Privacy

Signing in

On the sign-up page, your browser sends your email and password to Amazon Cognito. Confirm your email before signing in. The password is not kept in the app database.

To limit confirmation-code resends, Pennysleeve keeps your sign-up account identifier, a one-way hash of your username, and a resend time window and count. These security records need explicit cleanup and have no automatic timed purge.

Changing your signup plan can save a draft in this tab's session storage for confirmation, reloads and sign-in. It holds your normalized signup email, plan, billing interval, progress, whether you have an account, and a draft identifier and revision. Sign-in adds your verified account identifier. Only that signed-in account can use the draft. The draft proves neither ownership nor consent.

Billing recovery saves your choice before removing the matching draft. You can also discard it. Failed cleanup or closing account creation can leave it stored. Closing the tab may retain it, and it never expires automatically. It contains no password, one-time code, token, hosted checkout link, payment-provider or customer identifier, or payment credential. These exclusions apply only to this signup draft.

Sign-in runs on Amazon Cognito. It holds your email address, your password, and your second factor if you turn one on. When you sign in, your password never leaves your browser: the sign-in proves it without sending it. When you set or change a password, your browser sends it to Amazon Cognito only. Pennysleeve never holds it.

Your account holds your sign-in identifier, email, optional display name, creation date, role, plan, and whether it is disabled. It starts with default fee and rate settings that you can change.

Sign-in uses secure cookies for access and refresh tokens that page scripts cannot read. A separate cookie readable by the app holds your email, account identifier, and session expiry to help display your session. These are separate from the signup draft and visit counter. Your browser also keeps display preferences and carts in local storage, and unsaved form drafts in tab session storage. These can remain on that device after a reload.

AWS records a trace for calls the API serves: an id for the call, the matched kind of page request, how long it took, whether it failed, and the signed-in account. It does not record the address query or what you entered. Those traces are kept for one month and then deleted. The separate delivery-network log below does include address queries.

The delivery network in front of this site keeps its own record of every request it serves, pages and app requests alike, whether you are signed in or not: the time, the page or file asked for, anything after the question mark in the address, the address the request came from, the country that address is in, the site that linked you here, and what your browser says it is.

This includes a search or a filter you typed into a page address, such as a card name or vendor. Request bodies, including submitted passwords, forms, receipts, cards and messages, are not recorded. This log helps count visitors and page views. It holds no cookie, stays in Pennysleeve's AWS account, and goes to nobody else. It is kept in two places. The longer-lived copy is deleted after ninety days.

The app also keeps a log of each API call you make while signed in: the time, the kind of page request, how long it took, the status code it returned, and whether you or an assistant credential made it. It does not keep the address query or anything you sent. You can read it on the Request activity page. It is deleted after 14 days, and a copy can sit in a database backup for up to seven more days. Closing your account deletes it.

Cognito keeps its own record of your sign-ins. That one sits on Amazon's schedule, not on mine, so the month above does not describe it.

Reports

A bug report stores what you write, its category and impact, when it happened, the game and app version, and its review state. If you leave Include technical details checked, it also stores a page pattern with record identifiers and queries removed, browser family and major version, operating-system family, and phone, tablet, or desktop class. It never collects a raw browser string, console log, screenshot, receipt, card, message, or form contents.

Administrators can read submitted reports, and each detail read is recorded. The account and time may be used to find a related one-month trace. Closing your account deletes its bug reports and their review history.

Your records stay in your account

What you enter belongs to your account alone: purchases, pulls, inventory, sales, bulk lots, expenses, trips, personal use, tax reserve entries, receipts, and your settings.

One account cannot read another account's records. Support access and the information you choose to publish are described below.

Driving distances are shared across accounts. Pennysleeve keeps the two place names, miles, and lookup date so it can reuse the result. Another account that types the same two places reads that number. The saved result does not identify whose trip it was.

A receipt you upload is kept as a file in private storage. The store blocks public access and encrypts what it holds, and the app reaches a file through a signed link that expires. The database runs behind an encrypted connection with a verified certificate.

Card and price data is shared

Magic card names, sets, images, and prices come from Scryfall and MTGJSON. Pokemon card data and prices come from Pokemon data providers, including JustTCG. A job refreshes the shared catalog and prices every night. That data describes cards, not people, and it is the same for every account.

Pennysleeve fetches shared card data and card images on its servers and serves the images itself. Card-data providers are not told who you are or what you hold. Your browser does not request these images from the providers.

Working out how far a trip was

Ask the app for the distance of a trip and it sends the two places you typed to OpenStreetMap's Nominatim service, to turn each one into a point on the map, and then to the OSRM routing service, to get the driving distance between them. Those two services are told the places. They are not told your name, your account, or anything else you hold.

This happens when you save a trip and leave the miles empty, and again if you ask for the distance to be worked out. Type the miles yourself and nothing is sent at all. Type coordinates at both ends and no address leaves the system, although the routing service still gets the two points, because it cannot work without them.

