial-record obligations. Those records may remain after you delete Sleevz even though they are no longer attached to a live Sleevz workspace.

9. Deleting your account

You can delete your account yourself, at any time, without contacting us. There are two places to do it:

• In the app — Settings, then Delete account at the bottom of the page.
• On this site — sign in, then your account page, then Delete account.

Both routes do the same thing and ask you to type DELETE to confirm. Before you confirm, the app tells you exactly what will be removed.

What deletion removes:

• Your login and authentication record.
• Your inventory, transactions, cost-basis history, shows, expenses, consignment partners, and price alerts.
• Any invitations you created.
• The app's local data on the device you delete from.

Two things to know before you do it:

• It is permanent. Deleted records cannot be restored or voided back. If you want a copy of your books, export to Excel first — the app offers this from Settings.
• Shared workspaces behave differently. If you share an account with other people and you are not its last owner, deleting removes you and your login, and the workspace's records stay with the remaining members — they are the team's books. If you are the last owner, deleting removes the entire workspace and everyone else loses access to it. The app states which of these applies to you before you confirm.

We retain nothing after deletion except what backup and log expiry in section 8 covers, payment records kept by Stripe under its own legal obligations, and anything we are legally obliged to keep.

10. Your rights

Depending on where you live, you have rights over your personal data. We honour these requests regardless of where you live:

• Access — get a copy of what we hold. The Excel export in Settings gives you your records directly; email us for anything it does not cover.
• Correction — fix inaccurate data. Most of it is editable in the app.
• Deletion — see section 9, which you can do yourself.
• Portability — the Excel export is a standard, machine-readable format.
• Objection and restriction — ask us to stop or limit a particular use.

If you are in California: we do not sell or share personal information as the CCPA/CPRA define those terms, and we have not done so in the preceding twelve months. We will never discriminate against you for exercising a privacy right.

Email privacy@sleevz.app to exercise any of these. We reply within 30 days. If you are in the UK or EU and are unhappy with our response, you may complain to your national data protection authority.

11. Security

Traffic is encrypted in transit with TLS, and data is encrypted at rest by our database provider. Passwords are stored as salted hashes. Every account is isolated at the database level by row-level security, so one account cannot read another's rows even if a client tried. Server-side keys are never present in the app you download.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will notify affected users and the relevant regulator as the law requires.

12. Children

Sleevz is a business tool for card vendors and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, email us and we will delete it.

13. Where data is processed

Our providers operate data centres in the United States, and your data is processed there. If you are in the UK or EU, this is an international transfer; it is covered by the Standard Contractual Clauses our providers maintain.

14. Changes to this policy

If we change this policy we will update the "last updated" date at the top. For a change that materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect — we will not quietly rewrite this page and hope you don't notice.

15. Contact

Questions, requests, or complaints: privacy@sleevz.app.