This Privacy Policy describes how Moonstone (moonstonehq.com), operated from California, USA, handles information when you use the service.
What we collect
Account information: an email address and a password (stored as a salted hash — we cannot read it). Portfolio data: the cards and products you add, with quantities, printings, and optional purchase prices. Scan images: photos you submit are processed to identify cards; identification metadata (matched card, confidence) may be retained to improve accuracy — see “Scan data” below. Technical data: standard server logs (IP address, user agent, timestamps) for security and reliability, and session cookies to keep you signed in.
We do not sell personal information, and we do not use third-party advertising trackers.
Scan data
Card photos are processed to produce an identification. We may retain de-identified recognition metadata (for example: which card was matched, match confidence, and whether you corrected it) to improve the scanner. This metadata is not linked to a public profile.
How we use information
To provide the service (accounts, portfolios, pricing), to secure it (rate limiting, abuse prevention), to improve it (aggregate usage patterns, scanner accuracy), and to communicate service matters. We share data only with the infrastructure providers that host the service (e.g., hosting, database), bound by their own confidentiality obligations — not with data brokers or advertisers.
California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how it is used (this policy), to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.
To exercise any right, contact us at the email below; we will verify your request via your account email and respond within the statutory window.
Retention and security
Account and portfolio data are retained while your account exists and deleted on verified request. We use industry-standard measures (encrypted transport, hashed credentials, scoped access) but no system is perfectly secure; use a unique password.
Moonstone is not directed to children under 13, and we do not knowingly collect their personal information.
Contact
Privacy requests and questions: privacy@moonstonehq.com. We may update this policy; material changes will be reflected by the “Last updated” date.