Privacy Policy

Effective November 6, 2026

SlabZen is a trading card collection, price guide and market app, available at slabzen.app and in our mobile apps. It is operated by Bad Manatee LLC ("SlabZen," "we," "us"). This policy explains what information we collect, why, who we share it with, and the choices you have.

The short version: we collect what we need to run your account and your collection. We don't sell your personal information, and we don't use advertising trackers.

1. Information you give us

• Account details: your email address, username and password, and when you confirmed your email address. We store your password only in a scrambled (hashed) form we can't read.
• Profile: anything you choose to add, such as a display name, bio, profile photo and links to your social accounts.
• Your collection: the cards you add and the details you enter, such as grade, condition, certification and serial numbers, what you paid, when you got it, what you sold it for, notes, and folders you create.
• Photos: pictures you take or upload of your cards, and your profile photo.
• Watchlists and alerts: cards you follow and the price levels you want to hear about.
• Marketing choice: whether you ticked "Send me SlabZen news and deals" when you signed up, and when.
• Sign in with Apple or Google: if you choose one, we receive an account identifier from Apple or Google, your email address and your name. Apple may give us a private relay address instead of your real email. We never see your Apple or Google password.
• Following, likes and safety: who you follow, who follows you, follow requests, the posts you like, accounts you mute or block, and any reports you send us about other users.
• Notification choices: which notifications you want sent to your phone (Settings, then Notifications).
• Purchases: if you subscribe to SlabZen Pro, which plan you have, when it started, renews or ends, whether you bought it in the iPhone app or on our website, whether a renewal payment is currently failing (so we can tell you), and, after a subscription ends, that you had one and whether you ever paid for it or only had the free trial (so we know whether a free trial applies to you, and whether to offer to resubscribe). Apple or Stripe takes the payment itself. We never see your full card number.
• Feedback: problems you report about a card (the card, grade and price you were looking at are included), problem reports about the app with any screenshot you choose to add, and feature ideas.
• Messages to us: anything you send us, for example through support email.

2. Information collected automatically

• Which ad brought you (iPhone app): the first time the app opens, it asks Apple's AdServices framework for a one-time token and sends it to us with a random install ID made on your phone. Apple tells us whether the install came from an Apple Search Ads ad and, if so, which campaign, ad group and keyword, the day the ad was tapped, and the App Store country or region the install came from. This doesn't use your device's advertising identifier or track you across other apps or websites, and Apple doesn't tell us who you are. If you then sign up or log in in the app, we link that install to your account, so we can count which ads lead to sign-ups and subscriptions. We delete the token as soon as Apple has answered, and within 24 hours at most.
• Push notification token: if you allow notifications, your device's notification address and whether it's iPhone or Android, so we can send you alerts.
• With a problem report: your app version, your device model and operating system (or your browser, on the website) and the screen you were on, so we can find the problem. The report shows you this before you send it.
• IP address: used briefly to limit repeated attempts (for example, too many login tries), and to tell which country you're connecting from, so the website only offers its checkout where we sell on the web (the US, for now). We look the country up on our own servers, in the internet registries' public records (published by the NRO), so your address isn't sent anywhere for this. We don't store your IP address, or the country it points to, with your account.
• Server and error logs: our servers keep technical logs of requests and errors so we can keep SlabZen working and secure. When the app or website hits an error or crashes, it sends a crash report so we can fix it (see Sentry in section 4). These may include your account ID and the information a request contained.
• On the website: we keep you signed in by saving a sign-in token in your browser's storage, and our network provider sets one short-lived security cookie. The sign-in page also loads Apple's and Google's sign-in tools. We don't use advertising or analytics cookies. See our Cookie Policy for the full list.

We don't collect your precise location, contacts or microphone audio. Apart from the App Store country Apple reports for an ad install (above), the country check above is the only use we make of where you are. If a photo you upload carries the place it was taken (GPS data), we remove it before storing the photo. The app uses your camera only when you're scanning or photographing a card.

