This Privacy Policy describes how moonstone (moonstonehq.com), operated from California, USA, handles information when you use the service.
What we collect
Account information: an email address and a password (stored as a salted hash that we cannot read). If you sign in with Google instead, we receive and store the email address, the name on your Google profile, and the URL of your profile picture. If you sign in with Apple, we receive and store the user identifier Apple assigns to your Apple Account for moonstone and the email address Apple shares with us, which may be a private relay address (ending in privaterelay.appleid.com) that forwards to your inbox if you chose to hide your email. Apple shares your name only the first time you sign in, and only if you choose to; we store it as your display name. We do not receive your Apple Account password or a profile picture. Portfolio data: the cards and products you add, with quantities, printings, and optional purchase prices. Scan images: photos you submit to the scanner on this website are processed to identify cards, and some are kept for a limited period to improve accuracy, described under “Scan data” below. Photos sent to the paid Scan API are processed and not kept. Developer account data: if you use the Scan API, we store a hash of each API key, the name you give it, and per-period call counts, which are usage records tied to your account rather than to any individual call. Technical data: standard server logs (IP address, user agent, timestamps) for security and reliability, a short-lived record of your IP address used to rate-limit sign-up, sign-in and password-reset attempts, and the cookies described under “Cookies and storage” below.
We do not sell personal information, and we do not use third-party advertising trackers.
Scan data
This section is about the scanner on this website. Card photos are processed to produce an identification. When a scan comes back uncertain, and when you confirm or correct a result, we keep a copy of that photo together with recognition metadata (which card was matched, the confidence, and what you chose) so we can improve the scanner. Some of these are kept automatically, without you tapping anything, because a scan the model got wrong is the one we most need to learn from. These records are stored without your account identifier and are deleted after 180 days.
Photographs sent to the paid Scan API are handled differently and are not kept. They are processed to produce the response and are not written to storage, do not enter the corpus described above, and cannot be retrieved afterwards. What we do record about an API call is the usage count that meters your plan, not the image. While the call is running the image is passed to the same third-party processors listed below, because the API and the website scanner run on one recognition pipeline.
The Moonstone app for iPhone and Android handles photos the same way the paid Scan API does. A photo you take with the app's scanner, or pick from your library to ask Cynthia about, is downscaled on your phone and sent to us only to answer that request. It is processed by the providers listed below while the request runs and is not written to storage, does not enter the corpus described above, and cannot be retrieved afterwards. You can use the app without an account, or sign in to the same account as the website (with an email and password, with Apple, or with Google), which stores the account information described above; the app keeps its sign-in token in your phone's secure storage (the iOS Keychain or the Android Keystore). The cards in your collection, with their quantities, grades, conditions, printings and any purchase price you enter, are kept on your phone and also saved to our servers so they can be valued and moved into an account: under your account when you are signed in, and otherwise under a random identifier the app creates on your phone, which carries no name or email address. Signing in carries the collection you built signed out into your account. You can delete your account, with its collection and watchlist, from the app's Account screen. The questions you type to Cynthia go to the model providers described under service providers, and we keep each question with Cynthia's answer so we can check and improve her answers; from the app they are stored with your account when you are signed in, and otherwise without any account or device identifier. The app's requests are rate limited by IP address like the website's.
The app can keep a watchlist with price alerts, signed in or not: the cards you watch, the printing and grade of each, and any target price you set are saved to our servers under your account, or under the app's random identifier when you are signed out, and signing in moves them into your account. If you allow notifications, which the app asks only when you create your first alert, your phone gives the app a push token: an address for notifications to that installation of the app, which carries no name, email address or advertising identifier. We store the token with your account or the app's random identifier, the platform (iOS or Android), and when it was registered and last seen, and use it only to send you the price alerts you asked for, at most five a day. Signing out of the app deletes the token from our servers, as does deleting your account; turning notifications off in your phone's settings stops them at once, and we stop using a token the push service reports as no longer installed.
