Privacy Policy

PKLVault ("we", "us") provides an inventory, sales, and trade tracking platform for trading card collectors and vendors. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By creating an account or using PKLVault, you agree to the practices described in this document.

We collect only what's needed to operate your vault:

• Account data: email, username, display name, and password hash.
• Inventory data: cards you add, photos you upload, prices, condition, tags, and notes.
• Activity data: sales, trades, finance entries, and scan history you create.
• Device data: browser type, IP address, and basic diagnostics for security and reliability.

• To operate core features: inventory, scanning, sales, trades, and public shop pages.
• To authenticate sessions and protect your account.
• To improve performance, fix bugs, and prevent abuse.
• To communicate important service and security updates.

We do not sell your personal information to third parties.

When you use the AI photo scan feature, the image is transmitted to our AI provider solely to identify the card. We do not use your photos to train third-party models. Image content remains associated with your account.

Items you mark as public in your shop or share via a public link are visible to anyone with that URL. Everything else is private to your account. You can unpublish a card or rotate share links at any time.

We rely on a small set of trusted infrastructure providers:

• Cloud hosting & database for storage and authentication.
• AI gateway for card recognition.
• Pokémon TCG API for card metadata and pricing reference.

These providers process data on our behalf under contractual data-protection terms.

Data is encrypted in transit (TLS) and at rest. Passwords are hashed. Access to production data is restricted, logged, and limited to authorized personnel. No system is perfectly secure — if you suspect unauthorized access, contact us immediately.

We retain your data for as long as your account is active. When you delete your account, your inventory, photos, and personal data are removed within 30 days, except where retention is required by law or for fraud prevention.

You can at any time:

• Access and export your inventory data.
• Correct your profile information from Settings.
• Delete individual records or your entire account.
• Request a copy of personal data we hold about you.

To exercise these rights, email us at the address below.

PKLVault is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email. The "Last updated" date at the top reflects the most recent revision.