Cardrake

Privacy Policy for Cardrake

Last updated: August 2026

1. Introduction

Welcome to Cardrake's Privacy Policy. Your privacy is critically important to us. Cardrake ("we", "our", or "us") is committed to protecting and respecting your privacy regarding any information we may collect while operating our website at cardrake.com.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services, including both our free planning tools and premium Collector Plan features.

2. Information We Collect

2.1. Information You Provide Directly

Account Registration:

Collector Plan Data (Premium Users Only):

2.2. Analytics and Cookies

Google Analytics 4: We use Google Analytics to understand how visitors interact with our website. This includes:

PostHog (Product Analytics): We use PostHog, hosted in the European Union, to understand how our features are used so we can improve the product. This includes:

PostHog is loaded only after you grant Analytics cookie consent (see below), and is linked to your account identifier only once you sign in.

Cookie Consent: We implement Google Consent Mode v2 to ensure GDPR compliance:

You can change or withdraw your cookie choices at any time by opening (also linked in the footer of every page), or by clearing your browser data. Analytics tracking only occurs with your explicit consent.

2.3. AI Assistant Integrations (ChatGPT, Claude, and MCP Clients)

Cardrake can be used from AI assistants such as ChatGPT and Claude through our Model Context Protocol (MCP) endpoint. When you ask an assistant about Pokemon cards, the assistant — not you directly — sends Cardrake the specific requests it needs to answer: search terms, card and set identifiers, and filter or sort options.

What we receive and log per request:

What we do not receive: your conversation with the assistant, your assistant account identity, or any personal information beyond the requests described above. The integration is anonymous and read-only: it cannot access Cardrake accounts, collections, or wishlists.

We use this data to operate the service, understand which features are used, and prevent abuse (such as rate limiting). It is processed in PostHog on EU-based infrastructure and retained per Section 6.3. Your conversation with the assistant itself is governed by that provider's own privacy policy (OpenAI or Anthropic).

2.4. Automatically Collected Information

Usage Analytics:

Cookies and Tracking:

3. How We Use Your Information

3.1. Free Service Users

3.2. Collector Plan Subscribers

3.3. All Users

4. Information Sharing and Disclosure

4.1. Service Providers

We share information with trusted third-party service providers:

4.2. Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights, property, or safety, or that of our users or others.

4.3. Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure.

Your account authentication and payment processing are handled by Clerk.com, which maintains industry-standard security practices and certifications.

6. Data Retention

6.1. Account Data

We retain your account information for as long as your account is active or as needed to provide you services.

6.2. Collection Data (Premium Users)

Your collection tracking data, notes, and preferences are retained while your Collector Plan subscription is active. Upon cancellation, this data is retained for 90 days to allow for subscription reactivation, after which it may be permanently deleted.

6.3. Analytics Data

Usage analytics and website performance data may be retained for up to 26 months for analysis and service improvement purposes. PostHog session replay recordings are retained for 30 days and then automatically deleted.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where our service providers (such as Clerk.com and hosting services) operate. We ensure appropriate safeguards are in place for such transfers. Our product analytics provider, PostHog, processes data on infrastructure located in the European Union.

9. Age Restrictions

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

You can control cookies through your browser settings, but disabling certain cookies may affect website functionality.

11. Third-Party Links

Our website contains links to third-party websites, including affiliate links to Amazon and other retailers. This Privacy Policy does not apply to those external sites, which have their own privacy policies.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Significant changes will be communicated through email or website notification. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, our data practices, or would like to exercise your privacy rights, please contact us:

We are committed to resolving any privacy-related concerns promptly and transparently.