3. How we use it

• To run your account, sign you in and keep it secure.
• To identify the cards you scan and value your collection.
• To send the alerts you've set up, and account emails such as the code that confirms your email address when you sign up, password resets, and a reminder about 2 days before a SlabZen Pro free trial ends.
• To show your profile to other people, following your privacy setting (see section 5).
• To improve the card catalog, when you choose to contribute a photo (see section 5).
• To review reports about users or photos, and keep SlabZen safe.
• To fix wrong card information and problems you report, and consider your ideas. We tell you when we've acted on one.
• To send news and deals, only if you opted in. You can opt out at any time.
• To prevent abuse, fix problems and meet legal obligations.

4. Who we share it with

We don't sell or rent your personal information, and we don't share it with advertisers. We use a few service providers to run SlabZen. They may process your information only to provide their service to us:

We may also share information if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or merger of our business (in which case this policy continues to protect your information).

5. What other people can see

Every SlabZen account has a profile page at slabzen.app/@yourusername. What it shows depends on your privacy setting, which you can change any time in Settings.

• Every account starts private. Anyone, including people without a SlabZen account, can see your username, display name, profile photo, bio, social links, and how many cards, followers and accounts you follow you have. Your cards are shown only to followers you approve.
• If you make your profile public, anyone with the link, including people without a SlabZen account, can see the cards on your profile, and anyone signed in can follow you without asking. We ask search engines not to list profile pages.
• What a profile shows: only cards pictured with your own photos (including catalog photos you contributed), with what each card is and its grade. For a graded card in a slab, it shows the certification number you entered for it (the same number printed on the slab's label), with a link to the grading company's own lookup page where there is one, only if you turn on "Show cert numbers on my public profile" in Settings. It's off unless you turn it on, and you can turn it off any time. A profile never shows prices, values, what you paid, what you sold for, notes, serial numbers, or where you are. You can hide any card from your profile or pin favorites to the top. People who can see your cards can search and sort them on your profile.
• Followers: signed-in users who can see your cards can also see who follows you and who you follow. You can remove a follower without them being told.
• Following feed: when you add cards that appear on your profile, people who follow you see them in their Following feed, grouped by when you added them. When someone follows you, asks to, or accepts your request, we tell them or you in the app and by push notification. Muting someone hides their posts from your feed without telling them.
• Likes: when you like a post, the person who posted it, and anyone who can see that post, can see that you liked it. The person who posted it is told in the app, and by push notification unless they've turned those off.
• Finding people: signed-in users can search for your account by username or display name, unless you've blocked them.
• Blocking: someone you block can't see your profile or follow you, any follow between you ends, and any likes you've left on each other's posts are removed. They aren't told.
• Reports: if someone reports your profile or a photo, our team reviews it. If you report someone, we don't tell them who reported them.
• Feedback is private: card reports, problem reports and ideas you send are seen only by our team, never by other users.
• The rest of your account stays private: your email, watchlists, alerts, prices, sold and traded cards, and cards without your own photos are never shown to other users.
• Contributed photos are public. When you add a photo of a card, a switch labeled "Share this photo with the SlabZen catalog" is on by default whenever the photo is a plain photo of the card (not of a slab or holder). If you leave it on and our team approves the photo, it becomes part of the SlabZen catalog, and everyone who looks at that card sees it. The catalog doesn't show your name with it, but the photo can appear on your own profile with your card. Turn the switch off for any photo you want to keep on your own card only. You can change this choice for each photo before you add it. A photo you add to a card that isn't in your collection has nowhere private to go, so it's always a catalog submission.
• Anyone you share a link with, such as a profile, card or photo link, can open it.

6. Links to other sites

Some links, such as "find it on eBay," take you to other websites. Some are affiliate links: if you buy something, we may earn a commission at no cost to you. Those sites have their own privacy practices, and eBay may set its own cookies when you follow our links.

7. Our YouTube and TikTok accounts

We use YouTube API Services to run our own YouTube channel, @SlabZen. YouTube is part of Google, so the Google Privacy Policy applies too.

