Cardinal Privacy Policy

Effective Date: 2026-06-23
Last Updated: 2026-10-18

This Privacy Policy describes how Cardinal Grade Technologies, Inc. ("Cardinal," "we," "us," or "our") collects, uses, and shares information when you use the Cardinal mobile application (the "App") and when you visit our website at cardinal-app.ai (the "Site").

1. Who We Are

Cardinal is operated by Cardinal Grade Technologies, Inc., a Delaware corporation:

Cardinal Grade Technologies, Inc.
16192 Coastal Highway
Lewes, Delaware 19958
United States

If you have questions about this policy, contact us at support@cardinal-app.ai.

2. What Information We Collect

2.1 Card Photos and Images

When you scan a trading card, your device captures photos using the camera. These images are uploaded to our servers so our AI systems can grade the card. Card images are the core data that makes the App work. Images you capture are:

• Transmitted to our servers and stored there.
• Processed by our AI grading systems.
• Passed to third-party AI services when needed for card identification (see Section 4).
• Used to develop, train, test and improve our own AI models — see below.

Model training. We may use card images, and the grading and identification data derived from them, to develop, train, test and improve our AI models — in particular card detection, card identification, and grade prediction. This is how the App's accuracy improves over time. We do not sell card images, and we do not license them to third parties for their own model training.

If you use the App without signing in, card photos are not linked to your name, email address, or any other personally identifying information. If you sign in (see Section 2.5), your scans are associated with your account so they can sync across your devices.

2.2 Anonymous Install Identifier

When you first install the App, a random identifier (a UUID — universally unique identifier) is generated and stored on your device. This identifier:

• Is random and not derived from any hardware identifier, advertising ID, or personal information.
• Is sent with every request so our servers can associate the requests that make up a single scan and stay consistent across them.
• Resets when you uninstall and reinstall the App or clear app data.
• Is used to key analytics events and crash reports to a single install. For users who are not signed in, this is the only identifier analytics is keyed to, and it is not tied to a real identity.

This identifier is an opaque pseudonymous token, not personally identifiable information.

2.3 Device and Technical Metadata

When images are uploaded for grading, we also send technical metadata that helps improve grading accuracy:

• Device model and OS version
• App version
• Camera sensor data captured at the time of the scan (gyroscope, accelerometer, exposure settings, ISO, focus distance)
• Image quality scores computed on your device

This metadata is attached to the grading request and stored alongside the uploaded images.

2.4 App Activity and Crash Reports

The App uses third-party analytics and crash-reporting services. We collect:

• Usage events: In-app actions (e.g., scans started, grades viewed, screens visited), keyed to the anonymous install identifier described above.
• Crash logs: Technical diagnostic data about app crashes, including device type, OS version, app version, and a stack trace. Crash logs do not include card images or card-grading content.

Analytics and crash data are keyed to your anonymous install identifier or — if you are signed in — to your account identifier — an opaque code, never your name or email address. We do not send your name or email address to our analytics provider. Where we need to understand the behaviour of signed-in users, we combine analytics data with your account record inside our own systems. We do not collect advertising IDs. Analytics data about how the App and this website are used may be used to measure and improve our own marketing, including advertising.

2.5 Account Information (optional)

The App does not require an account. If you choose to sign in with Google or Apple, we receive and store:

• Email address — as provided by Google or Apple. If you use Sign in with Apple's "Hide My Email" feature, we receive a private relay address rather than your real address.
• Display name — as provided by Google or Apple, where available.
• Sign-in provider — which service you used to sign in.

This information is used to identify your account, sync your scans and collections across your devices, and understand how the App is used by signed-in users. We do not use it for advertising, and we do not sell it.

You can delete this information at any time by deleting your account in the App (see Section 7).

2.6 Website Analytics

This section is about the website at cardinal-app.ai, not the App.

When you visit our website we use Google Analytics to understand how the site is used. It sets cookies in your browser holding a randomly generated identifier, which is not linked to your name, your email address, or any account you may have with us.

We collect pages viewed, how you reached the site, what you click, approximate location from your IP address, and general device and browser information. If you send us a message using the contact form, we record that a message was sent and a broad category for it — never your name, email address or the message itself, which reach us by email.

If you follow a link from here to Google Play, that link identifies our website as the source of the visit.

This data is held in the same Google Analytics property as the App's usage data, retained for 14 months. To opt out, block cookies for this site in your browser settings.

2.7 Website Tools

The centering calculator on our website sends the card photo you choose to our servers to measure the card's borders. The photo is processed in memory to return the measurement and is not stored or logged; we keep only counts and timings of requests. The worth-grading calculator sends the prices you enter to our servers to calculate the results; they are not stored. Your IP address is used to limit how often the tools can be used.

