Privacy Policy

Last Updated: 25 August 2026

1. About This Privacy Policy

This Privacy Policy explains how Card Codex Ltd (“Card Codex”, “we”, “us” or “our”) collects, uses, stores and shares personal information when you use cardcodex.com and the services provided through it (the “Service”).

Card Codex Ltd is a company registered in England and Wales under company number 17331405 and is the controller of personal information processed through the Service.

If you have any questions about this Privacy Policy or how we use your information, you can contact us at:

Email: [email protected]

2. Information We Collect

The information we collect depends on how you use Card Codex.

Account Information

When you create or use a Card Codex account, we may collect:

• your email address;
• username and display name;
• account identifiers;
• password information in securely hashed form;
• account preferences and settings;
• membership status;
• date of registration;
• login and account activity; and
• information you provide when communicating with us.

Collection and Card Data

When you use Card Codex’s collection tools, we may store information associated with your account, including:

• cards and sets added to your collection;
• quantities and card variants;
• watchlisted cards;
• set completion progress;
• collection and portfolio history;
• collection preferences;
• saved card-related information; and
• your use of collection and portfolio features.

We use this information to provide features such as collection tracking, portfolio valuations, watchlists, statistics, price tracking and personalised portfolio roundups.

Subscription and Payment Information

If you subscribe to Card Codex Pro, we collect information relating to your subscription, such as:

• your membership level;
• subscription status;
• billing period;
• transaction and order identifiers;
• payment status;
• renewal and cancellation information; and
• limited payment information supplied to us by our payment provider.

Payments are processed by Stripe.

We do not directly store your full payment card number or security code.

Stripe processes payment information in accordance with its own privacy practices.

Social Login Information

You may be able to create or access your Card Codex account using third-party login providers, including Google and Discord.

When you use social login, we may receive information made available by that provider, such as:

• your name or display name;
• email address;
• profile identifier; and
• other basic account information you have authorised the provider to share.

We use this information to create, identify and authenticate your Card Codex account.

The relevant third party also processes information in accordance with its own privacy policy.

Technical and Usage Information

When you visit or use Card Codex, we and our service providers may collect technical information including:

• IP address;
• browser and device type;
• operating system;
• approximate location derived from your IP address;
• pages viewed;
• referring pages or websites;
• dates and times of visits;
• interactions with pages and features;
• session information;
• errors and performance information; and
• cookie and similar technology identifiers.

We do not intentionally collect precise GPS location through the Card Codex Service unless a particular feature clearly tells you otherwise.

3. How We Use Your Information

We may use personal information to:

• create and manage your Card Codex account;
• authenticate you when you sign in;
• provide collection, portfolio, watchlist and card-tracking functionality;
• calculate and display information relating to your collection;
• provide Card Codex Pro features;
• process and administer subscriptions and payments;
• manage trials, renewals, cancellations and refunds;
• send account and service communications;
• send personalised portfolio roundups;
• send Card Codex news, product and feature updates;
• provide customer support;
• respond to questions and requests;
• monitor and improve the performance and usability of Card Codex;
• understand how people use the Service;
• develop and improve features;
• measure the effectiveness of our website and communications;
• display and measure advertising;
• detect fraud, abuse and security threats;
• protect Card Codex and its users;
• troubleshoot technical problems;
• enforce our Terms and Conditions;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

We do not sell your personal information in the ordinary meaning of selling personal information for money.

4. Emails and Communications

Account and Service Emails

We may send emails that are necessary or useful for operating your Card Codex account and providing the Service.

These may include:

• account registration and verification messages;
• password and security emails;
• subscription confirmations;
• payment and failed-payment notifications;
• cancellation and refund information;
• important changes affecting your account or the Service;
• watchlist or feature notifications; and
• other administrative communications.

Some of these communications are necessary for us to provide the Service and cannot be disabled while maintaining the relevant account or feature.

Portfolio Roundups

Card Codex accounts include personalised portfolio roundup emails based on information associated with your collection.

Free accounts may receive these roundups monthly and Card Codex Pro accounts may receive them weekly.

Portfolio roundups may contain information such as changes in estimated collection value, collection activity and other information relating to your Card Codex portfolio.

Portfolio roundup emails are enabled when you create an account.

You can disable portfolio roundup emails at any time through your Card Codex account settings or using the unsubscribe or preferences link provided in the email.

