Kept is run by Larry Reedy, one person, as a side project. The code and the database still call it Card Vault. [lawyer review: whether a business entity or a place of business must be named here]
If you want to ask about your data, or have it deleted, write to lreedy3@gmail.com. Inside the app, report a problem at the top of the page reaches the same person.
Each row is one kind of information. "How long" is the truth for our own database; a few things live on for a while in backups and logs, which have their own sections below.
| What | What exactly | Why | How long |
|---|---|---|---|
| Account details | Username, display name, when you joined, your handle if you claim one, your profile and trade settings, your referral code and who referred you, any daily limit or plan an admin set. | To run your account. | Until the account is erased. A handle, once claimed, is permanent while the account exists. |
| Password | A salted hash of it. We never store the password itself and nobody, admins included, can read it back. | Sign-in. | Until the account is erased. |
| Email address | The address you gave, and whether you have confirmed it. | The confirmation link (the only email the app sends on its own), and to stop two accounts sharing one address. | Until the account is erased. Stripe and Resend keep their own copies under their own terms; see "Who we send data to". |
| Registration IP address | The internet address your account was created from (for IPv6, the first half of it). | A limit on how many accounts one address may create in a day. | Until the account is erased. No screen in the app shows it, not even to admins. |
| Sign-in cookie | One cookie that keeps you signed in. It cannot be read by scripts, is sent only over HTTPS, and is re-checked against your account every minute. | Staying signed in. | 14 days from your last visit, or until you sign out. |
| Cards and card details | Everything a scan reads or you type about a card: player, set, year, number, parallel, serial, grade, condition, notes, where you keep it, what you paid, how many you have, its status (owned, wishlist, listed, sold, price check), and which box it came from. | The product. | Until you delete the card or the account is erased. |
| Card photos | The front and back you photographed. Every photo is resized and re-encoded before it is kept: on the scan bench in your browser, and on the server for a photo replaced with "Retake photo" or a photo of a box. That strips camera metadata such as location and device, and the re-encoded picture is the one that goes to the scanner or to eBay. | Identification, your binder, your listings. | Until the card or box is deleted or the account is erased. Photos also sit in our backup mirror; see Backups. |
| Prices and values | The estimated value, how it was reached, and a history of price readings: the AI's estimate, a summary of eBay asking prices (lowest, highest, a middle figure, how many listings, and the words searched for; never the listings, item numbers or sellers), repricer answers, and the price a listing sold for. | Valuing your collection. | With the card. |
| Box rips and box photos | Each box you rip: its label, barcode, product, format, what it cost, when you opened and closed it, up to three photos of the packaging, and a link to a shared record of what the packaging says. | Rip tracking and a hint to the scanner. | Until you delete the session or the account is erased. The shared packaging record carries nothing of yours and stays. |
| Public profile, handle and share link | Your handle, display name, member-since date and profile setting; and if you make one, a 22-character share link, stored as it is so you can copy it again. | Sharing your page. | Until the account is erased. The link lives until you rotate it or turn it off. |
| Friends and blocks | Who asked whom, whether it was accepted, and who blocked whom. | The Friends tier, trades and rip parties. | Until you unfriend or unblock, or either account is erased. |
| Trade offers | Who offered what to whom, your message, the status, and a snapshot of each card's name and value at the moment of the offer. | A record of the swap. | Until either party's account is erased. You cannot delete an offer yourself; declining or withdrawing ends it, the record stays. |
| Rip parties | The party's code and name, who hosted, who joined and left and when. While a party is open, every card scanned at the table, with its value, is visible to everyone at it. After it closes, the recap keeps each member's count and total, the party's total, and the single best pull with its value. | Ripping together. | Until the host's account is erased. |
| Card show RSVPs | Whether you are interested in, going to, or tabling at a show. | The show board. | Until you clear it or the account is erased. |
| Shared checklists and shows you add | A checklist you import, or a show an admin posts, is marked as added by you. | Attribution. | The checklist or show stays forever, because other collectors' cards link to it; erasing your account removes your name from it. |