• What we access: our own tool, SlabZen Uploader, signs in only with the Google account that owns the SlabZen channel. Through the YouTube API it uploads our videos, sets their titles, descriptions, tags, thumbnails, playlists and publish times, reads our own videos' details and performance numbers, and posts comments on our own videos. It never accesses anyone else's YouTube account or data, and we don't offer it to anyone else.
• What we store: a sign-in token for our own channel, kept on our own server, and our own videos' titles, schedules and performance numbers, kept for our planning. We don't sell or share this information. Data we get from the YouTube API is refreshed or deleted within 30 days, except our own channel's analytics, which we keep for reporting.
• Viewers' devices: we don't store or read information on the devices of people who watch our videos, and no one else serves content or advertising through this tool.
• Removing access: access can be removed at any time on Google's security settings page.
• Questions or complaints: email [email protected].

TikTok. We also run the @slabzen TikTok account. To post our own videos there and see how they perform, we use TikTok's Login Kit and Content Posting API through a private tool that is signed in to the @slabzen account only. The tool can read that account's basic profile and statistics (such as follower and like counts), list our own videos with their view, like, comment and share counts, and upload our own videos to the account as drafts or posts. It never accesses anyone else's TikTok account and does not collect information about people who watch, like or comment on our videos. The sign-in token is kept on our own systems and is never shared or sold. We keep our own account's statistics for planning and reporting, and refresh or delete any other data received from TikTok within thirty days. The @slabzen account holder can remove the tool's access at any time in TikTok's settings. Questions: [email protected].

8. How long we keep it

• We keep your account information for as long as you have an account.
• Cards you mark as sold or traded stay in your history, so you can see your results, until you delete them or your account.
• When you replace or remove a photo, delete a card or a gallery photo, or change or remove your profile photo, we delete the old photo file within about a day. A photo is kept while it's still in use: if you submitted it to the catalog, it stays with that submission (you can see it in your submission history) until you delete your account, and if it was approved it stays in the public catalog.
• When you delete your account, we unlink it from the install's ad record. What's left is only Apple's campaign details and the random install ID, which can't identify you.
• Password reset links expire after one hour. Email confirmation codes expire after 15 minutes, and we store only a scrambled form of each code.
• When you delete your account, your account, profile, collection, photos, watchlists, alerts, follows, likes, blocks and ZenPoints are deleted right away (if our photo storage is briefly unavailable, we keep retrying until the photo files are gone), reports, problem reports and ideas you sent are kept without your name (any screenshots are deleted), and records of edits you made are kept without your name. Copies can remain in backups until they cycle out, and briefly in our image delivery network's cache (up to an hour). We keep information the law requires us to keep, and photos you contributed to the public catalog stay in the catalog without your name.
• When you delete your account we also ask RevenueCat to delete its record of your purchases. Apple and Stripe keep their own payment records, as the law requires. Deleting your account doesn't cancel a subscription: cancel it first (see our Terms).

9. Your choices and rights

• Access and edit: you can view and change your profile and collection in the app at any time.
• Delete your account: in the app or on the website, open Settings and choose Delete account. It takes effect immediately. You can also email [email protected] from your account's email address.
• Marketing: use the unsubscribe link in any marketing email, or contact us.
• Who sees your profile: switch "Private account" on or off in Settings, hide individual cards from your profile, remove followers, and block accounts.
• Notifications: choose which ones reach your phone in Settings, then Notifications, or turn them all off in your device settings.
• Get a copy or ask a question: email us. Depending on where you live, including California and the European Union, you may have additional rights, such as correcting your information or getting a copy of it. We honor those requests and won't treat you differently for making one.

10. Security

We use encryption in transit, hashed passwords and restricted access to protect your information. No service can be perfectly secure, so please use a password you don't use anywhere else.

11. Children

SlabZen is not for children under 13, and we don't knowingly collect information from them. Every account starts private, so a teen's cards are only seen by followers they approve unless they choose otherwise. If you believe a child under 13 has created an account, email [email protected] and we'll delete it.

12. Where your information is processed

SlabZen is based in the United States, and our providers process information in the United States. If you use SlabZen from another country, your information will be transferred to the United States.

13. Changes to this policy

If we make meaningful changes, we'll update the date at the top. If a change is significant, we'll also tell you in the app or by email before it takes effect.

14. Contact

Bad Manatee LLC
Email: [email protected]