Privacy Policy

This Privacy Policy explains what information Elitra Cards LLC ("Elitra," "we," "us") collects when you use the Elitra website and app (the "Platform"), how we use it, and the choices you have. By using the Platform you agree to this policy.

Account info — username, email, and a securely hashed password.

Email updates — if you sign up for drop/update emails on the homepage, we collect just your email address, used to send those updates. To be removed from this list, contact support@elitracards.com.

Listing & transaction info — cards you list, bids you place, purchases, and shipping details you provide for a sale.

Payment info — handled directly by Stripe; Elitra does not store full card numbers.

Reports & disputes — if you report a listing/seller or file a dispute, we collect what you submit (reason, details) along with the account or listing it concerns. See Section 6.5 for how long this is kept. A dispute filed against your account, or a listing removed by Elitra staff as a result of a report, both trigger a real notification to you with a chance to respond — see Terms of Service Section 13 for how account-level appeals work. A report by itself, before any action is taken, doesn't automatically notify the reported party.

Usage data — pages viewed, listings viewed, and basic device/browser info, used to keep the Platform working and to help rank which listings show as Featured. A listing's view count itself isn't shown publicly, but if you like a post on the Feed, that like count is shown publicly on that post.

To operate the marketplace (listings, bidding, purchases, disputes), to communicate with you about your account or transactions, to keep the Platform secure and prevent fraud or shill bidding, and to improve the product. We do not sell your personal information to third parties.

We share information with service providers who help run the Platform — for example Supabase for account, database, and authentication services; Stripe for payments; Resend for transactional emails (reports, disputes, and drop/update emails); Vercel for hosting — only as needed to provide the service, and we may disclose information if required by law or to investigate fraud, shill bidding, or other Terms of Service violations.

Listings, sales, and account information (username, shipping info, membership status, purchase history, and watchlist) are stored securely on our servers via our database provider, Supabase. A few things are stored locally in your browser instead — your theme preference (light/dark mode), a list of recently viewed cards, an in-progress listing draft if you leave the Sell page partway through, and your Tall Grass Dash high score. None of this is shared with anyone or used for tracking. Your sign-in session itself is also stored locally — in your browser's local storage and in a cookie readable by the site's own JavaScript, which is how Supabase's authentication system keeps you signed in between visits. This doesn't expose your password (Elitra never sees or stores that directly), but it does mean the session token itself lives in your browser rather than in a way only the server can read.

Elitra currently uses only strictly-necessary cookies — the sign-in session cookie described above, and nothing for advertising or cross-site tracking. There's no analytics or ad-tracking cookie today. If that changes, this section will be updated first and, where legally required, a consent option will be added before any such cookie is set.

You can update or delete your account information from the Account page. You can clear locally stored data at any time by clearing your browser's site data for this domain.

Do Not Sell or Share — Elitra does not sell your personal information, and does not share it for cross-context behavioral advertising (the kind of "sharing" California's CPRA covers). If that ever changes, this policy will be updated first (see Section 8) and a clear opt-out will be provided.

Roughly how long different kinds of data stick around after you stop actively using the Platform:

• Account/profile data — kept for the life of the account, deleted or anonymized within a reasonable period after account deletion (subject to Section 7's current limits on what deletion can technically remove).
• Transaction records (sales, payouts, fees) — retained at least 7 years, the standard tax record-keeping window.
• Messages between users — retained for the life of the account, since either party may need them for a dispute.
• Reports and disputes — retained at least as long as the underlying transaction/account, to detect repeat patterns (see disputePatterns in how moderation works).
• Listing photos — deleted when a never-sold listing is deleted by its seller; retained as part of the permanent sale record for anything that sold (see Terms of Service Section 7.1).
• Drop/update emails list (Section 4) — kept until you ask to be removed.

The Platform requires users to be 18 or older (see Terms of Service, Section 2.1) and is not directed at anyone younger. We do not knowingly collect information from anyone under 18. If we discover or have reason to believe an account belongs to someone under 18, we terminate the account and delete the associated personal data as described in Terms of Service Section 2.1.

We may update this policy as the Platform develops. Material changes will be noted here with an updated date.

Questions about this policy: support@elitracards.com