| Credits, plan and Stripe ids | Your plan, credits, and counts of paid AI calls per day and per month; if you have ever opened checkout, Stripe's customer and subscription ids and when the paid period ends. | Metering the calls that cost money, and billing. | Until the account is erased. A receipt of each Stripe event we acted on is kept forever; it holds no name. |
| eBay connection | If you connect eBay: eBay's id and username for your account, the access and refresh tokens eBay issued (stored encrypted), what you consented to, when you connected, the ids of the selling policies and ship-from location Kept created on your eBay account, and when your sales were last read. | Listing cards and reading your sales on eBay. | Until you disconnect, until eBay tells us you closed your eBay account, or the account is erased. |
| Seller settings and listings | Your ship-from city, state and ZIP, handling and returns terms, shipping charges and your cost figures; and for each card you list, the listing's title, price, offer thresholds, the written description, item details, status and eBay's item and order numbers. | Selling. | Until the listing or card is deleted or the account is erased. |
| eBay sales records | For each sale eBay reports: order and line numbers, date, what the buyer paid for the item and shipping, tax, eBay's fees and the label cost. Nothing about the buyer: eBay sends the buyer's name and address and we do not read them. | Marking cards sold and showing your net. | Until the account is erased. Disconnecting eBay does not remove them. |
| Facsimile signature facts | Designs you have told the scanner carry a printed signature: year, set, number, player. | Fed into your own future scans. | Until you remove them in Settings or the account is erased. |
| Problem reports and attachments | When you report a problem: what you wrote, which screen you were on, your window size, your browser's identifying string, the last few page errors, and a snapshot of the whole page as you saw it, with whatever was typed into its fields at that moment, except a password box, which is captured empty (and emptied again on the server), plus up to three files you attach (images are re-encoded, which strips their metadata; PDFs are kept as sent). The snapshot can include cards other people shared into your view. | Debugging what you reported. | Until an admin deletes it or your account is erased. Nothing expires on its own. |
| Landing page feedback | Notes left on the sign-in page by people without an account: the text, a name and contact if they gave one, their window size and browser string, and any screenshots. | Feedback on the front door. | Until an admin deletes it. |
| Admin audit log | Every privileged act by an admin: who did it, from which internet address, what they did, to which account, and a line of detail. When an account is erased, that line names the username and account id that were erased, not the email. | So that admin power is accountable. | Forever. It is never edited or deleted, and erasing an account does not touch it. |
| Server logs | Our host keeps the server's log. It does not record requests as they come in, so the links you click (a confirmation link, a share link, a party join) are not written to it. It records the internet address of anyone who trips a rate limit, usernames on a few billing, referral and account events, an email address when a message fails to send, and the path and account id of a request that failed with an error nobody expected. | Keeping the service running and spotting abuse. | [unverified] How long our host keeps logs is not something we have confirmed. |
| Browser storage | A few preferences in your browser's local storage (layout choices, filters, the last rip party you looked at, that you dismissed a tip) and a cached copy of the app's own files so it opens offline. Nothing from your vault is ever cached in the browser. | Preferences and offline use. | Until you clear site data. |
| Backups | A daily copy of the whole database, and a growing mirror of every photo, kept on the owner's own computer. | Disaster recovery. | Database copies: the newest 14. The photo mirror: it is never pruned, so a deleted photo stays in it. See Backups. |
Every card has a visibility you set in its editor: Private (you only, the default for every card), Friends (you and the people who accepted your friend request), or Public (anyone who has your handle or your share link, signed in or not). A price check is always private.
Whatever the tier, another person sees a card's identity, its photos, whether it is on your wishlist or up for trade, and a warning if the scanner thought it might be a reprint. They never see what it is worth, what you paid, where you keep it, your notes, its price history, or whether it is listed for sale. That is built into the shape of what the server sends, not into a setting.
Your page is closed by default. Opening it (Settings → profile visibility) is a separate choice from any card's tier, and needs a handle. A share link opens your page to anyone holding the link, at the tiers they already qualify for; rotate it and every old copy stops working at once. Handles are permanent and searchable by prefix once claimed.
