Privacy Policy

1. Introduction

Obsidian Ridge Holdings LLC ("CardBase," "Company," "we," "us," or "our") operates the CardBase mobile application and website, including all related features and services (collectively, the "Service"). This Privacy Policy describes the categories of personal information we collect, the sources from which we collect it, how we use and disclose it, and the rights and choices available to individuals who use the Service.

This Privacy Policy applies to all users of the Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

If you are a resident of California or another U.S. state with a comprehensive privacy law, please also see Section 10, "Additional Disclosures for U.S. State Residents," below.

2. Information We Collect

2.1 Information You Provide

Account Information. When you register for a CardBase account, we collect your email address, password, name and/or business name, username, profile picture (if provided), and collector or vendor status. Passwords are stored using industry-standard cryptographic hashing and are not accessible to CardBase personnel in plaintext form.

Inventory and Transaction Data. The Service enables you to record and manage trading card inventory, trade records, show profit-and-loss data, and grading information (including data associated with third-party grading services such as PSA, CGC, BGS, and TAG). We collect the information you enter or upload in connection with these features.

Content You Submit. If you use the social features of the Service, we collect the posts, comments, and other content you submit, share, or post. This content may be visible to other users as described in Section 4.

Show Calendar and Event Information. We collect information you provide when creating or registering for show calendar entries, including event details and related information.

Communications. If you contact us directly — for example, through our support email or contact form — we collect the information contained in that communication, including your contact details and the content of your message.

Providing the information described above is generally optional, but declining to provide certain information (such as account credentials) may prevent you from using some or all of the Service.

2.2 Information Collected Automatically

Location Information. The Service uses precise or approximate location data to support features including the show calendar and vendor/card-show proximity tools. Location is collected only where you have granted location permission through your device settings. You may revoke this permission at any time through your device settings. Declining or revoking location permission will limit location-dependent features but will not otherwise restrict your use of the Service.

Technical and Log Information. In the ordinary course of operating our infrastructure, our servers automatically record limited technical information, including IP address, device and browser type, and request timestamps. This information is used for security, abuse prevention, and operational troubleshooting.

Affiliate Links. CardBase participates in the eBay Partner Network and other affiliate programs. Some links in the Service to third-party marketplaces, such as eBay and TCGplayer, are affiliate links, and CardBase may earn a commission when you make a purchase after following one. When you select an affiliate link, we record limited, non-identifying information about the click, such as the product, the page of the Service where the link appeared, and the price displayed. This record is not associated with your account, email address, or IP address. We do not include personal information in the links we send you to.

Cookies and Similar Technologies. The Service uses cookies, local storage, or similar technologies that are necessary to keep you signed in and to maintain basic functionality of the web and app experience. CardBase does not use these technologies for advertising, and the Service does not incorporate third-party analytics or crash-reporting software. When you follow an affiliate link to a third-party marketplace, that marketplace or its affiliate network (such as the eBay Partner Network) may place its own cookies or similar tracking technologies on your browser or device to attribute your purchase to CardBase. Those technologies are controlled by the third party and governed by its privacy policy, not this one. You can block or delete cookies through your browser or device settings. Doing so will not affect your use of CardBase, but it may affect your experience on third-party sites.

2.3 Information From Third Parties

If you use CardBase features that reference third-party grading or pricing data (such as PSA, CGC, BGS, TAG, or market pricing sources), information you associate with your inventory — such as certification numbers — may be used to retrieve or display publicly available information from those sources. We do not receive personal information about you from these sources beyond what you provide.

3. How We Use Information

We use the information described in Section 2 to:

• Provide, operate, and maintain the Service;
• Create and authenticate your account and secure your data;
• Operate core Service functionality, including inventory management, trade calculation, show profit-and-loss tracking, and the show calendar;
• Operate social features, including displaying user-submitted content and public profile information to other users;
• Respond to your communications and provide support;
• Detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service;
• Comply with applicable law and enforce our agreements.

We do not use personal information for targeted or interest-based advertising, and we do not sell personal information, as that term is defined under applicable law.

4. How We Share Information

We disclose personal information only under the following circumstances:

Service Providers. We share information with infrastructure and hosting providers that support the operation of the Service. These providers are contractually restricted from using personal information for any purpose other than providing services to CardBase.

Other Users. Certain information is inherently public within the Service, including your username, profile picture, business name (if provided), and content submitted through social features. This information is visible to other users as a function of normal Service operation. If you list inventory for trade or sale, information about that inventory may similarly be visible to other users.

Legal Obligations. We may disclose information where required to comply with applicable law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of CardBase, our users, or the public.

Business Transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality obligations.

As You Direct. We may share information with third parties at your request or direction.

5. Data Retention

We retain personal information for as long as an account remains active. Upon account deletion, personal information is deleted from our production systems immediately, except where retention is required to comply with a legal obligation, resolve a dispute, prevent fraud, or enforce our agreements.

6. Account Deletion

You may delete your CardBase account at any time from within the Service under Settings > Account > Delete Account. Account deletion removes the associated profile, inventory data, and social content in accordance with Section 5.

7. User-Generated Content and Moderation

The Service's social features permit users to submit content and interact with other users. You may report content or block other users directly within the Service. Reported content and accounts are reviewed, and CardBase may remove content or restrict account access where a violation of our community guidelines or Terms of Service has occurred.

8. Children's Privacy

The Service is not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete that information. If you believe a child has provided us with personal information, contact us using the information in Section 12.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, or disclosure, including cryptographic password storage and secured infrastructure. No method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of information transmitted to or stored by the Service.

10. Additional Disclosures for U.S. State Residents

Residents of California and certain other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, and others) may have the following rights with respect to their personal information, subject to applicable legal exceptions and thresholds:

• Right to Know/Access. The right to confirm whether we process your personal information and to request access to the specific pieces of information we hold about you.
• Right to Correct. The right to request correction of inaccurate personal information we maintain about you.
• Right to Delete. The right to request deletion of personal information we have collected from you, subject to the exceptions described in Section 5.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.

CardBase does not sell personal information and does not use personal information for cross-context behavioral or targeted advertising. Accordingly, no opt-out mechanism for the sale or sharing of personal information is required at this time.

Do Not Track. The Service does not currently respond to "Do Not Track" browser signals, as no common industry standard for such signals has been adopted.

11. Changes to This Policy

We may amend this Privacy Policy from time to time. Material changes will be communicated through the Service or by other reasonable means prior to taking effect. Continued use of the Service following the effective date of any revised Privacy Policy constitutes acceptance of the changes.