Privacy Policy

What the extension does

The Scan For Cards Chrome extension runs in your own browser and uses the Instagram session you are already logged in to. On the schedule you choose, or when you press Scan now, it opens Instagram in a background tab and views the stories in your Instagram story bar (the accounts you follow) plus any extra accounts you add in Settings → Scanning. It takes screenshots of those stories and sends them to our servers so we can identify the cards in them and check them against your alerts.

What we collect and store

• Your account details: email address and a hashed password, or your Google account email if you sign in with Google
• Your alerts (keywords, players, sports, sets, years, grades, and max prices you define)
• The usernames of accounts whose stories were scanned, any extra accounts you add in Settings → Scanning, and your scan schedule
• Story screenshots captured by the extension
• Card data extracted from those screenshots (such as player, year, set, grade, and cert number), plus the asking price, seller handle, and a link to the story
• Your matches, snipe queue pins, and “DM sent” marks
• Your Telegram chat ID, if you connect Telegram
• Your plan and subscription status (payment details are held by Stripe, not us)

Shared listings database

Every story the extension scans is stored as a listing in a shared database, whether or not it matched one of your alerts. That includes the story screenshot, extracted card data, seller handle, asking price, and story link. Listings are visible to other signed-in Scan For Cards users, including on the Catalog page, and are reused so the same story isn't processed twice.

How screenshots are handled

Story screenshots are stored in Cloudflare R2 and displayed in the dashboard alongside the listing. To read the card, we send the screenshot to Google Cloud Vision for text recognition. If a graded slab's cert number is found, we look it up with PSA's public cert API. Otherwise, the screenshot is sent to an AI vision model (via Anthropic or OpenRouter) to identify the card.

What we do not collect

• Your Instagram username, password, or session. The extension uses your logged-in session inside your browser, and our servers never log in to Instagram.
• Your Instagram direct messages
• Your browsing history. The extension only views Instagram stories from accounts you follow and accounts you add.
• Your card number or bank details. Billing is handled by Stripe.

Third parties

We use these services to run Scan For Cards:

• Anthropic and OpenRouter: AI vision analysis of story screenshots
• Google Cloud Vision: text recognition (OCR) on story screenshots
• PSA: public cert lookup for graded slabs (we send only the cert number)
• Cloudflare R2: storage for story screenshots
• Telegram: delivering alerts to your linked Telegram account
• Stripe: payment processing and subscription management
• Resend: transactional email, such as password resets
• Google: sign-in, if you choose Sign in with Google
• Railway and Vercel: hosting for our servers, database, and website

We do not sell your data or share it with advertisers.

Data retention and deletion

Your account data, alerts, and matches are kept while your account is active. Listings in the shared database, including story screenshots, are kept indefinitely and are not removed when a story expires on Instagram. To delete your account, email us at the address below. Deleting your account removes your account details, alerts, match history, and Telegram link. Listings your scans added to the shared database stay in the Catalog, because other users rely on them, and they are not linked to your account.

Contact

Questions about this policy or data requests: [email protected]