Loading page
Last updated: July 27, 2026
This Privacy Policy explains how KZAR & COMPANY LLC, a Michigan limited liability company ("KZAR", "we", "our", or "us"), collects, uses, stores, and shares information when you use Cardmatic. KZAR owns and operates Cardmatic, a software product and service offered under the Cardmatic brand, and is the business responsible for the personal information processed through the service.
Cardmatic helps collectors and sellers identify, organize, research, value, grade, publish, list, and fulfill trading-card inventory. Third-party services you choose to connect or visit have their own privacy policies and terms.
If you use Cardmatic without an account, guest cards and their images, scan counters, grading assessments, and grading submissions are stored in IndexedDB in that browser. Pre-grade drafts, interface preferences, and privacy choices may use local or session storage. Guest content is tied to that browser and device, is not recoverable by Cardmatic, and may be removed if you clear site data, use private browsing, reset the browser, or lose the device.
Browser-only storage does not mean every guest action stays on the device. When you request AI identification or grading, the submitted images and analysis instructions are sent to Cardmatic's server and the configured AI provider to return the result. Registering on the same browser can migrate supported guest cards into the new account; guest grading records and other local drafts may remain browser-only.
Cardmatic stores and processes the card images and information you upload or create so it can provide identification, catalog matching, pre-grading, inventory, valuation, listing, and public-sharing features. Identification and grading requests may be processed by configured AI services such as Google Gemini or xAI Grok. Prompts can include the submitted images and the context needed to perform the requested analysis.
AI results may be incomplete or incorrect and should be reviewed before you save, publish, price, or list a card. A Cardmatic pre-grade is not an official grade. You are responsible for having the rights and permissions needed to upload, store, publish, and use your images and listing content.
We share information with service providers and connected platforms when needed to operate Cardmatic, perform an action you request, run a feature you enable, deliver communications, or maintain the service. Depending on the features you use, these parties can include:
Disconnecting an integration stops future Cardmatic access when the disconnect succeeds, but it does not automatically delete data already retained by the provider or end remote listings and products. Review and complete any remote action before disconnecting.
Some outbound TCGplayer links are affiliate links. Cardmatic may receive a commission when a purchase qualifies. Cardmatic also loads an Impact affiliate-measurement script that can transform eligible links and record impressions under Impact's own privacy practices. The Cardmatic product-analytics control below does not disable this independent affiliate script; browser privacy protections may limit third-party storage or tracking.
Your saved collection is private by default. Information becomes public only when you publish an active Showcase and choose the cards and profile details to display. Public information can include your username or display name, profile and banner imagery, showcase slug, title, bio, selected card image and identity, rarity, condition, grade, market estimate, optional collection count or portfolio value, and showcase view count.
Active showcases can appear in Community and can be viewed through a public URL without signing in. You can unpublish a Showcase or change card visibility, but search engines, caches, marketplaces, and other people may retain copies of information that was previously public.
Depending on your location, we may process personal data to perform our contract with you, pursue legitimate interests such as security and product improvement, comply with legal obligations, and act on your consent where consent is required. You can withdraw consent for an optional activity without affecting processing that already occurred or processing supported by another legal basis.
We retain account, collection, grading, marketplace, order, automation, billing, and support data while your account is active or as needed to provide the service. We may retain limited records longer to meet legal, tax, accounting, fraud-prevention, dispute-resolution, rights-holder, and security obligations. Provider-side copies are governed by the provider's retention practices.
Incomplete OAuth attempts expire after 10 minutes, and incomplete social-account setup records expire after 20 minutes. Cardmatic removes expired records during new sign-in activity and the next scheduled retention pass.
Account deletion removes account-bound data handled by the in-app deletion workflow. It does not clear separate browser-only guest data on every device, delete content already sent to a connected service, erase third-party copies of public information, or necessarily remove feedback and legal records that must be retained without an account link. Backup copies and security logs may remain for a limited recovery or compliance period.
If Apple does not immediately confirm token revocation, Cardmatic retains the encrypted revocation credential in a retry record without the deleted account ID, email, or profile. The retry record is deleted after Apple confirms revocation.
Raw pseudonymous Cardmatic product-analytics events are scheduled for deletion after 190 days and are removed by automated cleanup while the service is running, or when service activity resumes. Aggregate reports may be retained longer when they no longer identify a browser or account.
We use reasonable administrative, technical, and organizational safeguards designed to protect information stored in Cardmatic. Measures may include access controls, password hashing, session protections, encryption in transit where supported, token handling, rate limits, and security logging. No system is completely secure, and we cannot guarantee absolute security.
Keep your credentials and devices secure, use a unique password, review connected accounts, and contact us if you believe your account or a marketplace connection has been compromised.
Cardmatic uses first-party cookies and browser storage to authenticate users, maintain sessions, remember interface and theme preferences, enforce limits, reduce duplicate events, and store guest data as described above. Disabling required cookies or browser storage can prevent parts of the app from working.
Cardmatic's first-party product analytics apply to guest activity only. A signed, HTTP-only first-party cookie holds random browser and session IDs; the session changes after 30 minutes of inactivity and the identity cookie can last up to 180 days. If a guest registers within the attribution window, Cardmatic records an aggregate conversion event without adding the new email, username, or account ID to the analytics record. Supported Global Privacy Control and Do Not Track signals disable this collection. An opt-out preference can last up to one year in this browser.
Raw IP addresses and user-agent strings are not stored in Cardmatic's product-analytics event rows. Separate security, rate-limit, server-log, and feedback processes can handle IP address, user agent, or hashes derived from them for the purposes described in this policy.
This choice applies to this browser and Cardmatic's first-party product analytics. Turning it off removes the random analytics identity cookie and keeps only an opt-out preference.
Cardmatic and its service providers may process data in countries other than your own. Those jurisdictions may have different data-protection laws. Contact us if you have questions about transfers or safeguards that may apply to your information.
Cardmatic is not directed to children under 13, and people under 13 may not use the service. We do not knowingly collect personal information from children under 13. Contact us if you believe a child under 13 has provided personal information so we can review and take appropriate action.
People ages 13–17 may use supervised, non-commerce features only with permission and active supervision from a parent or legal guardian. Paid subscriptions, marketplace connections, listings, sales, buyer and order data, and live pricing automation must be operated by an adult. We do not require a birth date for registration; instead, registration requires an age and guardian-permission representation. A parent or guardian may contact us about a minor's account or request review or deletion, subject to reasonable identity and authority verification. See the Terms of Service for the complete eligibility rules.
We may update this Privacy Policy as Cardmatic changes. If we make material changes, we will update the "Last updated" date and may provide additional notice in the app or by email when appropriate.
Cardmatic may display card names, set information, catalog images, marketplace links, pricing references, public collection images, or other catalog data to help users identify and manage trading cards. Cardmatic is not affiliated with, endorsed, sponsored, or approved by Nintendo, Creatures, Game Freak, or The Pokémon Company.
If you are a rights holder or authorized representative and believe content available through Cardmatic infringes your rights, misuses protected material, or should be removed or corrected, include the specific URL or content, your contact information, your relationship to the rights holder, and enough detail for us to review the request. We may remove, disable, or update content while evaluating it and may request more information.
Submit a dedicated rights-holder removal request or contact info@cardmatic.io.
Cardmatic is owned and operated by KZAR & COMPANY LLC, Waterford, Michigan, United States. For privacy questions, requests, or concerns, contact info@cardmatic.io. We will review and respond in accordance with applicable law and operational requirements.
For account, subscription, marketplace, and acceptable-use rules, review the Terms of Service.