Find cards works out straight-line distances from a local table of zip-code locations. It does not send buyer or shop zips to Nominatim or OSRM for these searches.

Asking for access

The public pages link to sign-up instead of an anonymous request form. Existing request records described below remain. Paid plans are bought in Settings, Account, under Billing.

The closed-state request form held four things: an email address, a name, whether you are a shop or an individual buyer or seller, and roughly where you are. If you arrived through a link that carries a campaign code, the request also records that code, so I can see which post or video brought you. The code is a short label for the post, video, or creator that shared the link. It creates no account and no sign-in. The request waits until I read it, and it is kept while it waits.

If I open an account, the request stays, marked as answered. If I turn it down, the request itself is deleted and I keep the email address and the date I turned it down. That record exists so a second request from the same address is not read as a first one. Nothing in the app can delete it.

The form no longer takes an invite code.

Paid-plan review requests

Paid-plan review requests made before subscriptions opened in Settings are kept as history. A request records your signed-in account and email, the name, shop or individual choice, location, and note you submit. Its review history includes the decision, chosen plan and its version, decision time, administrator, and a record of changes.

These review and signup-security records have no automatic timed purge. Explicit cleanup is needed. Ask about retained records when you ask to close your account.

Support, and the record of it

I can open one account's records to answer a support question. This support view is limited to administrators, reads one account at a time, and cannot change the records it reads.

Deleting an entry sets it aside rather than destroying it. A second view shows the entries you deleted, on the same terms as the first: administrators only, one account at a time, recorded the same way, and unable to change anything. It cannot put an entry back. Closing your account removes the entries you set aside along with everything else.

Each support view is recorded before any of the account's records are read: which administrator, which account, and when. A failed view still leaves this record. The app cannot delete it.

Administrators can also see an account list with email, role, plan, and creation date. Viewing that list is not recorded as a support view. Administrators can change an account's plan and turn an account off.

Messages between buyers and sellers

A seller can choose whether Find cards buyers may message them. A conversation is private to its buyer and seller. It holds the messages, which participant sent each one, unread state, and a bounded copy of the card search that started it. Message text does not go in email alerts, system logs, traces, or notification events. If you set a name under Settings, the other person in a conversation is shown it. Your email address is never shown to them.

Either participant may block the other or submit a report. A report gives an administrator a bounded copy of that conversation as evidence, and every administrator opening it is recorded. Administrators cannot browse conversations that nobody reported. Closing either account deletes the shared conversation and its report evidence for both people.

Hosted billing

In Settings, Account, under Billing, a paid plan opens Stripe's hosted checkout, and the billing portal manages an existing one. The app has no custom card or bank-detail fields. Card numbers, bank details and billing addresses are not stored in the app's billing tables. Payments between buyers and sellers and their shipping stay outside Pennysleeve.

Paid plans are sold through Link, a Stripe service, and Link is the merchant of record. At checkout you give your email, billing address, and payment method to Stripe and Link. They hold those details, take the payment, send your receipts, and handle order support. Pennysleeve does not store your card number, bank details, or billing address. Under Stripe's policy, a deletion request made to Stripe or Link cancels any subscription sold to you through Link.

Local billing records hold account and customer bindings, subscription references, operation identities, selections and states, verified trial and paid periods, invoice and payment references, amounts and currencies, and safe event-processing facts. These records verify access and allow uncertain billing actions to be recovered. They do not contain the raw signed webhook body.

Ordinary business-data wipes retain these billing records. They are removed through an explicit account closure only after a fresh check confirms that pending work is resolved and subscriptions cannot renew. Support audit records keep the closure terms described below. Stripe and Link keep their own records under their own policies; deleting local billing records does not delete their records.

How visits are counted

These pages carry no advertising and no third-party trackers other than Google Analytics, which runs only after you choose Allow (see the next section). The delivery network's own record of the requests it served, described under Signing in, covers every page. For these public pages only, a first-party counter this site runs itself also counts visits, to show how many people read them.

The counter keeps a random id in this browser only. It never links to your account or your email. Each visit stores a one-way hash of that id, the page you opened, and the time, kept apart from the account database. A record lasts 30 reporting days, counting today, and is removed on the next scheduled sweep after that. A browser that blocks scripts, blocks storage, or matches an automation pattern is not counted.

What you enter is not sold or passed to others for their own use. Amazon Web Services hosts the service and its data in Northern Virginia. Information may also be disclosed when required by a lawful order.

Google Analytics on these public pages

If you choose Allow, these eleven public pages use Google Analytics to count visits and see which sites send visitors: Home, Buyers, Sellers, About, FAQ, Plans, Tools, Contact, Privacy, Terms, and Credits. Nothing loads from Google until you choose. If you decline or do not choose, nothing is sent to Google. Signing up, signing in, seller store pages, and every page of the signed-in app never use Google Analytics.

