Privacy Policy

1. Data We Collect

• Account data: Email address (for login), display name, profile avatar, and app role (admin or user).
• Discord identity: Optional Discord username and Discord ID, used for trading and social features. These are never shared with third parties.
• Collection data: Cards you add to your collection, want list, in-transit list, and deck builds — including quantities, cost basis, condition, and notes you enter.
• Marketplace data: Listings (with mandatory photos), offers, counter-offers, invoices, and trade proposals you create.
• Reverse marketplace data: Bids you place on cards you want to buy, including max price and acceptable condition.
• Photos: Card photos you upload (AI scan, grading, manual upload, or marketplace listings) are used for display, marketplace listings, and AI processing.
• Community data: Friend requests, vouches, trade feedback, activity reactions, and direct messages you send or receive.
• AI conversation history: Your conversations with RECON (the in-app AI assistant) are stored so you can revisit past chats and switch between conversations.
• Trust score signals: Trade history, marketplace deals, vouches received, verification status, and account tenure are used to compute your Collector Trust Score.
• Collection goals: Goals you set (e.g. complete a set, reach a card count) and your want list are used to match you with potential trade partners and marketplace listings.
• Authentication data: Two-factor authentication codes sent to your email when 2FA is enabled.
• Usage data: Anonymous analytics events (e.g. feature usage) to improve the app.

2. How We Use Your Data

• To display and manage your personal card collection, decks, want list, and in-transit tracking.
• To calculate collection values and provide market comps from public eBay sold listings.
• To enable marketplace listings, offers, trade proposals, invoices, and direct messages between users.
• To power AI features: card scanning and grading (photo analysis), RECON (your AI collection & deck assistant), AI Collection Biography, and Collection Wrapped summaries.
• To compute your Collector Trust Score from your trade history, vouches, and community activity.
• To match your collection goals and want list with potential trade partners and marketplace listings.
• To generate and deliver market reports, price alerts, and daily RECON you opt into.
• To show community features: members list, activity feed, leaderboards, and vouches.
• To send you notifications about friend requests, offers, trade proposals, price alerts, and marketplace activity.

3. What We Do NOT Collect

• We never collect payment card numbers — all payments are processed securely by our payment provider (Base44 Payments / Wix).
• We do not collect government IDs, SSNs, or sensitive financial account numbers.
• We do not sell your data to third parties.
• We never reveal your real legal name in public-facing data or AI chat — only your chosen display name (handle) is shown to other collectors.

4. Data Visibility & Sharing

• Private by default: Your collection, want list, cost basis, decks, and messages are visible only to you.
• Public collection: You can opt to make your collection public via a shareable link. Only card names and images are shared — never cost basis or notes.
• Marketplace: Listings you create are visible to all users. Your display name and Discord username (if linked) are shown so buyers can contact you. All listings require at least one photo.
• Messages: Direct messages are visible only between the sender and recipient.
• Community: Your display name, avatar, trust score tier, and online status appear in the community members list. Your activity (listings, trades, reactions) may appear in the community activity feed. Leaderboard rankings show your display name and stats.
• Vouches & feedback: Vouches and trade feedback you give or receive are visible on user profiles.
• Public provenance chain: Marketplace sales and completed trades are recorded in a tamper-evident, publicly visible transfer ledger showing card name, image, and buyer/seller usernames. Direct, Discord, and eBay sales are kept off this chain for privacy.
• Trash bin: Deleted collection items are moved to a 30-day trash bin before permanent deletion, so you can recover accidentally removed items.

5. AI Features & Data Processing

BZKA Vault uses AI to power several features. Here's exactly what data is involved:

• RECON (AI assistant): Your text prompts and conversation history are sent to an AI model. RECON can access your collection, decks, want list, marketplace listings, and the card database to answer your questions. Conversation history is stored in your account so you can revisit past chats.
• Card scanning & grading: Card photos you upload are sent to an AI model for identification and condition grading. Photos are processed transiently and not stored by the AI provider.
• AI Collection Biography & Wrapped: Your collection data (card names, quantities, stats) is sent to an AI model to generate a personalized narrative and year-in-review summary. The generated content is stored in your account.
• AI never uses web search: RECON relies exclusively on internal, authorized app data (your collection, the card database, marketplace, and market reports). It does not search the public internet for card data.
• Privacy in AI chat: RECON never reveals your real legal name. It resolves other collectors by their chosen handle (username) only.

6. Data Retention

Your data is retained as long as your account is active. You can delete your account at any time from the Profile page, which permanently removes your collection, listings, offers, trades, messages, decks, AI conversations, and community data. Deleted collection items are retained in a 30-day trash bin before permanent deletion. Anonymized analytics data may be retained indefinitely.

7. Third-Party Services

• AI providers (OpenAI, Google, Anthropic): Text prompts, card photos, and collection data are sent to AI models for scanning, grading, RECON assistant, biography, and wrapped features. These are processed transiently and not stored by the AI provider for training.
• eBay / Apify: Public sold-listing data is fetched via Apify to provide market comps, price history, and market reports. No user data is sent to eBay or Apify.
• Google: Used for Google Sign-In authentication. Google shares your email and name only for account creation.
• Base44 Payments (Wix): Processes subscription payments securely. We receive your subscription status and plan; we never see your payment card details.
• Whatnot: Public show and listing data is fetched to display upcoming live breaks. No user data is sent to Whatnot.
• Giphy: GIF search is available in direct messages. Search queries are sent to Giphy to return matching GIFs. No personal data is shared with Giphy.
• RECON External AI Connections (MCP): You can optionally connect external AI clients (e.g. ChatGPT, Claude) to your account via OAuth on the Connect page. When connected, those clients can read your collection, want list, and marketplace data on your behalf to assist you. You can revoke access at any time. No data is shared until you explicitly authorize a connection.

8. Security

All data is stored securely with row-level access controls ensuring users can only access their own private data (collection, decks, messages, cost basis). Authentication tokens are managed by the platform. Two-factor authentication (via email codes) is available for added account security. The provenance chain uses cryptographic hashing to ensure transfer records are tamper-evident.

9. Children's Privacy

BZKA Vault is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, please contact us and we will delete it.

10. Your Rights

• Access: View all your data within the app.
• Export: Export your collection as CSV from the Collection page.
• Delete: Delete your account and all associated data from the Profile page. Deleted items are recoverable from the trash bin for 30 days.
• Block users: Block other collectors from contacting you or viewing your activity.
• Opt-out: Make your collection private at any time. Disable notifications or price alerts at any time.
• Revoke AI connections: Disconnect any external AI client from the Connect page at any time.

11. Contact

For privacy questions or data requests, reach out via the support channel in the app or contact Base44 support.

12. Changes to This Policy

We may update this policy as the app evolves. Material changes will be announced in-app. Continued use after changes constitutes acceptance of the updated policy.