When the app hits an error it sends us a crash report so we can fix it: the error message and where in the code it happened, the app version, the phone's platform and operating system version, and which screen was open (without anything typed into it). A crash report carries no account, device identifier, photo, collection or question. It is not linked to you or used for tracking, the IP address it arrives from is used only to rate limit reports and is not stored with it, and we keep the most recent 5,000 reports.
Service providers who process your data
Running moonstone means passing some of your data to companies that perform a specific job for us. Each is bound by its own contractual obligations, none of them is a data broker or an advertiser, and none is permitted to use your data for its own purposes. The current list, which can change as providers do:
Hosting and delivery: Vercel (application hosting) and Turso (database). Payments: Stripe, which receives your email address and handles your card details directly. We never see or store a card number.
Card photographs you upload to the scanner, send to the assistant, or submit to the Scan API, including from the Moonstone app, are transmitted to Google Cloud Vision for text recognition, to a GPU service we run on Modal for image analysis, and to Anthropic and to models reached through OpenRouter (which routes to whichever model answers first, and can include models hosted by Google, NVIDIA, Meta or MiniMax) for reading and describing the card. Questions you type to the assistant are transmitted to those same model providers together with the market data needed to answer them. Do not upload a photograph, or type anything into the assistant, that you would not want processed by those providers.
Email: the transactional messages we send, such as a password reset, are delivered by an email service provider that receives your address and the content of that message.
Push notifications: the app's price alerts are sent through Expo, which receives the push token and the alert's text (the card and its price) and hands them to Apple Push Notification service on iPhone or Firebase Cloud Messaging on Android for delivery.
We use first-party analytics we run ourselves rather than a third-party service. It records the page visited, the referring site, an approximate country, and a UTM tag when one is present. It does not record your IP address, sets no cookie, stores nothing on your device and does not follow you across other sites. You can turn it off, as described under “Cookies and storage” below.
Points, achievements and prizes
If you take part in the rewards program we keep, against your account: your points balance and a record of each time points were earned or spent (for example a daily check-in, an achievement, an event welcome bonus or a spin), your check-in streak, the achievements you have unlocked and small counters that track progress toward them (such as how many cards you have scanned), which event code your account was created with, who invited you if you joined through an invite link, and the prizes you have won with their status. Spins at an expo booth display show recent wins with only the first initial of your display name, or “A visitor”. Points cannot be bought or sold and are not linked to any payment.
Shipping address: if you ask us to ship a prize, we collect your full name, street address, city, state, ZIP code and, if you choose to give it, a phone number for the carrier. We use it only to send that prize and the prizes shipped with it. It is not sent to analytics, crash reports or any marketing system, and it is not written to our logs. It is kept until the parcel ships and then for 90 more days, so we can deal with a lost or returned parcel, after which it is deleted. We only ship inside the United States. If you win a free month of Pro, it is applied to your account; if you already have Pro you receive a gift code instead, which we store only as a one-way hash.
This information is kept while your account exists, except the shipping address, which follows the 90-day rule above. You can ask us to delete it with the rest of your account.
How we use information
To provide the service (accounts, portfolios, pricing), to secure it (rate limiting, abuse prevention), to improve it (aggregate usage patterns, scanner accuracy), and to communicate service matters. We do not sell personal information to data brokers or advertisers, and we do not use advertising trackers.
California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how it is used (this policy), to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.
To exercise any right, contact us at the email below; we will verify your request via your account email and respond within the statutory window.
Retention and security
Account and portfolio data are retained while your account exists. You can delete the account yourself at any time, which removes your profile, portfolio, watchlist, API keys and usage records; cancel any subscription first, because deleting the account here does not stop a charge that lives at Stripe. We use industry-standard measures (encrypted transport, hashed credentials, scoped access) but no system is perfectly secure; use a unique password.
moonstone is not directed to children under 13, and we do not knowingly collect their personal information.
Contact
Privacy requests and questions: privacy@moonstonehq.com. We may update this policy; material changes will be reflected by the “Last updated” date.