Google receives the page you opened as its plain address and title, the website that sent you (its address only, never the page), and a campaign name only when it is one of this site's own labels. When you select a sign-up, sign-in, subscribe, request-access, or email link, or send an access request, Google receives which of those you did and on which page. Your account, email, what you type into forms, and search text are never sent. Like any website, Google also receives the network address and browser details that every connection carries. Google Analytics stores its identifiers in cookies named _ga and _ga_NNEDW3W4GT in this browser.

Google keeps visit-level and identifier-level data for 2 months, the shortest setting it offers, and a new visit does not extend it. Google's summary reports can keep totals longer. Advertising features, Google signals, and ad personalization are off. This is separate from the first-party counter described above, and Google receives nothing from that counter. Google's own terms apply to what it receives: Google Privacy Policy and how Google uses information from sites that use its services.

Your choice is kept in this browser for 180 days, then you are asked again. You can change it here or from Analytics choices at the foot of any public page. Turning it off stops new collection and removes the Google cookies from this browser, including in other open tabs. It cannot recall what was already sent, and it does not delete Google's past records.

Page-use records

While this is on and its daily cleanup is healthy, Pennysleeve also keeps page-use records in its own database to see which links bring visitors, improve features, and fix bugs. They are never sold or sent to any third party, except when required by a lawful order. Public pages store a hash of a random tab visit id, never linked to the counter, your account, email, network address, or request, with each page, time, kind of site that sent you, campaign label, and whether you opened or sent the access request form. Signed in, it stores your account, app page patterns, time, and app version. Detail lasts 14 days, then only anonymous daily page counts remain. Only I, the owner, can read it, including, if you leave Include technical details checked (it is checked by default), your pages from the hour before a bug report.

A visit ends after 30 idle minutes. The next page starts a new visit. Public visits from recognized automated browsers are not recorded. Nothing is recorded when scripts are blocked, and nothing you type in a form is ever recorded. Pages shown with a bug report expire when the original records do. Signed-in page-use records have no separate opt-out. Closing your account deletes their remaining detail.

What is published

Your card list is private until you turn your list on. Listing starts off for every account. Other sharing, such as messages, support and distance lookups, follows the limits above.

With it on, a signed-in buyer searching for a card you hold is shown your shop name or the first five digits of your zip, how far away you are, the contact you published, the matching cards and their quantities and prices, and a street address only if you gave one and said it is a business address. Listing is a choice per card, so a card you hold back is not shown at all. What you paid, what your margin is, and what you made are never part of a listing.

If your store publishes on a selling plan, anyone can open your store page with no account. It shows your shop name, or the words Seller near and your zip when you have none. It always shows your five-digit zip code, and each card you publish with its quantity and price. It also shows when your list was last rebuilt. Only your selected Email, Phone, or Store link is public. It shows no street address or sign-in account identity. In-app messages require a signed-in visitor and your separate opt-in.

Getting your data, and getting rid of it

Inventory and pulls have exports on their pages. In Settings, Business archive downloads your account's current, non-deleted bookkeeping and stock records across both supported games, including receipt filenames. It excludes receipt files, private QR codes and links, and app settings, and cannot restore the app. Archive access expires 24 hours after preparation, and archive storage is set to expire files after one day. Each download link expires separately. File removal and the backup periods below are separate. Contact me if you need help accessing your records.

Contact me to close your account. Closure is handled by hand and removes your account records and sign-in, subject to the billing conditions and exceptions described here. Removing the sign-in prevents a later sign-in from creating a fresh empty account. I will tell you when closure is complete.

When I close an account, I also remove its sign-up security records and paid-plan review records. Security records for a sign-up that never created an account in the app, including an unconfirmed sign-up, need separate cleanup. There is no automatic timed purge.

Six things outlive that. The record of a support view stays, with your account taken out of it, so it says that an administrator looked at an account, and when, and it no longer says which account, so the audit history remains. A deleted receipt file stays recoverable in the store for ninety days before it goes for good, which is the same window that gets a file back after a mistake. The database keeps a backup of the last seven days, so deleted rows sit in a backup for a week and then age out. Before a large change I also take a copy of the whole database by hand, and a copy like that has no expiry of its own: it stays until I delete it. And if I turned down a request for access from your address, that record stays, as the section above says. If your store had an address, the address stays reserved for thirty days after you close, so nobody else can take it and receive your shared links. The reservation keeps the address and an internal number for your closed account. It is removed within a day after the thirty days end.

Scanning a collection label

The QR scanner asks for camera access only after you press Start camera. The picture stays in your browser while it looks for a Pennysleeve collection label. Pennysleeve does not upload, save, or share the camera picture. You can enter the label code instead.

Changes, and reaching me

This notice will change when the service's information practices change. For questions, access to your records, or account closure, email brad@pennysleeve.io.