Privacy Policy

Account details. Your email address, and optionally a display name, username, and country or region. Passwords are stored only as a one-way hash, so we cannot read yours. If you sign in with a third-party provider instead, we receive your email and basic profile from them.

Your collection. The cards and sealed products you add, and anything you record about them — quantity, condition, grade, purchase price, sale price, and dates.

Things you post. Profile information, posts, comments, sentiment votes, and direct messages.

Payments.If you buy credits, the payment is processed by Stripe. Card numbers go directly to Stripe and never reach our servers. We keep a record of the amount, the date, and Stripe’s reference for the transaction.

Visit statistics. Which pages are viewed, roughly where in the world the visit came from, which site linked you to us, and what kind of browser and device was used. This is collected by Google Analytics on our behalf, described in its own section below.

This distinction is a deliberate design rule in the product, not just a policy statement.

What you paid, what you sold for, and your profit are always private. They are never shown to another user, never included in a shared link, and never sent to an advertiser. The code that builds public pages does not read those fields at all.

The market value of a collection is public only if you turn it on. Public value is off by default. When enabled it shows what your cards are worth at current market prices — never what you paid for them.

Your profile, posts, and comments are public. Direct messages are visible only to the people in the conversation.

We use Google Analytics to understand how many people visit comps, which pages they read, and which sites send them to us. We use it because it is the tool the rest of the industry uses, and because building our own would have taken time we would rather spend on the product.

Google Analytics sets cookies and collects your IP address, the pages you view, your approximate location, and your device and browser type. Google processes that data for us and under its own terms. You can read how Google handles it at policies.google.com/privacy.

Because it uses cookies, we ask your permission before it runs. If you decline, Google Analytics is not loaded and no analytics cookie is set. You can change your mind at any time. Google also publishes a browser add-on that blocks Analytics on every site you visit, at tools.google.com/dlpage/gaoptout.

We never send Google Analytics your email address, your collection, or anything you paid for a card.

comps shows ads to visitors who do not have an ad-free subscription. Subscribers see no ads and their browsers do not load any advertising code at all.

Sponsor ads are images we host ourselves. They set no cookies and run no third-party code, and the sponsor learns nothing about you. We count how many times an ad was seen and clicked so we can invoice the sponsor, and we report only totals to them — never anything about an individual visitor.

Google AdSense may fill ad space that no sponsor has booked. Google is a third party with its own rules: it may set cookies or use similar technology to serve and measure ads, including personalized ads based on your prior visits to this and other sites. You can review and change these settings at Google My Ad Center and read how Google handles data at policies.google.com/technologies/partner-sites.

We never send an advertiser your email address, your collection, or anything you paid for a card.

If you sign in, we set a cookie that keeps you signed in. That is what it does and all it does — without it, every page would ask you to log in again. This one is necessary for the site to work, so it is always set.

We also store your answer to the cookie question itself, so we do not ask you again on every page.

Google sets cookies in two situations: when Google Analytics runs, which only happens if you agreed to it; and when Google serves an AdSense ad, as described above.

We do not sell your personal information. We share only what a service needs to do its job:

• Stripe — payment processing.
• Resend — sending account and notification email.
• Supabase and Cloudflare R2 — hosting our database and the images you upload.
• Vercel — running and serving the site.
• Google Analytics — visit statistics, and only if you agreed to it.
• Google AdSense — only when it fills an ad slot, and only for visitors who see ads.

Card prices come from market data providers including Scrydex and PriceCharting. We send them card identifiers to look up prices. We never send them anything about you.

We may also disclose information if the law requires it, or to investigate fraud or abuse of the service.

• Account and collection data: until you delete your account.
• Visit statistics: held by Google, not by us, under the retention period set in our Google Analytics account.
• Ad view and click records: 13 months, so a sponsor can query an old invoice.
• Payment records: as long as tax and accounting rules require us to.

You can view and edit your account and profile in settings, turn public collection value on or off at any time, and ask us to delete your account and its data. Depending on where you live you may also have the right to a copy of your data, to correct it, or to object to certain uses. Email us and we will act on it.

You can also decline analytics cookies, or change your mind later, and Google Analytics will not run. Because that data sits in Google’s systems rather than ours, deleting it is a request to Google — the opt-out add-on linked above is the most direct route.

comps is not intended for children under 13, and we do not knowingly collect their information. Some features carry a higher age requirement, which is stated where those features appear. If you believe a child has given us information, contact us and we will remove it.

If we change how we handle data, we will update this page and the date at the top. Questions, corrections, or a deletion request: privacy@comps.io.

See also our Terms of Service.