Privacy Policy

What we collect

Account: your email address, used to send sign-in codes and to contact you about your account. If you sign in with Apple or Google, we receive the email address they share with us (with Apple’s Hide My Email, a private relay address) and nothing else from those accounts.

Profile: your username, display name, bio and profile photo. These are public.

What you post and do: posts, card photos, comments, likes, reposts, follows, stories (photos and videos, any place name you tag and people you mention), and reports you file. Stories are removed after 24 hours.

Messages: direct messages and photos you send, stored so the people in the conversation can see them. We may review messages that are reported to us.

Your collection: cards you add, grades, cert numbers and photos. Cert numbers are checked with the grading company.

Activity in the app: which posts are viewed and for how long, and your notification settings. We use this to rank the feed and leaderboards.

Approximate location: when you open the app, our website host estimates the city, region and country your internet connection is in from its IP address. We keep that city once, the first time, to see where our community is growing. We don’t store your IP address or your precise location.

Location you choose to share: when you tag a story, your phone turns your position into a place name such as "Austin, Texas", and only that name is saved. When you check in at a card show, your position is checked against the show’s address to confirm you’re there, and not kept.

Camera: Show Mode and card scanning read cards with your phone’s camera. The photo is read on your phone; only the words and numbers on the card are sent to find a match, and the photo isn’t uploaded unless you add it to a post or your binder.

Device: a push notification token if you allow notifications, and the days you open the app. Recent searches stay on your device.

Website ads measurement: slabsocial.com uses the Meta Pixel, which sets cookies and tells Meta (Facebook) which of our pages you visit and when you tap through to install the beta, so we can see whether our Facebook ads work and show them to people likely to be interested. Meta may link this to your Facebook or Instagram account under its own privacy policy. It also uses the Reddit Pixel, which sets cookies and tells Reddit which of our pages you visit and when you leave your email on the beta page (with a scrambled, one-way hashed copy of that email, so Reddit can match the sign-up to its ad without receiving the address), so we can see whether our Reddit ads work; Reddit may link this to your Reddit account under its own privacy policy. And it uses Google Analytics, which sets cookies and tells Google which pages you visit, roughly where from, and what device and browser you use, so we can see how many people visit and where they came from. The admin pages don’t use any of these, and the Slab Social app doesn’t use advertising or tracking tools at all.

Beta page: when you visit slabsocial.com/beta, we count which steps are tapped (for example Get TestFlight), with only the kind of device, the app the page was opened in, and the ad it came from. No cookies, names, IP addresses or other identifiers are kept. If you give us your email there, we keep it with the phone you picked and the ad you came from, to send you the download link and Slab Social news such as the Android launch and giveaway results; ask us and we’ll delete it.

How we use it

To run Slab Social: sign you in, show your profile and posts, deliver messages and notifications, verify graded cards, build feeds, search and leaderboards, keep the service safe, act on reports and enforce our Terms, and fix problems.

Who we share it with

Other people on Slab Social see your public profile and what you post. Messages are visible to the people in that conversation.

Service providers that run parts of Slab Social for us, only for that purpose: Supabase (database, sign-in and file storage), Vercel (our website, share links, and the approximate city when you open the app), Mux (video processing and streaming), Expo and Apple or Google (push notifications and sign-in), the grading companies we check cert numbers with (such as PSA), Meta, Reddit and Google (the pixels and analytics on our website, described above), and OpenStreetMap services (Photon and Nominatim) that turn card show addresses into map positions. Card details and pictures come from public card databases (such as the Pokémon TCG data set and TCGdex) and CardSight AI, and prices from PokemonPriceTracker and SportsCardsPro; we don’t send them your personal information.

We may share information if the law requires it, to protect people’s safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Keeping and deleting it

We keep your information while your account exists. Delete a post, comment or story and it’s removed. Delete your account in Settings and your profile, posts, comments, stories, collection, photos and the messages you sent are deleted. Copies may remain in backups for up to 30 days.

Your choices and rights

You can edit your profile, delete content, change notification settings, block or mute people, and delete your account in the app. To turn off the website pixel and analytics, use Your privacy choices at the foot of any page on slabsocial.com; it applies to that browser. We treat a Global Privacy Control signal from your browser the same way. Visitors in the EU, EEA, UK and Switzerland are asked first, and neither runs until they accept. You can also block cookies in your browser or use the ad settings in your Facebook account (Settings → Ad preferences). Depending on where you live you may have rights to access, correct, delete or export your information, or to object to some uses. To make a request, email us.

Children

Slab Social isn’t for children under 13, and we don’t knowingly collect their information. If you believe a child under 13 has an account, contact us and we’ll delete it.

Security, changes and contact

We use encryption in transit and access controls to protect your information, but no system is perfectly secure.

We'll post changes to this policy here and tell you in the app if they're significant. Questions or requests: support@slabsocial.com.