Cardinal Privacy Policy

Effective Date: 2026-06-23
Last Updated: 2026-06-23

This Privacy Policy describes how Cardinal Grade Technologies, Inc. ("Cardinal," "we," "us," or "our") collects, uses, and shares information when you use the Cardinal mobile application (the "App").

1. Who We Are

Cardinal is operated by Cardinal Grade Technologies, Inc., a Delaware corporation:

Cardinal Grade Technologies, Inc.
16192 Coastal Highway
Lewes, Delaware 19958
United States

If you have questions about this policy, contact us at [email protected].

2. What Information We Collect

2.1 Card Photos and Images

When you scan a trading card, your device captures photos using the camera. These images are uploaded to our servers so our AI systems can grade the card. Card images are the core data that makes the App work. Images you capture are:

• Transmitted to our servers and stored there.
• Processed by our AI grading systems.
• Passed to third-party AI services when needed for card identification (see Section 4).
• Used to develop, train, test and improve our own AI models — see below.

Model training. We may use card images, and the grading and identification data derived from them, to develop, train, test and improve our AI models — in particular card detection, card identification, and grade prediction. This is how the App's accuracy improves over time. We do not sell card images, and we do not license them to third parties for their own model training.

If you use the App without signing in, card photos are not linked to your name, email address, or any other personally identifying information. If you sign in (see Section 2.5), your scans are associated with your account so they can sync across your devices.

2.2 Anonymous Install Identifier

When you first install the App, a random identifier (a UUID — universally unique identifier) is generated and stored on your device. This identifier:

• Is random and not derived from any hardware identifier, advertising ID, or personal information.
• Is sent with every request so our servers can associate the requests that make up a single scan and stay consistent across them.
• Resets when you uninstall and reinstall the App or clear app data.
• Is used to key analytics events and crash reports to a single install. For users who are not signed in, this is the only identifier analytics is keyed to, and it is not tied to a real identity.

This identifier is an opaque pseudonymous token, not personally identifiable information.

2.3 Device and Technical Metadata

When images are uploaded for grading, we also send technical metadata that helps improve grading accuracy:

• Device model and OS version
• App version
• Camera sensor data captured at the time of the scan (gyroscope, accelerometer, exposure settings, ISO, focus distance)
• Image quality scores computed on your device

This metadata is attached to the grading request and stored alongside the uploaded images.

2.4 App Activity and Crash Reports

The App uses third-party analytics and crash-reporting services. We collect:

• Usage events: In-app actions (e.g., scans started, grades viewed, screens visited), keyed to the anonymous install identifier described above.
• Crash logs: Technical diagnostic data about app crashes, including device type, OS version, app version, and a stack trace. Crash logs do not include card images or card-grading content.

Analytics and crash data are keyed to your anonymous install identifier or — if you are signed in — to your account identifier — an opaque code, never your name or email address. We do not send your name or email address to our analytics provider. Where we need to understand the behaviour of signed-in users, we combine analytics data with your account record inside our own systems. We do not collect advertising IDs, and we do not use analytics data for advertising.

2.5 Account Information (optional)

The App does not require an account. If you choose to sign in with Google or Apple, we receive and store:

• Email address — as provided by Google or Apple. If you use Sign in with Apple's "Hide My Email" feature, we receive a private relay address rather than your real address.
• Display name — as provided by Google or Apple, where available.
• Sign-in provider — which service you used to sign in.

This information is used to identify your account, sync your scans and collections across your devices, and understand how the App is used by signed-in users. We do not use it for advertising, and we do not sell it.

You can delete this information at any time by deleting your account in the App (see Section 7).

3. How We Use Your Information

We do not use any data for advertising or sell any data to third parties.

4. How We Share Your Information

We do not sell your data. We share data only with service providers necessary to operate the App:

4.1 Cloud Infrastructure and Hosting

Card images and job metadata are stored and processed on third-party cloud infrastructure. These providers act as data processors for Cardinal and process the data only on our instructions.

4.2 Card Identification Services

In some cases — for example when a card cannot be identified on your device — we send the card image to one or more third-party AI services for identification. These services receive the card image and return card identity information (name, set, number). They do not receive your name, email address, or anonymous install identifier. Where a card is identified on your device, no image is sent for that match.

4.3 Market Pricing Data

Card market pricing is sourced from third-party pricing data providers. Cardinal queries pricing data using the card's identity (game, set, card number). No card images or personal identifiers are sent to pricing providers.

4.4 Analytics, Crash Reporting and Sign-In

We use third-party analytics and crash-reporting services. Events are keyed to the anonymous install identifier or, for signed-in users, to an opaque account identifier — never to your name or email address.

If you sign in, our authentication provider holds your account credential and the profile information (email address and display name) supplied by Google or Apple. That identity comes from Google or Apple in the first place; we do not pass it on to any other party.

4.5 Other Disclosures

We may disclose information if required by law, legal process, or to protect the rights and safety of Cardinal, our users, or the public.

5. Data Retention

• Card images and grading data: Retained on our servers until you request deletion (see Section 7).
• Images used for model training: Where an image has been included in a training dataset, copies may be retained for as long as we maintain that dataset, and characteristics learned from it persist in the trained model. See Section 7.
• App activity and crash logs: Analytics events are retained for up to 14 months; crash logs are retained for up to 90 days.
• Account information (if you sign in): Retained until you delete your account. Deletion from our live systems is immediate; copies in analytics backups are removed within 30 days.
• Anonymous install ID: Persisted on your device until you uninstall the App or clear app data. We retain the identifier alongside your grading records for the retention period above.

6. Data Security

All data transmitted between the App and our servers is encrypted in transit using HTTPS/TLS. Card images are stored with server-side encryption at rest.

7. Your Choices and Data Deletion

Cardinal does not require you to create an account — the App works fully without one.

If you sign in with Google or Apple: you can delete your account at any time from within the App (Settings → Delete account). Deleting your account immediately removes your account and everything synced to it from our servers, including your name, email address, and your synced scans and collections. Scans and collections already saved on your device are kept, so you can carry on using the App as a guest.

A note on model training: deleting your account, or requesting deletion of your data, removes your card images and grading records from our active systems. It does not retract images that have already been incorporated into a training dataset or used to train a model — a trained model cannot be made to forget an individual image, and copies inside a training dataset are not linked back to your account. If this matters to you, contact us at [email protected] before scanning.

If you use the App without signing in: your data is associated with an anonymous install identifier. Uninstalling the App clears that identifier from your device. To request deletion of card images and grading data associated with your install identifier, contact us at [email protected] with the phrase "data deletion request." We will delete the associated data within 30 days.

8. Children's Privacy

The App is not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If you believe a child has submitted information through the App, contact us at [email protected] and we will delete it.

9. International Users

Cardinal is operated from the United States, and your information is processed in the United States. If you are located in the European Economic Area, the United Kingdom, or California and wish to exercise applicable data-protection rights (such as access, correction, or deletion), contact us at [email protected] and we will respond as required by applicable law.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the "Last Updated" date above. Continued use of the App after the updated policy is posted constitutes acceptance of the updated terms.

11. Contact Us

For privacy questions or data deletion requests, contact:

Cardinal Grade Technologies, Inc.
16192 Coastal Highway
Lewes, Delaware 19958
United States

Email: [email protected]

This privacy policy is hosted at: https://cardinal-app.ai/privacy