Privacy

You can look up any card’s price on UltraBall without an account and without telling us who you are. This page says what we keep when you do more than that, why we keep it, and how to see it or have it deleted.

If you create an account

One account works on this site and in the UltraBall app for iPhone and Android.

• Your email address. We use it to sign you in and to send the emails you ask for.
• A password, if you set one, stored only as a scrambled hash that cannot be read back.
• If you sign in with Apple, in the iPhone app: Apple’s id for you, which is the same each time you sign in to UltraBall, and the email address Apple shares with us. That can be a private relay address that forwards to your own. We don’t ask Apple for your name, and never see your Apple ID password.
• A record of each device you are signed in on, so you can stay signed in and sign out: in a browser, a sign-in cookie that lasts up to 60 days; in the app, a sign-in kept in your phone’s secure storage that lasts while you keep using the app. Each is stored with the browser or phone type it was made on.
• What you put in your account: the cards in your collection with their condition or grade, what you paid and when if you tell us, your watchlist and price targets, your binders, your favourites and the sets you are tracking.

Emails

We send sign-in links, the price and listing alerts you set, and the Monday collection email if you switch it on. Each alert and the Monday email can be turned off from your account or from the link in the email. We do not send marketing email to people who have not asked for it.

Photos you upload

• The card scanner uses your photo to identify the card, and doesn’t keep it. We keep a record of each scan, with the cards it suggested and the one you confirmed, to make recognition better.
• The AI card grader keeps the photos with the report it produces, so you can come back to it. A report can be opened by anyone who has its link, and appears in the recently graded list only if its owner chooses to list it. You can turn a report’s link off, or delete the report, and its photos go with it. If you chose to keep a report for accuracy checks, deleting it leaves its photos, measurements and real grade with us, no longer linked to you after a day, for up to two years; they are used to check the grader against real grades and to tune its rules, never to train Ximilar’s models or anyone else’s.

Card recognition and grading analysis are done for us by Ximilar, which receives the photos for that purpose.

The UltraBall app

The app keeps the same things described on this page, for the same reasons. Beyond that:

• The camera and your photo library are used only when you scan or grade a card, and only once you have allowed them. The app sends only the photo you take or pick; it reads nothing else on your phone.
• If you turn on notifications, we keep your phone’s notification address (a token issued through Expo by Apple or Google), whether it is an iPhone or an Android phone, the currency you read prices in and which alerts you want. Notifications are delivered by Expo’s push service and Apple or Google. Turning notifications off, or signing out, removes the token.
• The app records the same kind of events as the site, such as a card added to your collection or a search made (not what you searched for), with your account when you are signed in. It has no advertising or third-party analytics tools and reads no advertising identifier.
• It doesn’t use your location: it picks a currency from your phone’s language and region settings.
• On the phone itself it keeps your sign-in in secure storage, and your currency, recent searches, recently viewed cards and a short-lived copy of your account’s pages so it opens quickly. Deleting the app removes them.

If you connect your eBay account

Connecting eBay is optional. Signing in with eBay connects it too. Either way, eBay asks for your consent first and we then keep:

• your eBay username and eBay’s id for your account;
• a token that lets us read these, stored encrypted and never sent to your browser;
• the Pokémon cards you bought in the last 90 days and from then on: the item, what you paid, the date and the seller. Purchases that are not Pokémon cards are not kept.
• the listings you watch on eBay, the auctions you bid on and the Best Offers you make, where they are Pokémon cards: the listing, its price and when it ends, so we can show each beside what the card sells for. We never bid, buy or make an offer for you.
• the Pokémon cards you sold: the item, what it sold for, eBay’s fees and the date, so your collection and your sales record stay right.

We use this only to list those purchases and sales for you, so you can keep your collection and your own records up to date. What you paid and what you sold for are yours: they never change a price on the site and are not shown to anyone else. We never see your eBay password. eBay’s consent screen describes some of these permissions as “view and manage”, which is eBay’s wording for the whole permission; we only read, and never list, buy, sell, refund or message on your behalf. Disconnecting removes the token, every purchase you have not added to your collection, and the listings read from your watch list, bids and offers. If you signed in with eBay we hold no email address for you unless you add one. If your eBay account is closed, eBay tells us and we delete the same.