Card Codex Updates

When you register for Card Codex, we may also add your email address to our email platform, Kit, so that we can send you relevant Card Codex news, product updates, feature announcements, card and collection updates and similar communications.

You can unsubscribe from these optional emails at any time using the unsubscribe link included in the email.

You may continue to receive necessary account, security, payment or service communications after opting out of optional emails.

We maintain records of email preferences where necessary to ensure that we respect unsubscribe requests.

5. Our Lawful Bases for Processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the particular activity, we may rely on the following bases.

Performance of a Contract

We process information where it is necessary to provide the Service you have requested or to take steps at your request before entering into a contract.

This includes processing necessary to:

• create and operate your account;
• provide collection and portfolio functionality;
• provide Card Codex Pro;
• manage subscriptions;
• process payments; and
• provide features you request.

Legitimate Interests

We may process information where it is necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and improving Card Codex;
• understanding how the Service is used;
• providing relevant account and portfolio communications;
• communicating with users about Card Codex;
• maintaining the security and integrity of the Service;
• preventing fraud and abuse;
• troubleshooting technical issues;
• protecting our business and users; and
• establishing, exercising or defending legal claims.

Where required, we consider the impact of this processing on your privacy before relying on legitimate interests.

Consent

We rely on consent where applicable, including for certain cookies, advertising technologies and other processing where consent is legally required.

Where we rely on consent, you can withdraw it at any time.

Legal Obligations

We may process information where necessary to comply with legal obligations, including accounting, taxation, regulatory and law-enforcement requirements.

6. Analytics and Website Monitoring

We use services that help us understand how Card Codex is used and improve the Service.

Google Analytics

We use Google Analytics to understand website traffic and how visitors interact with Card Codex.

Google Analytics may collect information such as device information, browser information, approximate location, pages visited, referral information and interactions with the Service.

Google Search Console

We use Google Search Console to understand how Card Codex performs in Google Search, including search visibility, queries, page performance and technical issues.

The information available to us through Search Console is generally aggregated rather than information that directly identifies individual Card Codex users.

Microsoft Clarity

We use Microsoft Clarity to understand how visitors interact with Card Codex and identify usability and technical issues.

Clarity may collect information about interactions with the website, such as clicks, scrolling, navigation and session behaviour.

Depending on our configuration and your consent choices, technologies such as cookies may be used to support these services.

7. Advertising

Card Codex uses Raptive to provide and manage advertising on the Service.

Raptive and its advertising partners may use cookies, device identifiers and similar technologies to:

• deliver advertisements;
• measure advertising performance;
• limit repeated advertisements;
• understand interactions with advertising; and
• personalise advertising where permitted.

Advertising providers may process information such as your IP address, device information, browser information, cookie identifiers and interactions with advertisements.

Where consent is legally required for advertising cookies or similar technologies, these technologies should be controlled through our cookie consent system.

More information about cookies and advertising technologies is provided in our Cookie Policy and through the privacy controls available on the Website.

8. Email Providers

We use third-party providers to deliver emails.

Kit

We use Kit to manage and send Card Codex email updates.

Information processed through Kit may include your email address, subscriber status, email preferences and information about interactions with emails, such as whether an email was delivered, opened or clicked where this functionality is enabled.

Mailgun

We use Mailgun as part of our email delivery infrastructure.

Mailgun may process information necessary to deliver emails, such as email addresses, delivery information and technical message information.

We may also retain email delivery logs for troubleshooting, security and support purposes.

9. Payments

We use Stripe to process Card Codex Pro payments.

When you make a payment, Stripe may collect and process information including your payment card details, billing information, transaction information, device information and information used for fraud prevention.

Card Codex receives information necessary to administer your subscription and confirm the status of payments but does not directly receive or store your complete card details.

10. Website Security and Performance

We use Cloudflare to help provide, secure and improve Card Codex.

Cloudflare may process technical information such as IP addresses, device and browser information, request information and security data.

We use this information and Cloudflare’s services to help:

• deliver website content;
• protect against malicious traffic;
• prevent attacks and abuse;
• maintain website availability; and
• improve performance.

We may also use security tools within WordPress and our hosting environment to protect accounts and the Service.

11. Who We Share Information With

We do not disclose personal information to third parties except where reasonably necessary to operate Card Codex, where you ask us to do so, or where required by law.

