← The Card Investor

Privacy Policy

This Privacy Policy explains what information The Card Investor ("we," "us") collects, how we use it, and the choices you have. The Card Investor is operated by Davin Harris as a sole proprietor.

1. Information We Collect

We collect only what we need to run the Service:

• Account information — your email address, a display name you choose, and a hashed password. We never see or store your plaintext password.
• Subscription information — plan, status, renewal date, and a non-sensitive customer/subscription ID returned by our payment processor. We do not store full payment card numbers.
• Service usage — the cards you mark as "Cards I Collect" and any testimonials you submit, all stored in our database keyed to your account.
• Technical data — basic server logs (IP address, user agent, timestamp) that our hosting provider records for security and abuse prevention.
• Cookies and local storage — a session cookie keeps you logged in; browser localStorage caches your collection display so it loads instantly. We do not use third-party advertising trackers.

2. How We Use Your Information

• To create and manage your account and subscription.
• To deliver the picks, guides, and tools you signed up for.
• To process payments and refunds via our payment processor.
• To send transactional email — receipts, password resets, account or service notices. We do not currently send marketing email; if we ever do, you'll be able to opt out.
• To prevent abuse and enforce our Terms.
• To debug and improve the Service.

3. Service Providers (Sub-processors)

We rely on a small number of trusted vendors to run the Service. They process your data on our behalf and are bound by their own privacy commitments:

• Supabase — authentication and database hosting (US).
• Stripe — payment processing and subscription billing (US/global).
• Netlify — web hosting and content delivery (US).

We do not sell your personal information, and we do not share it with third parties for their own marketing.

4. Data Retention

We keep your account information for as long as you have an active account. If you delete your account, we delete the associated profile, collection, and session data within 30 days, except where we are required to retain billing or tax records (typically up to 7 years) or where retention is needed to resolve disputes or enforce our agreements.

5. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. You can exercise these rights at any time by emailing support@thecardinvestor.com. We do not discriminate against you for exercising your rights.

6. Children

The Service is not directed to children under 13, and we do not knowingly collect information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

7. Security

We use industry-standard practices — TLS in transit, hashed passwords, row-level security on our database — to protect your data. No system is perfectly secure. If we ever experience a breach that affects you, we will notify you in line with applicable law.

8. International Users

Our servers and service providers are located in the United States. By using the Service, you consent to your information being transferred to and processed in the US, which may have different data-protection laws than your country.

9. Changes

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and notify subscribers by email where appropriate.

10. Contact

Privacy questions or requests: support@thecardinvestor.com.