Privacy policy

Who is responsible for your data

Chad, trading as Valdro, 43 Cutlers Walk, Rotherham, S66 1BT decides how your personal data is used (the “controller” under UK data protection law). Contact us about anything in this policy at support@valdro.app.

What we collect

• Your account: email address, the name you give (optional), and your password, which we store only as a one-way scrambled form we can’t read. If you add fingerprint or face sign-in, we keep only a public key from your device, never your fingerprint or face.
• Your collection: card photos you take or upload, the cards in your vault, prices paid, sales and notes you add, watch lists and alerts.
• Sign-ins and security: when and on what kind of device you signed in (for example “iPhone, Safari”), so you can see and end sign-ins in Settings. For security records we keep a scrambled form of your internet address, enough to tell if two visits came from the same place but not where.
• Your plan: which plan you’re on, and the customer and subscription references Stripe gives us. Stripe holds your card details; we never see them.
• eBay, if you connect it: a key that lets the app list and manage items for you, stored encrypted. We don’t receive your eBay password.
• Phone alerts, if you turn them on: the address your phone gives us for sending notifications.
• Listing on eBay, if you use it: the item details and the postcode you enter for where the card is, sent to eBay with the listing.
• Your agreement when you subscribe: that you asked for the plan to start straight away and confirmed you’re 18 or over, with the time.
• Usage: how many scans and price searches you use, and what they cost us, to apply plan limits.
• The waitlist: if you join it, your email address.

Why we use it, and our legal basis

• To run your account and the features you use, including taking payment for a plan. Basis: our contract with you.
• To keep accounts and the app secure, stop abuse and apply fair-use limits. Basis: our legitimate interest in a safe, working service.
• To improve prices for everyone using anonymous, combined figures (for example how much a card sells for). This includes the prices of your own deals: what you sell a card for, and what you pay for one, count towards that card’s value for all members (at most one of yours per card each month). Other members never see these prices one by one, or your name, account or listings. The owner can see them, to run the service. It’s on unless you turn it off in Settings › Your prices; turning it off takes your past prices back out. Basis: legitimate interest.
• Phone alerts and the waitlist. Basis: your consent, which you can withdraw at any time (turn alerts off in Settings, or email us).
• Keeping payment records as tax law requires. Basis: legal obligation.

Who we share it with

We use these services to run Valdro. They process data for us under their data processing terms:

• Vercel hosts the app and keeps your card photos in private storage (through the app, only you and anyone you share them with can see them).
• Neon hosts the database.
• Anthropic and Google read card photos and search for sold prices. They receive the photo or card details, not your name or email.
• Stripe takes payments.
• Resend sends emails such as password resets and trial reminders.

If you use these features, these companies handle the data under their own terms:

• eBay, if you connect your account or list a card.
• Your browser’s push service (Google, Apple or Mozilla, depending on your phone or browser) delivers phone alerts. It carries the alert, encrypted.

Price and certificate lookups (eBay, Card Hedge, SportsCardsPro, PSA) send card details or certificate numbers only, nothing about you. Match-day news (API-Football) is looked up by player name only. Each Monday we email a summary of your own vault (“Your vault this week”); turn it off in Settings › Emails or from the link in the email. If you share a display case (Ultimate), anyone with its link sees that case's card photos, names and grades, and values only if you chose to show them; stop sharing and the link stops working. We don’t sell your data or share it for advertising. We’d share it with others only if the law requires it.

Data outside the UK

Some of these providers process data in the United States. Where that happens, transfers are covered by the UK’s approved safeguards (the UK–US data bridge, or the UK’s international data transfer agreement or addendum).

How long we keep it

• Your account and collection: until you ask us to delete your account.
• Ended sign-ins: 30 days. App logs: 90 days. Password reset links: 1 day.
• Payment records: 6 years, as UK tax law requires.
• Security records of account changes (an account number and what changed; when you change your email, the new address is recorded so the change can be undone and checked): kept so changes can be checked later.
• Waitlist emails: until you’re invited or ask us to remove yours.
• If you had a free trial and later delete your account, we keep a scrambled form of your email (not the email itself) only so the same email can’t start another free trial.

Cookies and storage on your device

We use a few small cookies, all needed for the app to work, so there’s no cookie banner: one keeps you signed in, one is set for a few minutes while you connect eBay (to check the sign-in started on your device), and a couple remember display choices such as list or grid view and whether you’ve seen the welcome guide. The app also saves settings such as light or dark mode on your device. We don’t use advertising or tracking cookies, or third-party analytics.

Your rights

You can ask us to:

• send you a copy of your data;
• correct something that’s wrong;
• delete your account and data (you can also do this yourself with Delete my account in Settings — see how to delete your account);
• stop or limit some uses of your data, or object to them;
• give you your data in a format you can take elsewhere.

Email support@valdro.app from the address you sign in with. We’ll reply within one month. It’s free.

If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

Connections to the app are encrypted. Each account can only see its own collection, enforced by the database itself. Passwords are stored scrambled and eBay keys encrypted, and sign-ins can be ended from Settings.

Children

Valdro isn’t for children under 13. If you think a child under 13 has an account, email us and we’ll delete it.

Changes to this policy

If we change how we use your data in a way that matters, we’ll tell you in the app or by email before it happens. The date at the top shows the latest version.