A rip party is the one exception to "never the money." Joining a party is consent: while it is open, everyone at the table sees every card scanned at it, value included, and each member's running count and total; the recap afterwards keeps the counts and totals and the single best pull with its value. Joining also makes you friends with everyone at the table, and leaving the party does not undo that.
A trade offer shows the other person the names of the cards on both sides and your message. Each card's value is shown only to the person who owns that card.
On the card-show board, signed-in people can see who has RSVP'd to a show; visitors without an account see counts only.
Admins (today, the owner) can see your username, display name, email, plan, credits, usage counts and how many cards you have. No admin screen lists or browses your cards, values or photos. The one exception is a repair tool that reaches a single card by its id to fix a broken record; it shows the card's identity and image status, never its value, cost, notes or location, and every use is written to the audit log. An admin can also set a new password on an account, which is logged, and could then sign in as that person; that is why the log exists. Problem-report snapshots are read by admins only, and every read is logged.
| Service | What it receives | Why |
|---|---|---|
| Railway | Everything: it hosts the app, the database and the server log. | Hosting. |
| Cloudflare R2 | Every photo and report attachment, filed under the card, box or report id. | Photo storage. |
| Anthropic | See "The AI" below. Never your name, email or any identifier. | Identifying, valuing and describing cards. |
| Google (Gemini) | Only when Anthropic cannot answer a scan: the same scan, as "The AI" below describes. Never your name, email or any identifier. | A backup for identifying cards. |
| eBay | See "eBay" below. | Asking-price comparisons; and if you connect, selling. |
| Stripe | Your email, username and account id, and the plan or pack you chose. | Payments. |
| Resend | Your email address, your display name and the confirmation link. | Sending the confirmation email. |
| Google Fonts | Your browser's request for two typefaces, which carries what any web request carries (your address, browser string, the page you came from). | Typography on every page. |
We do not sell anything about you to anyone, and we send nothing to anyone not in that table. Each of those services keeps what it receives under its own policy; we have not restated those here. [lawyer review: whether to name each provider's policy or data-processing terms, and whether any of them count as a sale or share under a law that applies to us]
Identification and valuation use Anthropic's Claude models through Anthropic's API. What goes depends on the button:
The backup. When Anthropic cannot answer a scan (the service is down, refusing us, or out of capacity), the scan may go to Google's Gemini models through Google's Gemini API instead: exactly what a scan sends Anthropic, as listed above, and nothing more. Only scans go there; condition review, prices, stories, listings and box reading wait for Anthropic. A card identified this way says so in its notes. The backup is used through a paid Google account, under Google's terms for paid use.
No call carries your username, email, handle, account id or any other identifier. Anthropic's and Google's handling of what they receive is governed by their own terms. [lawyer review: whether and how to state Anthropic's and Google's API data-use terms, and whether a data-processing agreement is needed with either]
Pricing asks eBay's public listings for a card, with the app's own credentials: the search is the card's year, player, set, number, parallel, print run and slab label. Nothing about you goes with it, and we keep only a summary of what came back.
Selling is optional and starts with you signing in on eBay's own page and granting Kept permission. From then on Kept acts on your eBay account on your instruction: it sets up selling policies and a ship-from location (your city, state and ZIP; no street address, name or phone), uploads a card's photos and publishes the listing you approved, and reads your orders and the fees eBay charged so the card can be marked sold. It reads your orders but not your buyers: their names and addresses are in what eBay sends and are never stored. Disconnecting in Settings deletes the tokens; eBay keeps its own record of the permission, which you can remove under your eBay account's third-party app settings. The policies and location Kept created stay on your eBay account. If you delete your eBay account, eBay notifies us and the connection is deleted.
Stripe runs checkout and the billing portal. We hold Stripe's ids for your customer record and subscription and the date your paid period ends, and we credit your account when Stripe tells us a payment succeeded. We never see or store a card number. Stripe receives your email and username so the customer record is recognisable to you.
The app sends one email on its own: the link that confirms your address, through Resend. An admin can send a test message. There are no newsletters, no marketing mail, and no password-reset mail, because there is no self-service password reset today; ask the owner.
One cookie, for signing in. No analytics or advertising cookies exist on these pages, so there is no cookie banner. The app keeps a handful of layout and filter preferences in your browser's local storage and caches its own files so it can open offline; nothing from your vault, your profile page or a share link is ever written to the browser's cache.