We may share or make information available to categories of recipients including:

• website hosting and infrastructure providers;
• payment processors such as Stripe;
• email providers such as Kit and Mailgun;
• analytics providers such as Google and Microsoft;
• advertising providers such as Raptive and its advertising partners;
• authentication providers such as Google and Discord;
• security, performance and content-delivery providers such as Cloudflare;
• professional advisers such as accountants, solicitors and insurers;
• regulators, courts, law-enforcement agencies or public authorities where legally required; and
• a purchaser, investor or successor organisation in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business.

Service providers acting on our behalf are permitted to process personal information only as necessary to provide their services and subject to applicable contractual and legal requirements.

12. International Transfers

Some of our service providers operate internationally or may process personal information outside the United Kingdom.

This may include providers based in or operating infrastructure in the United States and other countries.

Where UK data protection law requires safeguards for an international transfer, we take reasonable steps to ensure an appropriate transfer mechanism or safeguard is in place.

Depending on the circumstances, this may include adequacy regulations, recognised contractual safeguards or other mechanisms permitted by applicable data protection law.

13. Cookies and Similar Technologies

Card Codex and our service providers use cookies and similar technologies.

These technologies may be used for:

• essential website functionality;
• authentication and account sessions;
• remembering preferences;
• security;
• analytics;
• performance monitoring;
• advertising; and
• measuring interactions with the Service.

Where consent is legally required, non-essential technologies are subject to the choices provided through our cookie consent system.

For more information, please see our Cookie Policy.

14. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Service and meeting legal, accounting, security and regulatory requirements.

In general:

• account information is retained while your Card Codex account remains active;
• collection, watchlist and portfolio information is retained while associated with an active account;
• subscription and transaction records may be retained after your subscription or account ends where required for accounting, tax, fraud prevention or legal purposes;
• email preference and suppression information may be retained so that we can respect unsubscribe requests;
• security and technical logs may be retained for a reasonable period for security, troubleshooting and fraud prevention; and
• information contained in backups may remain for a limited period until backups are overwritten or securely deleted.

When information is no longer required, we will delete or anonymise it where reasonably practicable.

15. Account Deletion

You may request deletion of your Card Codex account and associated personal information.

Deleting your account may permanently remove information associated with your account, including collection, watchlist and portfolio information.

Some information may be retained where we have a legal obligation or legitimate reason to retain it, such as transaction records required for tax and accounting purposes, fraud-prevention records, records of disputes and records necessary to honour email opt-outs.

To request account deletion, use any account deletion functionality available within Card Codex or contact us at [email protected].

16. How We Protect Your Information

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, encryption in transit, password hashing, security monitoring, firewalls, backups and other appropriate security measures.

No online service can guarantee absolute security, and you are responsible for keeping your account credentials secure.

If you believe your Card Codex account has been compromised, please contact us at [email protected].

17. Your Data Protection Rights

Depending on where you live and the circumstances, you may have rights relating to your personal information.

Under UK data protection law these may include the right to:

• be informed about how your information is used;
• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information in certain circumstances;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• object to the use of your personal information for direct marketing.

These rights are not absolute and may depend on the circumstances.

To exercise a privacy right, contact us at [email protected].

We may need to verify your identity before fulfilling a request.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we use your personal information.

18. Email Opt-Outs

You can opt out of optional Card Codex email communications using the unsubscribe or preferences link included in the relevant email.

You can manage portfolio roundup preferences through your Card Codex account where this functionality is available.

If you opt out of optional communications, we may still send messages necessary to administer your account, subscription or the Service, such as security, payment or important service notices.

You have the right to object to direct marketing at any time. We will respect valid opt-out and objection requests.

19. Children’s Privacy

Card Codex is not intended to knowingly collect personal information from children where doing so would require parental consent under applicable data protection law.

If you believe that a child has provided personal information to Card Codex in circumstances where parental consent was required, please contact us at [email protected] so that we can investigate and take appropriate action.

20. Third-Party Websites

Card Codex may contain links to third-party websites, marketplaces and services.

We are not responsible for the privacy practices of third-party websites that we do not control.

We recommend reviewing the privacy information provided by those organisations before providing personal information to them.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Card Codex, our service providers, our processing activities or applicable law.

When we make changes, we will update the “Last Updated” date at the top of this page.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected users where appropriate.

22. Contact Us

If you have questions, concerns or requests relating to this Privacy Policy or your personal information, contact:

Card Codex Ltd

Email: [email protected]

Company number: 17331405

Registered in England and Wales