Privacy

The data controller is Luke Bailey, trading as SlabShield, 41 St Edward Street, Leek, Staffordshire, ST13 5DN, United Kingdom. You can reach us at support@slabshield.co.uk or on 07561 700006.

Your account. Email address, username, display name, password ( stored hashed — we never see it), and anything you choose to add such as a bio, avatar, banner or social links.

Your collection. The cards you add, their grades and certification numbers, what you paid, your own notes, photographs you upload, wishlists and collections.

What you do here. Follows, likes, messages, trade offers, battle entries and challenge progress.

Payment. If you subscribe, Stripe processes the payment and we store only your Stripe customer and subscription identifiers plus whether the membership is active. We never receive or store your card number.

Notifications. If you turn on weekly updates, we store the notification token your browser or your phone hands us, so the digest can be delivered. It identifies the install rather than you, and it is deleted when you turn notifications off, when you delete your account, or as soon as it stops working. We do not use it for anything else, and turning notifications off is the whole of opting out.

This is the one worth reading twice. When you scan a card, the photograph is sent to an external AI provider so it can read the card and label. That transfer is necessary to provide the feature — it is how scanning works at all.

We do not send your name, email or account details with it. We keep a record that a scan happened, so the monthly allowance can be counted.

Our provider is Anthropic, based in the United States, so this involves an international transfer protected by the safeguards in our provider agreement. If you would rather your photographs did not leave, do not use the scanner — you can add every card by hand and lose nothing but the convenience.

If your Vault is set to public, your username, display name, avatar, banner, bio, social links, badges, level and the cards you have marked public — including their estimated values — can be seen by anyone on the internet, and may be indexed by search engines.

A private Vault is visible only to you. You can switch between the two at any time in settings, though search engines may hold a copy of a previously public page for a while afterwards.

To provide the Vault you have asked for — that is performance of our contract with you, and covers your account, your collection and your membership.

To keep the service working and safe — our legitimate interest in preventing abuse, debugging, and stopping somebody granting themselves a paid membership.

To meet legal duties, such as keeping records of payments for tax.

Where we ask for consent — for example marketing email — you can withdraw it at any time.

We do not sell your data. We share it only with the services that make the Vault run: Supabase stores the database and handles sign-in, Vercel hosts and serves the site, Stripe takes payments, Anthropic reads scanned photographs, and Scrydex supplies catalogue information and prices — we send it the card you are looking up, never anything about you.

Some of these are based outside the UK. Those transfers rely on the safeguards in our agreements with them, such as the UK addendum to the standard contractual clauses.

Your account and collection stay until you delete them. You can delete the account yourself, in the app or in a browser, from Vault settings — it happens immediately and removes your profile, collection, photographs, messages and activity. The deletion page lists exactly what goes and what has to be kept.

Payment records are kept for six years because tax law requires it. Scan counts are kept while your account exists so the monthly allowance works. Server logs are kept briefly for debugging.

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or ask for it in a portable format. Deleting it needs no request at all — it is a button in Vault settings. Vault Pro includes a collection export, and we will provide the rest on request.

Email support@slabshield.co.uk. We will respond within one month. If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk.

We use cookies to keep you signed in and to remember your preferences. These are strictly necessary for the Vault to work and cannot be turned off without breaking sign-in.

We use no analytics, advertising or tracking cookies, and nothing here follows you to other websites. That is also why you are not asked to accept anything: there is nothing to accept.

The Vault is not for under-16s. If you believe a child has created an account, tell us and we will remove it.

We will update this page when what we do changes, and change the date at the top. If a change is significant — a new provider receiving your data, for instance — we will email you. Our terms of use sit alongside this.