Privacy policy

The short version

Sports Card Vending does not sell personal information. Vendors can create accounts, mark shows, and optionally upload inventory CSVs. Raw inventory files and account email addresses are private. Vendor profile details, marked shows, and organized inventory are public only where the vendor-facing controls say they will be shared. Community discussions and replies are public.

Information collected

Cloudflare processes standard technical information needed to deliver and protect the site, such as IP address, request time, browser details, requested URL, and security signals. Sports Card Vending may use aggregate traffic tools such as Google Analytics or Microsoft Clarity when they are configured.

If you email the editorial desk, we receive the address, message, and attachments you choose to send. We use them to answer the message, evaluate a correction or lead, and maintain ordinary business records.

Vendor accounts store an email address, password-derived security data, business and display names, city and state, an optional website, selected shows, session records, and any inventory the vendor chooses to upload. Passwords are not stored in readable form. Account records also include email verification time, agreement version and acceptance time, age confirmation, and password-change time.

Community records include public discussions, replies, reactions, follows, and profile attribution. Reports to moderators include the reporting account, reason, optional explanation, and moderation status. Reports are not public.

Account email

Account verification, password reset, and security notices are delivered through Cloudflare Email Service. The recipient address, sender, message content, and delivery metadata are processed by Cloudflare for that purpose. Verification and reset tokens are random, stored in hashed form in Cloudflare D1, expire, and work once.

Inventory processing

Raw CSVs are stored in a private Cloudflare R2 bucket. Processing runs from a Cloudflare Queue. To understand an unfamiliar spreadsheet, up to five sample rows and the column headers are sent to Google's Gemini Flash. Requests use Cloudflare AI Gateway when it is available and fall back to Google's API if the gateway is unavailable. Gemini proposes a column map; application code validates that map and normalizes the rows before saving organized inventory in Cloudflare D1.

Inventory is private by default. A vendor can explicitly choose public organized inventory during upload. The raw CSV is never published.

Cookies and local storage

The theme selector stores a light, dark, or automatic preference in your browser. The private editorial area uses a signed session cookie after an administrator logs in. Vendor accounts use a separate secure session cookie that can be revoked on logout. Analytics providers may set or read identifiers according to their own policies when analytics is enabled. Analytics and session replay are disabled on vendor and admin pages and other account-security pages. You can block or clear browser storage through your browser.

Affiliate and external links

Some links contain an affiliate identifier. When you follow one, the merchant may receive the referring page, link parameters, browser information, and transaction data under its own privacy policy. Amazon and other merchants decide what they collect after you leave this site. Using a normal non-affiliate link directly to the merchant is always an option.

Retention and choices

Infrastructure and analytics providers keep data according to their configured retention periods. Vendor inventory remains until it is replaced or deleted, and account records remain until the account is deleted or retention is otherwise required. Deleting an account removes the vendor profile and private account data. Public community contributions may remain without the profile attribution so discussions do not break. Open moderation records may be retained long enough to investigate abuse and protect users. Editorial email is retained only as long as it remains useful for correspondence, corrections, legal obligations, or ordinary business records.

To ask what information you sent us, request deletion of an editorial email, or raise a privacy question, contact hello@sportscardvending.com. We may need to retain limited records when required by law or needed to protect the site and its users.

Operator and changes

Sports Card Vending is published by Particularly Good LLC. This page will be updated when the site's data practices materially change, with a new effective date shown at the top.