Privacy Policy

1. What this is

HoldOrSell is a research aid for trading-card collectors. It reads a collection you provide and returns a directional verdict on each item. It is not financial advice, it does not execute trades, and it does not connect to a bank, a broker or a marketplace account on your behalf.

2. What we collect

• Your email address and a password. The password is stored only as a secure one-way hash, so it cannot be read back, including by us.
• Your collection. When you upload a collection we store your cards: set, name, number and rarity, plus quantities, and (only if you provide it) the price you paid.
• A session. Signing in creates a server-side session record. Working without an account uses a single functional cookie, sd_session, marked httpOnly and SameSite=Lax, whose only job is to keep your uploaded collection attached to your browser between requests.

3. What stays private

Your account email and the specific price you paid for a card are private. They are not shown to other users, not published, and not part of any shared dataset. Your ownership of specific cards is not part of the shared card database in any identifiable way.

4. What we use, and what you consent to

By creating an account you agree that the non-personal parts of your collection data (which cards and sets exist in collections, and their market prices over time) may be used in aggregated and de-identified form to improve the platform: to build a shared card database of release dates, reprint history and price history, and to improve the scoring models. This shared card data benefits all users and does not identify you.

This is section 4 of the terms, and it is the consent that matters. It covers card facts and prices. It does not cover your identity or your entry price.

5. What we do not do

• We do not sell your personal information.
• We do not publish the price you paid, or your identity.
• We do not display third-party advertising inside the tool.
• The application ships with no third-party analytics, advertising or tracking scripts, and no advertising cookies.

6. The shared card database

Facts about cards themselves (release dates, reprints, price history) are shared across all users as a single source of truth. That is what makes a verdict comparable between collections. Who owns which card is not part of it.

7. Third parties whose data we read

Card catalogue, price and listing data is read from external sources: a local archive built from TCGplayer price data, and live marketplace queries. Those are outbound requests made by the service about cards. Your collection is not sent to them, and they are not given your identity. Card images are served from the card-data provider's image host, so loading a card page requests an image from that host.

8. Deletion

You can request deletion of your account and your private collection data. The entry point is in account settings. Deleting your account removes your account record, your private collection and your entry prices. It does not retract card facts and market prices already folded into the shared, de-identified card database, because those no longer identify you and cannot be traced back to your account.

9. Changes

If this policy or the terms change materially, you will be asked to review and re-consent rather than being opted in silently.

10. No warranty

The tool is provided as-is, without warranty. Use at your own risk.

11. Contact

To be completed before launch. See the note at the top of this page. Until a published address exists, deletion and data requests should be made through account settings.