Privacy Policy

This Privacy Policy explains what information Elitra Cards LLC ("Elitra," "we," "us") collects when you use the Elitra website and app (the "Platform"), how we use it, and the choices you have. By using the Platform you agree to this policy.

Account info — username, email, and a securely hashed password.

Email updates — if you sign up for drop/update emails (on the homepage or the /join page), we collect just your email address, used to send those updates, plus the short tag of the link you signed up through, if it had one (for example, a link shared by a card shop), so we know which links work. To be removed from this list, contact support@elitracards.com.

Listing & transaction info — cards you list, bids you place, purchases, and shipping details you provide for a sale.

Payment info — handled directly by Stripe; Elitra does not store full card numbers.

Reports & disputes — if you report a listing/seller or file a dispute, we collect what you submit (reason, details) along with the account or listing it concerns. See Section 6.5 for how long this is kept. A dispute filed against your account, or a listing removed by Elitra staff as a result of a report, both trigger a real notification to you with a chance to respond — see Terms of Service Section 13 for how account-level appeals work. A report by itself, before any action is taken, doesn't automatically notify the reported party.

IP address & device info — your IP address and basic browser info are used when you make requests, to keep the Platform secure, prevent fraud and shill bidding, and limit abuse (rate limiting). The IP address of the account that creates a listing is stored with that listing for the same reasons. Stored IP addresses are cleared after 90 days. If an error occurs while you use the Platform, our error-monitoring provider (Sentry) may also receive the page URL, browser/device info, and IP address tied to that error so we can fix it — not for ads or analytics.

Shipping & tracking — the tracking number a seller adds is sent to our tracking provider to follow the package and confirm delivery.

Usage data — pages viewed, listings viewed, and basic device/browser info, used to keep the Platform working and to help rank which listings show as Featured. A listing's view count itself isn't shown publicly, but if you like a post on the Feed, that like count is shown publicly on that post.

To operate the marketplace (listings, bidding, purchases, disputes), to communicate with you about your account or transactions, to keep the Platform secure and prevent fraud or shill bidding, and to improve the product. We do not sell your personal information to third parties.

We share information with service providers who help run the Platform — for example Supabase for account, database, and authentication services; Stripe for payments, payouts, and sales tax; Resend for emails (account confirmation, password reset, notifications, reports, disputes, and drop/update emails); EasyPost for package tracking; Upstash for rate limiting (which processes IP addresses); Twilio for text alerts, only if you turn them on once that feature is available; Vercel for hosting; Sentry for application error monitoring (which may receive the page URL, browser/device info, and IP address associated with an error, so we can find and fix crashes — not for advertising) — only as needed to provide the service, and we may disclose information if required by law or to investigate fraud, shill bidding, or other Terms of Service violations.

Listings, sales, and account information (username, shipping info, membership status, purchase history, and watchlist) are stored securely on our servers via our database provider, Supabase. A few things are stored locally in your browser instead — your theme preference (light/dark mode), a list of recently viewed cards, an in-progress listing draft if you leave the Sell page partway through, and your Tall Grass Dash high score. None of this is shared with anyone or used for tracking. Your sign-in session itself is also stored locally — in your browser's local storage and in a cookie readable by the site's own JavaScript, which is how Supabase's authentication system keeps you signed in between visits. This doesn't expose your password (Elitra never sees or stores that directly), but it does mean the session token itself lives in your browser rather than in a way only the server can read.

Elitra currently uses only strictly-necessary cookies — the sign-in session cookie described above, and, while the Platform is in early access, a cookie that remembers you entered the early-access code — and nothing for advertising or cross-site tracking. There's no analytics or ad-tracking cookie today. If that changes, this section will be updated first and, where legally required, a consent option will be added before any such cookie is set.

You can update your account information from the Account page. You can clear locally stored data at any time by clearing your browser's site data for this domain.

Requesting a copy of your data, or its deletion — Email support@elitracards.com from the email address on your account and say whether you want a copy of your personal data or want it deleted. We may ask you to confirm the request from that address before acting on it, and we'll respond within a reasonable time and within any deadline the law that applies to you sets.

Self-serve account deletion — You can also delete your account yourself: Account → Settings → Delete account, then confirm with your current password. Deletion isn't available while you have an open order, an open dispute, an active auction with bids, or an unpaid auction win (see Terms of Service Section 13.1). When you delete your account:

• Deleted or removed: your sign-in account and email address, your username (replaced with an anonymous “deleted-” name), shipping address, phone number, saved card (removed from Stripe), notification preferences, watchlist, saved searches, follows, likes, notifications, game scores, Verified Shop applications, and any email-list signup. Memberships and shop plans are cancelled, your active listings are taken down, and your open offers and bids are withdrawn.
• Kept for 7 years: records of sales and purchases, payments, payouts and fees, ratings, disputes, reports, strikes and moderation records, and the messages you exchanged with other users. These are kept to meet tax and accounting record-keeping requirements, to handle chargebacks, refunds and legal claims, and to prevent fraud. They show the anonymous name instead of your username, and the shipping address on your past purchases is removed. We also keep a minimal record that an account was deleted (its internal ID, the anonymous name, the date, and the IDs of its Stripe customer and payout accounts) so those records can be matched up if needed. Stripe keeps its own payment records under its own privacy policy.
• IP addresses: cleared after 90 days whether or not you delete your account.

Do Not Sell or Share — Elitra does not sell your personal information, and does not share it for cross-context behavioral advertising (the kind of "sharing" California's CPRA covers). If that ever changes, this policy will be updated first (see Section 8) and a clear opt-out will be provided.

Roughly how long different kinds of data stick around after you stop actively using the Platform:

• Account/profile data — kept for the life of the account; deleted or anonymized when you delete your account (see Section 6).
• Transaction records (sales, payouts, fees) — retained at least 7 years, the standard tax record-keeping window.
• Messages between users — retained, since either party may need them for a dispute; after an account is deleted, its messages are kept for 7 years under the anonymous name (see Section 6).
• IP addresses — cleared after 90 days.
• Reports and disputes — retained at least as long as the underlying transaction/account, to detect repeat patterns (see disputePatterns in how moderation works).
• Listing photos — deleted when a never-sold listing is deleted by its seller; retained as part of the permanent sale record for anything that sold (see Terms of Service Section 7.1).
• Drop/update emails list (Section 4) — kept until you ask to be removed.

The Platform requires users to be 18 or older (see Terms of Service, Section 2.1) and is not directed at anyone younger. We do not knowingly collect information from anyone under 18. If we discover or have reason to believe an account belongs to someone under 18, we terminate the account and delete the associated personal data as described in Terms of Service Section 2.1.

We may update this policy as the Platform develops. Material changes will be noted here with an updated date.

Questions about this policy: support@elitracards.com