The server log, kept by our host, does not record requests as they come in: the one-time link you click to confirm your email, a share link's path and a rip-party join code are not written to it. It records the internet address of a visitor who trips a rate limit; on a few billing and account events, a username; when an email fails to send, the address it was going to; and, when a request fails with an error nobody expected, its path and your account id, so the failure can be found and fixed. The log is not sent anywhere and is read only by the owner. [unverified] How long the host keeps it is not confirmed.
Once a day, when the owner's computer is on, a copy of the whole database and a mirror of every photo are taken to that computer. The database copies include everything above, password hashes included; the newest 14 are kept. The photo mirror is never pruned, by design, so a photo you delete, and the photos of an erased account, remain in it until the owner removes them by hand. The copies are not encrypted on that disk. [unverified] Whether our host keeps backups of its own, and for how long, is not something we have confirmed. [lawyer review / owner: whether to encrypt the backups and prune erased accounts' photos before this page goes live, rather than disclose it]
The table above says it row by row. The rule behind it: your own data lives as long as your account does, or until you delete the card, box, setting or link it belongs to; shared library rows (checklists, show listings, box facts, card stories) are everyone's and stay; the admin audit log is permanent; backups and logs lag behind by the periods above. Nothing is deleted automatically on a schedule.
A card: delete it from the editor. Its photos are deleted from storage at the same time (if storage fails to answer, the row is still deleted and the stray file is counted and left). A box: delete the session. Your eBay connection: disconnect in Settings. Your share link: turn it off in Settings.
Your account: ask us. There is no delete button today. We close the account first (sign-in refused, your page and photos become unreachable, nothing erased yet, reversible), then erase it. Erasing removes your cards and photos, price history, listings, seller settings, eBay connection and sales records, facsimile facts, rip sessions and box photos, the parties you hosted and your seat at others', friendships, every trade offer you were on either side of (the other person's copy goes too), show RSVPs, the problem reports you filed with their attachments, usage counts, and the account itself.
What erasing does not remove, so you know: your name on shared checklists and shows is cleared but the rows stay; a spent invite code stays spent; the admin audit log keeps its lines about you, including the erasure line that names your username and account id (not your email); receipts of Stripe events (which carry no name); the server log; backups for up to 14 runs; the photo mirror until pruned by hand; snapshots in other people's problem reports that happened to show a card you had shared; and whatever Stripe, Resend, eBay and Anthropic hold under their own terms. An account with a live Stripe subscription cannot be erased until the subscription is cancelled at Stripe.
To take your data with you first: Sell → Export CSV gives you every card with its values and cost basis; the eBay export gives you your listings. There is no single export of everything else yet. [lawyer review: whether a law that applies to us requires a fuller export, a deletion deadline, or a self-service deletion button]
[lawyer review: the rights to list here (access, correction, deletion, portability, objection) and under which laws; whether a GDPR/UK GDPR or California section is needed given where users may be; the lawful basis for each category if GDPR applies]
Kept is not for children under 13, and we do not knowingly keep an account for one. If you believe a child has made an account, write to us and we will erase it. [lawyer review: any parental-consent wording a law requires; the Terms say 13 to use, 18 to buy credits or connect eBay]
Passwords are stored as salted hashes. The sign-in cookie cannot be read by scripts and is sent only over HTTPS. eBay tokens are stored encrypted. Sign-in, signup, report filing and party joining are rate-limited by address. Cards are fenced to their owner at the database layer, and one rule decides who may see a card everywhere it is read. Photos are only served through a route that asks that rule. What is not yet done, honestly: the backup copies on the owner's computer are not encrypted, and the keys that encrypt the eBay tokens live in the same database as the tokens. No system is perfectly secure; if we learn of a breach affecting you we will tell you. [lawyer review: breach-notification wording and any statutory deadline]
When this page changes in substance we will change the effective date at the top, add a line below, and ask you to read it the next time you sign in. Your account records which edition you agreed to when you signed up. [lawyer review: notice period and whether continued use may count as acceptance of a new edition]