Separately, you can switch on “eBay purchases” in your account without connecting eBay. While it is on, the eBay links you press carry a random tag for your account, so eBay’s affiliate report can tell us which item you bought through our link and for how much. The tag is not your email or your id. Switching it off deletes it.

If you connect an app such as ChatGPT

Connecting an app is optional, and creating an UltraBall account does not connect one. An app is connected only when you press Allow on our consent screen, which lists exactly what the app is asking for. Each item is a separate permission and the app gets only the ones shown:

• see the cards in your collection, with their condition or grade, how many you hold, what you paid and when if you recorded it, and what they are worth;
• add cards to your collection;
• see your watchlist and price targets;
• add cards to your watchlist, set price alerts and remove watches;
• see the sets you track and how complete they are;
• start tracking a set.

A connected app never receives your email address, your password, your eBay connection or your eBay purchases and sales, and it cannot buy, sell, bid or pay for anything. Before it changes your account it is shown a preview, and the change is saved only when it confirms that you agreed. A price alert set through an app sends email only if you agreed to that email.

What the app is given is sent to that app at your request, and what the app’s maker does with it is covered by their privacy notice: for ChatGPT, OpenAI’s. We keep the name the app gave, the permissions you allowed, when you connected it and when it was last used. The keys the app holds are stored here only in a scrambled form that cannot be read back; they stop working after an hour and are renewed for up to 30 days unless you disconnect. Disconnecting, under Connected apps on your account page, stops the app’s access at once. Looking up prices through an app needs no connection and tells us nothing about who you are.

Links to marketplaces

Some links to eBay are affiliate links, marked #ad. When you follow one, eBay may set its own cookies to record that you arrived from UltraBall, and may pay us a commission if you buy. What eBay does with that is covered by eBay’s own privacy notice.

Measuring how the site is used

We use Google Analytics, PostHog and Vercel Analytics to count visits and see which pages and tools are used, and we record some events ourselves, such as a card being added to a collection. PostHog runs without cookies and without knowing who you are. We look up the country your connection comes from once, to pick a currency for prices; that is not stored against you. Your browser also remembers your currency choice and a few other settings on your own device.

Who else handles your data

• Vercel hosts the site and Neon hosts the database.
• Resend delivers our emails.
• Ximilar analyses card photos.
• Google and PostHog provide analytics for the site.
• Expo, with Apple and Google, delivers the app’s notifications, if you turn them on.
• Apple, if you sign in with Apple.
• Stripe takes the payment if you buy a plan. Your card details go to Stripe, never to us.
• eBay, if you connect your account or follow a link to it.
• The maker of an app you connect, such as OpenAI for ChatGPT, for the things you allowed it to see.

We do not sell your data, and we do not share your collection, your costs or your purchases with anyone, except with an app you have connected yourself, as described above, and what you choose to show, as described below.

What you choose to show others

Your collection is private unless you share it. If you make a shared collection link or a public profile, anyone with its address can see what you switched on, and nothing else: the name you picked, and whichever of your cards, their value, your level, achievements and set progress you chose. Neither ever shows your email address, what you paid or when you bought. These pages are kept out of search engines. You can change what is shown, make it private or delete it at any time from your account, and the address stops working straight away; a link preview already fetched by another site can linger there for a few minutes. We may take a public profile down if its name or use breaks our terms.

Seeing, changing or deleting your data

You can change or remove anything in your collection, watchlist and favourites yourself, delete grading reports, and disconnect eBay or a connected app, all from your account. We keep what your account holds, and the events recorded with it, until you delete the account.

To delete your whole account, use Delete account in the app’s settings, or delete it here on the site. It goes straight away, with everything in it, from the site and the app; if you signed in with Apple, UltraBall is also removed from the apps using your Apple ID. To ask for a copy of what we hold about you, contact us from the email address on the account and we will send it.

Changes to this page

When what we collect changes, this page changes with it and the date at the top is updated.