Privacy Policy
Last updated: October 8, 2026
VendBuddy ("we," "our," or "us") operates the VendBuddy website and mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
1. Information We Collect
Account Information
When you create an account, we collect your email address and, optionally, your display name. If you sign in with a third-party provider (Google, Discord, or Apple), we receive your name and email from that provider. We do not store your passwords — authentication is handled securely by Supabase Auth.
Vendor Business Data
If you use VendBuddy as a vendor, we store the data you enter to manage your business: card inventory, deals, events, pricing, barcode labels, and related records. This data is associated with your vendor account and isolated from other vendors via row-level security.
Card Images (Camera)
When you use the card scanner, your device camera captures a photo of the card and sends it to our server, which identifies the card (name, set, and number) with our own image-recognition model. Some photos are also sent to Anthropic's Claude AI: to identify a card our model can't, or to check a sample of our model's answers.
We keep scan photos to improve card recognition:
- When a scan is matched to a card in our catalog, we store the photo with that match and use it to train and test our recognition model.
- When a scan goes wrong, we store its photos with a problem report so we can find out why. A report is filed when you reject a match and when a scan finds no match.
Our team may review these photos for those purposes. They are photos of your cards, but anything else in the frame is captured too. Scan photos are stored with your account and deleted when you delete it. We do not sell them or use them for advertising.
Automatically Collected Information
We collect crash reports and basic performance diagnostics via Sentry to identify and fix bugs. This data includes device type, OS version, app version, and error stack traces. It does not include personally identifiable information.
We use Amplitude to understand how the Service is used: the pages and screens you visit, the features you use, and basic device and browser information. When you are signed in, this activity is linked to your account. On the website, Amplitude also receives your IP address, from which it derives an approximate location, and records sessions (clicks, scrolling, and page navigation) so we can find and fix usability problems. Anything you type into a form is masked in these recordings before it leaves your browser.
On the website, we and our partners also use cookies, described in Cookies and Similar Technologiesbelow. The mobile app does not use advertising identifiers or track you across other companies' apps or websites.
2. How We Use Your Information
- To provide, operate, and maintain the Service
- To create and manage your account
- To process transactions and manage subscriptions via Stripe
- To send transactional communications (e.g., password resets)
- To identify and fix bugs via crash reporting
- To improve our card recognition, including by training it on scan photos
- To understand how the Service is used and improve it
- To measure our marketing and show VendBuddy ads on other websites
- To respond to your support inquiries
- To enforce our terms and protect against misuse
3. How We Share Your Information
We do not sell your personal information for money. We share data with the following service providers, which process it on our behalf to operate and improve the Service:
- Supabase — database hosting, file storage (including scan photos), and authentication
- Vercel — website hosting
- Fly.io — server hosting
- Stripe — payment processing (we never see or store your full card number)
- Apple — in-app purchases and subscriptions on iOS
- Resend — email delivery, including replies you send to our emails
- Sentry — crash reporting and error tracking
- Amplitude — product analytics and website session recordings
- Google Analytics — website analytics
- Anthropic (Claude) — AI card identification from scan photos
- Expo / EAS — mobile app build, update delivery, and push notifications
On the website, we also let Google set advertising cookies. These allow Google to collect cookie identifiers, your IP address, and the pages you visit, so we can measure our marketing and show you VendBuddy ads on other websites. Under some US state privacy laws, this may count as "selling" or "sharing" personal information, or as targeted advertising. You can opt out at any time, as described in Cookies and Similar Technologies.
We may also disclose information if required by law, legal process, or to protect the rights and safety of our users.
4. Cookies and Similar Technologies
Cookies are small files a website stores in your browser. Our website uses three kinds:
- Strictly necessary— keep you signed in, protect your account, and remember your cookie choices. These are always on.
- Analytics— set by Google Analytics and Amplitude to tell us how the website is used.
- Advertising— set by Google to measure our marketing and show you VendBuddy ads on other websites.
If you arrive through a link from a VendBuddy partner, we also set a cookie for 60 days so we can credit that partner if you sign up.
Your Choices by Region
- In the European Economic Area, the United Kingdom, Switzerland, and Quebec, we set analytics and advertising cookies only after you accept them in our cookie banner, and you can withdraw that consent at any time.
- Everywhere else, including the United States, analytics and advertising cookies are on by default, and you can turn either off at any time.
We determine your region from your IP address when you visit.
Changing Your Choices
Use the link below, or the "Cookie preferences" or "Your Privacy Choices" link at the bottom of our public pages. Your choices are stored in a cookie, so they apply only to the browser and device where you make them, and clearing your cookies resets them.
Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information and keep advertising cookies off in that browser. The older "Do Not Track" browser signal has no agreed standard, so we do not respond to it.
To learn how Google uses information from websites that use its services, see Google's explanation.
5. Public Profiles
Vendors can opt in to a public profile at /v/{handle}. When enabled, your display name, bio, and in-stock inventory are publicly visible. You can disable your public profile at any time from your profile settings.
6. Data Retention
We retain your account and business data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., financial transaction records).
Cookies expire on their own schedule (Google Analytics cookies, for example, last up to two years) or when you clear them. We keep analytics data only as long as it helps us understand and improve the Service.
7. Data Security
We use industry-standard security measures to protect your data, including encrypted connections (TLS), row-level security policies on all database tables, and secure authentication via Supabase Auth. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Withdraw consent for optional data processing
To exercise any of these rights, contact us at support@vendbuddy.app.
US State Privacy Rights
If you live in California or another US state with a consumer privacy law, you also have the right to:
- Know what personal information we collect, use, and disclose, and get a copy of it
- Correct or delete your personal information
- Opt out of the sale or sharing of your personal information and of targeted advertising
To opt out, use the "Your Privacy Choices" link (see Cookies and Similar Technologies) or turn on Global Privacy Control in your browser. For the other rights, email us from the address on your VendBuddy account, which is how we verify that the request is yours. You may use an authorized agent; we will ask for proof that you gave them permission. We will not discriminate against you for exercising any of these rights. If we decline your request, you can appeal by replying to our response, and we will answer within the time your state's law requires.
In the past 12 months, we have collected these categories of personal information: identifiers (such as your name, email address, account ID, IP address, and cookie identifiers); commercial information (your subscription and purchase history); internet activity (how you use the Service, including session recordings on the website); approximate location derived from your IP address; photos you take with the card scanner; and the business records you enter as a vendor. We collect them from you, from your device, and from the sign-in provider you choose, use them for the purposes in section 2, and disclose them to the service providers in section 3. The only categories that may be sold or shared are identifiers and internet activity, through advertising cookies on the website. We do not use sensitive personal information, such as your account login, for any purpose other than providing the Service.
9. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. We do not knowingly sell or share the personal information of anyone under 16.
10. Third-Party Links
The Service may contain links to third-party websites (e.g., TCGPlayer, Amazon affiliate links). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy, contact us at: