Last updated: 15 September 2026
Card Vault is operated by Drakopoulos N. Panagiotis Aias, an individual based in Greece ("we", "us", "the controller"). For any question about this policy or your personal data, contact us at drakopoulos.aj@yahoo.com.
Account data: the email address and password you sign up with. Your password is never stored in plain text — it is hashed by our authentication provider, Supabase, and we never see it.
Content you enter: the details of your card collection and transactions — player names, teams, leagues, seasons, manufacturers, sets, parallels, serial numbers, card numbers, grading, and purchase/sale prices and dates, along with any "break", "batch", or buyer/seller details you add. This is the data the app exists to store for you; we do not collect it for any purpose beyond providing the service back to you.
We don't collect payment card numbers, government ID numbers, location data, or any data from third-party trackers or advertising networks. Card Vault does not use analytics or advertising cookies. Your session is kept using your browser's local storage rather than tracking cookies.
We process your account data to create and secure your account, and we process your collection data solely to store and display it back to you and to compute the statistics you see in the app (cost, profit/loss, etc.). This processing is necessary to perform the contract you enter into by creating an account (GDPR Article 6(1)(b)), and, for basic security logging, on the basis of our legitimate interest in keeping the service safe (Article 6(1)(f)).
Your data is stored and processed by our infrastructure providers: Supabase (database and authentication) and Vercel (application hosting). We don't sell, rent, or share your data with advertisers or data brokers. These providers may process data in locations outside Greece or the EEA; both offer GDPR-compliant safeguards for such transfers (including standard contractual clauses) — see their own privacy policies for details: Supabase & Vercel.
Every account's data is isolated at the database level — our database enforces row-level security so that no account can read or write another account's data, even in the event of an application bug. All traffic is encrypted in transit (HTTPS), and we publish security headers (HSTS, X-Frame-Options, and others) to harden the site against common web attacks.
We keep your data for as long as your account is active. If you delete your account from the Account page in the app, your account and every card, break, and batch you've logged are permanently deleted immediately — this cannot be undone. If you'd rather we delete it for you, email us at the address above and we'll do it within 30 days.
Under GDPR, you have the right to:
Card Vault is not directed at, and is not intended for use by, anyone under the age of 16.
If we make material changes to this policy, we'll update the date at the top of this page. Continued use of Card Vault after a change means you accept the updated policy.