Privacy policy
This policy explains what we collect when you sell cards to us, why we hold it, who else sees it, and what you can ask us to do with it. It covers this website and the emails we send you about your lots.
What we collect
Everything below is given to us by you, in the course of selling us cards. We do not buy personal information from anyone, and we do not build profiles of you from outside sources.
- Your account: your email address, and a password if you made one. If you sign in with Google or Facebook instead, we receive your email address and basic profile details from them, never your password.
- Shipping details: the name, phone number and postal address we need to buy your prepaid label and to send cards back if you ask for them.
- Payout details: whether you want PayPal, Venmo or Cash App, and the handle or address to send it to. We never see or hold your bank details, card numbers, or the login to any of those services.
- Your lots: what you told us you were sending, your estimated counts, any notes you wrote, and the tracking number once your box is on its way.
- Photos and video: the images of your lot you upload with your ticket, the photo of your packed box, and anything you attach to a message.
- Scans of your cards: we photograph every card front and back, and record what each one is and what it was worth. This is the record of what you sent us.
- Messages: anything you write to us about a lot, and any question you submit to the FAQ.
How we use it
- To review your submission and decide whether to accept it.
- To buy and send you a prepaid shipping label, and to identify your box when it arrives.
- To scan, identify and price your cards, and to show you that breakdown.
- To pay you, and to keep a record of what was paid.
- To send cards back to you if you ask for them inside your send-back window.
- To email you about your lot as it moves: accepted, label sent, in transit, priced, paid.
- To answer you when you write to us.
- To keep our own accounting and tax records.
We do not use any of it to advertise to you, and we do not use it to make automated decisions about you.
What we don’t do
It is worth being specific, because much of this is unusual:
- We do not sell or share your personal information. Not for money, and not for anyone else’s advertising.
- We do not run analytics. There is no Google Analytics, no tracking pixel, no session recorder and no advertising SDK anywhere on this site.
- We do not set advertising or tracking cookies. See Cookies below for the only cookies we do set.
- We do not send you marketing email unless you have separately asked us to. The emails you get are about your own lots.
Who else sees it
We use a small number of outside services to run the business. They only ever get what they need to do their part, and none of them may use your information for their own purposes.
- Supabase: hosts our database, your account and your uploaded files.
- Porkbun: delivers the emails we send you about your lots.
- Google and Meta (Facebook): only if you choose to sign in with them. If you use an email and password, neither is involved.
- CardUploader: identifies and prices cards from their images. Card images are sent; nothing identifying you goes with them.
- Pirate Ship: buys your prepaid label. Your name and address go to them, and on to the carrier printed on the label (usually USPS), who needs them to deliver the box.
- YouTube: the packing tutorials on the packing page are embedded from YouTube’s no-cookie domain, which does not set tracking cookies unless you press play.
- Sentry: records technical details when something on the site breaks — the error, the page it happened on, and your browser type — so we can find and fix it. Cookies, IP addresses and anything you typed into a form are stripped before it is sent, and email addresses are removed from what remains. Your card images are never sent to them.
We will also hand over information if the law requires it: a subpoena, a court order, or a similar legal demand. If that ever happens we will tell you, unless we are legally prohibited from doing so.
How long we keep it
We keep your account, your lots and your card scans for as long as your account is open. The scans are deliberately permanent: they are your record of exactly what you sent us and what each card was worth, and we would rather you be able to go back and check.
If you close your account we delete your personal information, including your address, payout handle, photos and card scans. We keep the financial record of what we paid you (the amount, the date and the method) for as long as tax and accounting law requires, which is generally seven years. That record is kept because we are required to keep it, not because we want it.
How we protect it
Some specifics, rather than a promise that we take security seriously:
- Every table in our database enforces row-level security, so one seller’s account cannot read another’s. The rule is applied by the database itself, not by the website asking nicely.
- Your uploaded photos and card scans live in a private storage bucket. They are not publicly addressable, and links to them are short-lived and generated per request.
- Your payout amount is calculated by the database at the moment you accept it. The figure is never sent from your browser, so it cannot be tampered with in transit.
- Your payout method and handle are copied onto the payout record when you accept, so a later change to your profile cannot rewrite what was already agreed.
- Traffic between you and this site is encrypted.
No system is perfect, and we would rather say so than imply otherwise. If we ever discover a breach affecting your information, we will tell you and the relevant authorities as the law requires.
Your choices
Whoever and wherever you are, you can:
- See what we hold. Most of it is already on your profile and your lot pages. Ask us and we will send you the rest.
- Correct it. You can edit your address and payout details yourself at any time. Ask us about anything else.
- Delete it. Ask us to close your account and we will delete your personal information, keeping only the financial record described above.
- Take it with you. Ask and we will send you your lot history and card data in a portable format.
Write to privacy@viridian.cards and we will respond within 45 days. We will never charge you for asking, and we will never treat you differently for having asked.
If you live in California
The California Consumer Privacy Act gives you specific rights. You have all of them, and they are the same rights described above: to know what we have collected, to have it deleted, to have it corrected, and to receive a copy of it.
In the language the CCPA uses, here is what we collect and why:
| Category | What that means here | Why we have it |
|---|---|---|
| Identifiers | Email, name, phone, postal address, account ID | To reach you, ship to you, and pay you |
| Commercial information | Lots you sent, cards scanned and their values, payouts made | To price your lot and pay you for it |
| Visual information | Photos of your lot, your packed box, and scans of every card | To verify what arrived and record what it was worth |
| Financial information | Your chosen payout method and handle | To send you money |
| Internet activity | None collected | — |
| Geolocation | None collected | — |
| Biometric or sensitive information | None collected | — |
| Inferences or profiles | None created | — |
We have not sold or shared your personal information in the preceding twelve months, and we do not do so. We have no advertising partners and no data brokers. There is no opt-out link on this site because there is nothing to opt out of.
To make a request, write to privacy@viridian.cards. You may use an authorised agent to make it on your behalf; we will ask for proof that you authorised them. We will not discriminate against you for exercising any of these rights. Your payout rates do not change because you asked us a question about your data.
Children
We do not set a minimum age for using this service, and we do not knowingly collect personal information from children under 13. If we learn that someone under 13 has created an account, we will delete it and the information attached to it.
If you are a parent or guardian and believe your child has given us information, write to privacy@viridian.cards and we will remove it.
Changes to this policy
If a change materially affects what we do with information we already hold, we will email you about it rather than rely on you noticing.