Privacy Policy

In the current beta:

- Slab does not process purchases between buyers and sellers;

- Slab does not collect payment-card or bank-account information;

- Slab does not use advertising trackers or analytics tracking;

- Slab does not currently sell personal information or use it for targeted advertising;

- buyers can browse public shops without creating an account; and

- browser storage is used only for the sign-in session of a logged-in seller.

Seller shop pages are public. Information displayed on them can be viewed by anyone who obtains the page URL.

When you create or use a seller account, Slab maintains account and authentication information that may include:

- email address;

- a one-way hash of your password;

- email-verification status;

- Slab user identifier;

- account sign-up date and time;

- most recent sign-in date and time; and

- IP address captured when you sign in.

Slab does not store your password as readable plain text.

A seller profile may contain:

- seller or shop name;

- tagline;

- Slab shop web address;

- profile creation date;

- five seller display settings or toggles; and

- a link to the seller's avatar image.

Some of this information is intentionally displayed publicly as part of the seller's Slab shop.

If you upload an avatar, the image file is stored in Slab's seller-avatars storage bucket. Avatar files are publicly readable by URL.

A person who has the image URL may be able to access the file outside the normal Slab shop interface. Do not upload an avatar that you intend to keep private.

Slab stores inventory information associated with a seller account. Depending on the card and the information entered or retrieved, a record may include:

- card name, set, number, type, image, rarity, and language;

- asking price, condition, and quantity;

- purchase price and purchase date;

- sold status, sold date, and sold price; and

- market-price and graded-price figures, including related timestamps.

Because these records are associated with an identifiable seller account, Slab treats them as seller data even when a field primarily concerns business inventory.

Some inventory information appears on the public shop. Other information is used for seller inventory or bookkeeping functions. What a visitor can see depends on the current shop interface and the seller's display settings.

If you join the Slab waitlist, we store your email address and the date you joined. Joining the waitlist does not create a seller account.

The waitlist is separate from account registration and does not technically gate account creation. We may use waitlist information to contact you about Slab access, beta availability, or relevant Slab updates.

Slab does not currently operate checkout or payment processing. Slab therefore does not collect or store credit-card numbers, debit-card numbers, bank-account numbers, or buyer payment credentials through the Service. Sales occur outside Slab.

A buyer does not need to sign in to browse a public Slab shop. Slab does not currently use analytics or advertising tracking on those visitors.

A person who browses a public shop without signing in does not receive a Slab seller sign-in session, and Slab does not place Slab application data in that person's browser storage.

Internet hosting and network infrastructure may necessarily process technical request information to deliver a page. Slab does not currently use that information to build advertising profiles or behavioral analytics about public-shop visitors.

Slab does not currently use analytics cookies, advertising cookies, or similar technologies for behavioral advertising.

For a logged-in seller, Slab uses browser storage associated with the authentication session so the seller can remain signed in and use authenticated features. Buyers who never sign in do not have a Slab seller authentication session stored in their browser.

Slab does not currently display a cookie-consent banner because the current Service does not use analytics or advertising tracking. If that changes, Slab may update the technology and this Policy as required.

Slab uses personal information to:

- create, authenticate, and verify seller accounts;

- maintain seller sign-in sessions;

- operate profiles and public shop pages;

- store and manage seller inventory;

- provide inventory-management and bookkeeping features;

- display information a seller chooses or configures to publish;

- retrieve card-pricing information;

- maintain security, prevent misuse, troubleshoot, and operate the Service;

- communicate about accounts, the beta, and the Service;

- respond to support, legal, and privacy requests;

- comply with legal obligations; and

- protect Slab, users, and the Service.

Slab does not currently use seller or buyer information for targeted advertising.

Slab uses third-party providers to operate the Service:

Supabase. Slab uses Supabase for database services, authentication, storage, and file hosting. Supabase infrastructure processes and stores seller account information, profiles, inventory records, authentication data, and uploaded files as needed to provide those functions.

Lovable. Slab uses Lovable for deployment and hosting. Hosting infrastructure may process page requests and technical information necessary to deliver Slab pages and application functions.

PokemonPriceTracker. Slab uses PokemonPriceTracker to obtain card-pricing information. For a lookup, Slab sends only the card name, set, card number, and language. Slab does not send the seller's identity, email address, contact information, purchase price, asking price, or seller-specific transaction information as part of that lookup.

Authentication email delivery. Slab uses a managed authentication email sender for messages such as email verification and authentication emails. The sender receives the email address and technical message information needed to deliver the message.

