Privacy Policy
Last updated: November 1, 2026
Overview
Conduit ("we", "us") is a Pokémon card collection tracker at conduitcards.com and in the Conduit apps. It is an independent app run by its founder in Indiana, USA. This policy explains what we collect, why, who it goes to, and how to see or delete it. We don't sell your data and we don't use it for advertising.
What you give us
- Account: your email address and password. Passwords are stored hashed by our database provider; we never see them.
- Signing in with Apple or Google: instead of a password, we get your email address (with Apple you can choose a private relay address), your name, an account ID, and with Google your profile picture link. With Apple we also keep a sign-in token so we can tell Apple to disconnect Conduit when you delete your account. We don't get your Apple or Google password or anything else from those accounts.
- Birthday: asked once at sign up (on the handle screen if you sign up with Apple or Google) to check you're old enough. We don't store it.
- Profile: your username, display name, avatar, the badge you feature, whether your profile is public, who you follow, the badges you earn, and, if you tell us, where you heard about Conduit.
- Binders: the binders you create, the cards you mark as owned, and any price you enter as paid.
- Takes: short posts you write about cards, the takes you agree with, and reports and blocks you make.
- Emails you sign up for: your product update preference and, if you join, the e-Reader Archive list.
- Feedback: what you send through the feedback form, plus an email address if you add one.
What we collect automatically
- Usage analytics: page views and in-app actions (for example, marking a card or creating a binder) through Vercel Analytics, plus page speed through Vercel Speed Insights. These use no cookies and aren't tied to your account.
- Server logs: your IP address and browser type reach our host with each request. We use them briefly to keep the service running and to stop abuse, and we don't store them with your account.
- Sign-in cookies: keep you signed in. They aren't used for tracking.
- On your device: your theme, recent searches, and a copy of your binders and card art so they work offline. Changes you make offline are kept on the device until they sync. Signing out or deleting your account clears them.
We don't track you across other apps or websites, so browser "Do Not Track" signals don't change anything here.
What other people can see
- Public profile: off unless you turn it on. When on, anyone can see your username, display name, avatar, badges, follows and takes, and search engines can list it.
- Takes: always public, and they show your username and avatar even if your profile is private. Anyone can share a take, including as an image.
- Shared binders: if you share a binder, anyone with the link sees which cards you have. Prices you paid are never shown.
How we use it
- Run your account, binders, profile and takes
- Send account emails (confirmation, password reset, deletion) and the updates you opted in to
- Keep Conduit safe: rate limits, spam filters and reviewing reported takes
- Fix bugs and decide what to build next, using analytics
How long we keep it
- Your account and everything saved to it: until you delete your account. Deleting removes it right away, and database backups expire within 30 days.
- Takes you delete: hidden from everyone at once, and fully removed when your account is deleted.
- Feedback: until we've dealt with it, or until you delete your account.
- e-Reader Archive list: until you unsubscribe.
Your choices and rights
- Delete: in Settings, or see how to delete your account without the app.
- See or download: export any binder as a CSV in the app, or email us for a copy of everything we hold about you.
- Correct: edit your profile in Settings, or ask us.
- Emails: turn product updates off in Settings, and every e-Reader email has an unsubscribe link.
- Profile: make it private any time in Settings.
Email hello@conduitcards.com for anything else. We reply within 30 days.
Children
Conduit is for people 13 and older, and sign up asks for your birthday to check. We don't knowingly collect data from children under 13. If we learn an account belongs to a child under 13, we delete it and its data. Parents can email hello@conduitcards.com and we'll act within 7 days.
Security
All traffic is encrypted (HTTPS). Database rules stop accounts from reading each other's private data, and sign-in and reset requests are rate limited. No system is perfect: if a breach ever affects your data, we'll tell you and the authorities the law requires, promptly.
If you're outside the US
Conduit is run from the United States and your data is stored there. If privacy laws like the GDPR apply to you, we rely on providing the service you asked for (your account and binders), our legitimate interest in keeping Conduit safe and improving it (security and analytics), and your consent (optional emails, which you can withdraw any time). You can ask us to access, correct, delete or export your data, or object to how we use it, and you can complain to your local data protection authority.
Changes
If we change this policy in a way that matters, we'll email registered users before it takes effect. The date at the top shows the latest version.
Contact
Questions or requests: hello@conduitcards.com.