3. How We Use Your Information

We do not sell any data to third parties. As described in section 2.4, analytics data about how the App and this website are used may be used to measure and improve our own marketing, including advertising.

4. How We Share Your Information

We do not sell your data. We share data only with service providers necessary to operate the App and the Site:

4.1 Cloud Infrastructure and Hosting

Card images and job metadata are stored and processed on third-party cloud infrastructure. These providers act as data processors for Cardinal and process the data only on our instructions.

4.2 Card Identification Services

In some cases — for example when a card cannot be identified on your device — we send the card image to one or more third-party AI services for identification. These services receive the card image and return card identity information (name, set, number). They do not receive your name, email address, or anonymous install identifier. Where a card is identified on your device, no image is sent for that match.

4.3 Market Pricing Data

Card market pricing is sourced from third-party pricing data providers. Cardinal queries pricing data using the card's identity (game, set, card number). No card images or personal identifiers are sent to pricing providers.

4.4 Analytics, Crash Reporting and Sign-In

We use third-party analytics and crash-reporting services. Events are keyed to the anonymous install identifier or, for signed-in users, to an opaque account identifier — never to your name or email address. Analytics for the Site are provided by Google Analytics, as described in Section 2.6.

If you sign in, our authentication provider holds your account credential and the profile information (email address and display name) supplied by Google or Apple. That identity comes from Google or Apple in the first place; we do not pass it on to any other party.

4.5 Other Disclosures

We may disclose information if required by law, legal process, or to protect the rights and safety of Cardinal, our users, or the public.

5. Data Retention

• Card images and grading data: Retained on our servers until you request deletion (see Section 7).
• Images used for model training: Where an image has been included in a training dataset, copies may be retained for as long as we maintain that dataset, and characteristics learned from it persist in the trained model. See Section 7.
• App activity and crash logs: Analytics events are retained for up to 14 months; crash logs are retained for up to 90 days.
• Website analytics: Analytics events from the Site are retained for up to 14 months. The _ga and _ga_* cookies set in your browser expire after up to two years, or sooner if you clear them.
• Account information (if you sign in): Retained until you delete your account. Deletion from our live systems is immediate; copies in analytics backups are removed within 30 days.
• Anonymous install ID: Persisted on your device until you uninstall the App or clear app data. We retain the identifier alongside your grading records for the retention period above.

6. Data Security

All data transmitted between the App and our servers is encrypted in transit using HTTPS/TLS. Card images are stored with server-side encryption at rest.

7. Your Choices and Data Deletion

Cardinal does not require you to create an account — the App works fully without one.

If you sign in with Google or Apple: you can delete your account at any time from within the App (Settings → Delete account). Deleting your account immediately removes your account and everything synced to it from our servers, including your name, email address, and your synced scans and collections. Scans and collections already saved on your device are kept, so you can carry on using the App as a guest.

A note on model training: deleting your account, or requesting deletion of your data, removes your card images and grading records from our active systems. It does not retract images that have already been incorporated into a training dataset or used to train a model — a trained model cannot be made to forget an individual image, and copies inside a training dataset are not linked back to your account. If this matters to you, contact us at support@cardinal-app.ai before scanning.

If you use the App without signing in: your data is associated with an anonymous install identifier. Uninstalling the App clears that identifier from your device. To request deletion of card images and grading data associated with your install identifier, contact us at support@cardinal-app.ai with the phrase "data deletion request." We will delete the associated data within 30 days.

To opt out of analytics on our website, see Section 2.6. Website analytics are separate from the App, and clearing or blocking cookies for cardinal-app.ai does not affect any data held about your use of the App.

8. Children's Privacy

The App and the Site are not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If you believe a child has submitted information through the App, contact us at support@cardinal-app.ai and we will delete it.

9. International Users

Cardinal is operated from the United States, and your information is processed in the United States. If you are located in the European Economic Area, the United Kingdom, or California and wish to exercise applicable data-protection rights (such as access, correction, or deletion), contact us at support@cardinal-app.ai and we will respond as required by applicable law.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the "Last Updated" date above. Continued use of the App or the Site after the updated policy is posted constitutes acceptance of the updated terms.

11. Contact Us

For privacy questions or data deletion requests, contact:

Cardinal Grade Technologies, Inc.
16192 Coastal Highway
Lewes, Delaware 19958
United States

Email: support@cardinal-app.ai

This privacy policy is hosted at: https://cardinal-app.ai/privacy