Privacy Policy

Who we are

GrailSpotter operates a standing-order marketplace for collectible cards, on the web at grailspotter.com and in the GrailSpotter iOS app. Contact us at info@grailspotter.com.

What we collect

You give us

• Account details — your email address, a display name, and optionally a contact email and phone number.
• A shipping address, if you buy. It is copied onto an order when you approve a find, so the finder can post the card to you.
• Order content — the titles, descriptions and prices you post, any reference images you attach, counter offers, and the rating and comment you leave when an order completes.
• Photographs — if you are a finder, the photos you take of a card you have claimed. These are shown to the buyer of that order.
• Payment details — entered into Stripe’s payment form. Card numbers go directly to Stripe and never reach our servers. We store the Stripe identifiers needed to charge you, pay a finder, or refund you.

Your device gives us

• A push notification token, if you allow notifications, so we can tell you that an order was claimed or that a card is waiting on your decision.

We do not collect location, contacts, browsing history, advertising identifiers or analytics. There is no advertising or analytics SDK in the app.

What we use it for

• Running the marketplace: showing orders, matching buyers and finders, and moving a card from one to the other.
• Taking payment, holding it in escrow while an order is in flight, and paying the finder once you confirm delivery.
• Sending you transactional email and push notifications about your own orders. Notification preferences are in the app, in Settings → Notifications. Some messages — the ones that carry a deadline on your own order — cannot be turned off, because missing one costs you the order.
• Preventing abuse, and meeting our tax and anti-fraud obligations.

We do not sell your data, share it with data brokers, or use it for advertising.

Who else sees it

Only the processors we need to run the service:

Other users see only what the marketplace requires: your display name and rating on an order you are part of, and — if you are the buyer of an order you approved — your shipping address, to the finder shipping it. Finders’ names are shown to buyers in an anonymised form.

We may also disclose information where the law requires it.

How long we keep it

For as long as your account exists, and afterwards only where we must: records of completed transactions are kept for the period tax and accounting rules require, and Stripe keeps its own payment records under its own policy.

Deleting your account

You can delete your account from inside the app — Settings → Account Settings → Delete my account — or on the web under Settings → Account. Deletion is immediate and permanent, and takes your orders, images and notifications with it. We will refuse the request while you have money in flight — an order that is funded, shipped, or awaiting your decision — and tell you exactly which orders to settle first. If you would rather ask us, write to info@grailspotter.com.

Security

Traffic is encrypted in transit. Access tokens are held in the iOS Keychain, and card details are handled entirely by Stripe, a PCI Level 1 service provider. No system is perfectly secure, but we do not store what we do not need.

Children

GrailSpotter is not for children. You must be 18 or older to buy, sell or hold an account, since using the service means transacting money.

Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, export it, or have it deleted. Write to info@grailspotter.com and we will answer within 30 days.

Changes

If this policy changes materially we will say so in the app and on the web before the change takes effect.