Slab may also disclose information to professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect legal rights, address security or fraud, or operate the Service as described in this Policy.

Slab's primary database and stored files use infrastructure located in AWS US East (Ohio), United States.

Slab's hosting is edge-distributed. Page requests may therefore be served or processed through infrastructure in other regions or countries depending on where a visitor accesses the Service. Information may be processed outside the state, province, or country where you live, and those places may have different data-protection laws.

Slab is designed to let sellers publish shops that buyers can browse. Information displayed on a public shop should be treated as public. This may include a seller or shop name, tagline, avatar, shop web address, and displayed inventory information.

An avatar file is also publicly readable through its file URL. Slab cannot control what another person does after viewing, copying, photographing, screenshotting, saving, or otherwise obtaining information from a public page. Do not place sensitive or private personal information on a public shop.

The current beta does not have an automatic retention or expiration schedule. Account information, seller profiles, inventory records, waitlist information, authentication records, and uploaded files do not currently expire automatically.

Information may remain stored indefinitely unless you request deletion, Slab manually removes it, it is removed during account closure or system maintenance, or Slab is legally required to delete or retain it.

Retention practices may change as the Service develops. If Slab adopts specific retention periods, this Policy will be updated as appropriate.

Slab does not currently offer self-service account deletion. To request deletion of an account or personal information, email matt@getslabapp.com.

Deletion requires manual action because Slab data exists in separate systems. Depending on the account, deletion may require separate removal of:

1. application, profile, and inventory records;

2. the authentication or login record; and

3. uploaded files, including an avatar.

If the same email address appears on the Slab waitlist, that record may also need separate removal. Deleting an application profile alone does not automatically delete the authentication record or avatar file. Slab will process applicable requests across the relevant systems rather than treating the removal of one record as deletion of the entire account.

Slab may ask you to verify control of the account before completing a request. Slab will respond within the time required by applicable law. Some information may be retained where required or permitted by law, including for security, fraud prevention, legal claims, or compliance obligations.

Depending on where you live and which laws apply to Slab, you may have the right to:

- request access to personal information Slab maintains about you;

- request correction of inaccurate information;

- request deletion;

- obtain a copy of certain information;

- learn about categories of information Slab processes or discloses;

- opt out of certain processing where applicable; and

- appeal certain privacy-request decisions where applicable law provides that right.

To make a privacy request, email matt@getslabapp.com and include enough information for Slab to identify the applicable account or record. Slab may request reasonable verification before providing, changing, or deleting information.

Where applicable law provides an appeal right, send an appeal to matt@getslabapp.com with "Privacy Appeal" in the subject line. Slab will not unlawfully discriminate against you for exercising an applicable privacy right.

Slab does not currently sell personal information, share personal information for cross-context behavioral advertising, or process personal information for targeted advertising. Slab also does not currently operate third-party advertising trackers on public shop pages.

If Slab's business model or advertising practices change, Slab will update this Policy and provide notices or choices required by applicable law before using personal information in a materially different way.

Slab uses technical and organizational measures intended to protect information in a manner appropriate to the nature of the Service. For example, account passwords are maintained as one-way password hashes rather than readable passwords.

No internet service, database, storage provider, or transmission method can be guaranteed completely secure. You are responsible for protecting your credentials and should contact Slab if you believe your account has been accessed without authorization.

Seller accounts are limited to people who are at least 18 years old. Slab does not knowingly permit a person under 18 to operate a seller account. Public shop pages can be browsed without creating an account.

If you believe Slab collected personal information through an account operated by someone under 18, contact matt@getslabapp.com.

Slab may preserve or disclose information when reasonably necessary to:

- comply with applicable law, regulation, subpoena, court order, or lawful government request;

- investigate fraud, abuse, or a security incident;

- enforce the Terms of Service;

- protect the rights, property, or safety of Slab, users, or others; or

- establish, exercise, or defend legal claims.

Where practical, Slab will disclose only information reasonably relevant to the applicable purpose.

If Slab is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be transferred to a successor, purchaser, affiliate, or other participant in that transaction.

Any recipient remains subject to applicable privacy law and obligations applying to the transferred information. Where required by law, Slab will provide notice of a material change in who controls personal information.

Slab may update this Policy when the Service, technology, providers, or applicable laws change. The effective date at the top will be updated when changes are made.

If a change materially affects how Slab uses existing personal information, Slab may provide additional notice through the Service, by email, or by another reasonable method as appropriate.

Privacy requests, deletion requests, questions, support requests, and legal inquiries may be sent to matt@getslabapp.com.