Privacy Policy
Last updated 29 August 2026
CompFlash identifies trading cards from images you give it and shows you recent sold prices. This page describes exactly what that involves for your data. It is written to be checkable: where we say something is not stored, that is enforced in the software, not merely intended.
The short version
- Card images are not kept. They are processed in memory and discarded.
- We do not do face recognition of any kind, on any image.
- We do not sell your data, and we do not use it for advertising.
- You can export or delete everything from your account settings at any time.
What we collect
| Data | Why | How long we keep it |
|---|---|---|
| Email address and a hash of your password | To sign you in | Until you delete your account |
| Card images you scan | To identify the card | Not stored. Held in memory for the length of the request, then discarded |
| Scan results — the identified card, the comps used, the estimate | Your history, corrections and watchlists | Until you delete them or delete your account |
| The page address and stream title at the moment you scan | Support, and handling abuse of the service | With the scan record |
| Counts of scans | Enforcing plan limits and billing | With your account |
| Timing and cost of the services we call | Keeping the product fast | Aggregated, never tied to you |
Card images, specifically
A frame from a live auction can contain more than a card — a seller's hands, a face, a room. Two things follow from that, and both are deliberate design decisions rather than promises:
- Images are never written to disk. The retention setting that would allow it defaults to zero and ships that way. Nothing in the product turns it on.
- We perform no biometric processing. No face detection, no face matching, no template extraction, anywhere in the pipeline. Because images are not retained, no biometric identifier is stored either.
To identify a card we send the image to a card-identification provider. That provider receives the image and returns a candidate match. We do not send them your name, email or account identifier.
Who else processes your data
| Service | What it handles |
|---|---|
| Microsoft Azure | Hosting, the database, and email delivery. United States. |
| Stripe | Payments. Card details go to Stripe directly; we never see or store them. |
| Card identification provider | Receives the card image to identify it. Not your identity. |
Your rights
These are buttons in the product, not requests you have to file with us:
- Export. Get everything we hold about your account as a single JSON file.
- Delete. Erases your scans, usage records, watchlist and sessions, and anonymises the account. Non-identifying operational totals survive, because they contain no reference to you; the deletion response tells you exactly what remained.
If you are in a jurisdiction with additional rights — access, correction, portability, objection — write to hello@compflash.com and we will act on them.
Chrome extension and Google API data
CompFlash's use of information received from Google APIs will adhere to theChrome Web Store User Data Policy, including theLimited Use requirements.
In practice that means the extension:
- Collects only what is needed to identify a card and show you comps.
- Does not collect your browsing activity. It records the address of the page you scan on, because that is part of the scan you asked for, and nothing else.
- Does not transfer or sell your data to anyone for advertising, to data brokers, or for credit or lending decisions.
- Is not read by a human, except where you ask us for support, or where we are legally required to.
- Runs no remotely fetched code. Everything it executes ships inside the extension package.
Cookies
The marketing site sets no cookies and runs no analytics or tracking scripts. The application stores your session in your browser so you stay signed in. That is the only thing it keeps there.
Age
CompFlash is for people aged 18 or over. It is not directed at children and we do not knowingly collect their data.
Changes
If this policy changes materially we will say so by email before the change takes effect, rather than quietly updating the date at the top.