Privacy Policy
Effective November 1, 2026
Card Biscuit is made by Valley Chase, LLC ("we"). This policy explains what the Biscuit app and website collect and why. Short version: we use your card photos only to price your cards, we don't sell your data, and we don't track you across other apps or sites.
What we collect
- Card photos and typed card names. When you scan or type a card, it's sent to our server and to our AI provider (Anthropic) to identify the card. Photos are processed to answer your request and are not stored by us afterward. The one exception: if you tap "What's off?" and send us a report, a small copy of that card's photo is kept with the report for up to 60 days so we can fix the mistake. When you correct a card's details, we may keep what the app read and what you changed it to (card details only, no photo) to make card reading better.
- Voice. If you use the microphone to say a card, your phone's built-in speech service (for example Apple's) turns your words into text. Only that text is sent to us, the same as typing it. We don't receive or store recordings. You can always type instead.
Card searches. To find recent sales, the card's search text (for example "2023 Prizm C.J. Stroud 339") is sent to our sold-listings data provider (Apify), which looks up public eBay sold listings. Search results are cached on our server for a few hours so the next person gets them faster. Cached results are about cards, not about you.
- A random device ID. The app creates a random ID to apply fair daily limits. It isn't linked to your name, email or contacts.
- Purchases. If you subscribe, Apple handles payment. Our subscription service (RevenueCat) tells us whether your subscription is active. We never see your card number.
- Basic server logs such as error messages and IP address, kept briefly to keep the service running and prevent abuse.
What stays on your phone
Your Recent scans, My cards, Buys & sells log, settings, and any scans saved while you had no signal are stored on your device (and in your iPhone's own iCloud backup, if you use it). Deleting the app deletes them.
Anonymous usage counts. The app adds 1 to a daily total when certain things happen (the app opens, a card is scanned, a price is shown, the plans screen is opened, a purchase goes through). Only the totals are kept: nothing about you, your device or your cards is attached to them.
Cards priced. When a card is priced, the card's name and its price are kept for 7 days (to show which cards are popular and to fix mistakes). Nothing about who priced it is attached.
Subscriptions. Apple tells us when a subscription starts, renews, ends or is refunded: the plan, the country, the dates and an anonymous transaction number. Apple never shares your name, email or payment details with us.
What we don't do
- We don't sell or rent your data.
- We don't use advertising trackers.
- We don't use your photos to train AI models, and our AI provider's terms say it doesn't train on them either.
Service providers
Vercel (hosting), Anthropic (card identification), Apify and other sold-listing data providers, Upstash (price cache), RevenueCat and Apple (subscriptions). Each only gets what it needs to do its job.
Hot in the oven
When you comp a card, the card itself (year, set, player, number) and its value may show up anonymously in the app's "Hot in the oven" list. Nothing about you, your photo or your device is shown.
Children
Card Biscuit isn't directed to children under 13, and we don't knowingly collect personal information from them.
Your choices
You can delete your on-device data anytime by deleting the app. For questions or requests, email jordan@valleychase.com.
Changes
If this policy changes, we'll update the date above and post the new version here.