This Privacy Policy describes how moonstone (moonstonehq.com), operated from California, USA, handles information when you use the service.
What we collect
Account information: an email address and a password (stored as a salted hash that we cannot read). Portfolio data: the cards and products you add, with quantities, printings, and optional purchase prices. Scan images: photos you submit are processed to identify cards; identification metadata (matched card, confidence) may be retained to improve accuracy, described under “Scan data” below. Technical data: standard server logs (IP address, user agent, timestamps) for security and reliability, and session cookies to keep you signed in.
We do not sell personal information, and we do not use third-party advertising trackers.
Scan data
Card photos are processed to produce an identification. We may retain de-identified recognition metadata (for example: which card was matched, match confidence, and whether you corrected it) to improve the scanner. This metadata is not linked to a public profile.
Service providers who process your data
Running moonstone means passing some of your data to companies that perform a specific job for us. Each is bound by its own contractual obligations, none of them is a data broker or an advertiser, and none is permitted to use your data for its own purposes. The complete list:
Hosting and delivery: Vercel (application hosting) and Turso (database). Payments: Stripe, which receives your email address and handles your card details directly. We never see or store a card number.
Card photographs you upload to the scanner or send to the assistant are transmitted to Google Cloud Vision for text recognition, and to Anthropic and to models reached through OpenRouter for reading and describing the card. Questions you type to the assistant are transmitted to those same model providers together with the market data needed to answer them. Do not upload a photograph, or type anything into the assistant, that you would not want processed by those providers.
Email: the transactional messages we send, such as a password reset, are delivered by an email service provider that receives your address and the content of that message.
We use first-party analytics we run ourselves rather than a third-party service. It records the page visited, the referring site, an approximate country, and a UTM tag when one is present. It does not record your IP address, does not set an advertising cookie and does not follow you across other sites.
How we use information
To provide the service (accounts, portfolios, pricing), to secure it (rate limiting, abuse prevention), to improve it (aggregate usage patterns, scanner accuracy), and to communicate service matters. We do not sell personal information to data brokers or advertisers, and we do not use advertising trackers.
California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how it is used (this policy), to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.
To exercise any right, contact us at the email below; we will verify your request via your account email and respond within the statutory window.
Retention and security
Account and portfolio data are retained while your account exists and deleted on verified request. We use industry-standard measures (encrypted transport, hashed credentials, scoped access) but no system is perfectly secure; use a unique password.
moonstone is not directed to children under 13, and we do not knowingly collect their personal information.
Contact
Privacy requests and questions: privacy@moonstonehq.com. We may update this policy; material changes will be reflected by the “Last updated” date.