Privacy policy

Stashtab Sync (“Sync”) is a business tool for game stores: you connect the marketplaces you already sell on, and Sync keeps your card inventory listed, priced, and taken down when it sells. This policy describes what Sync does with information belonging to you, the seller, and to the marketplace accounts you connect. It does not describe what a connected marketplace does with its own data.

Personal information you give us. When you create a Sync account we store your name, email address, a hashed password, and session records. We do not store your password in a form we can read. If you join a waitlist for a marketplace Sync does not support yet, we store the email address you submit and the name of the platform you asked for.

Information collected through technology. Sync sets a session cookie so you stay signed in, and it records product usage events and error reports through the analytics and error-monitoring providers listed below, including the page you were on, your browser and device type, and the time of the event. These records are keyed to your seller account identifier, not to a buyer.

Connecting a marketplace grants Sync access to that account on your behalf. For each connection we store the credentials the platform issues us — access tokens, refresh tokens, and webhook or notification secrets — along with the identity of the connected account (for example a Shopify store domain or an eBay seller account identifier), the scopes you granted, and expiry timestamps.

Every credential is encrypted at rest with AES-256-GCM using a key that is held in our deployment environment and never stored beside the data it protects. Credentials are decrypted only in memory, only to make a request to the marketplace that issued them. They are never logged, never shown in the Sync interface, and never shared with another seller or another platform.

You can disconnect any marketplace from Sync’s settings at any time. Disconnecting removes the stored credentials and asks the platform to remove the notification subscriptions Sync created.

Your inventory. The cards you list through Sync — the specific printing and finish, condition, language, quantity, your price, and which marketplaces you have chosen to list it on.

Your pricing and shipping settings. The pricing rules you configure (price source, adjustments, rounding, floors) and the shipping profiles you create or import from a connected store.

Sale notifications. When a connected marketplace tells Sync that something sold, we store a receipt of that notification so the same sale is not processed twice: the platform, the connection it arrived on, the platform’s own order and event identifiers, the time it occurred, the gross amount and currency when the platform supplies them, and the line items as SKU, quantity, and price. This is the minimum needed to decrement your stock, delist the card everywhere else, and report your monthly sales volume back to you.

Provider request records. For each request Sync makes to a connected marketplace we keep append-only metadata — the method, the path without its query, the response status, how long it took, and safe request identifiers — for 30 days so we can diagnose failures. These records never contain credentials or provider message bodies.

Card catalog data. Sync maintains a catalog of card printings built from public card-data sources. This is public reference data about cards, not data about you or your customers.

Sync does not store your buyers’ names, shipping addresses, email addresses, or contact details. It does not store payment card numbers, bank details, or payout information — Sync never handles the money for a sale. Sale notifications are reduced to order identifiers, SKUs, quantities, and amounts before they are written down, and buyer details in the incoming payload are not retained.

We use the information above to operate Sync for you: to keep you signed in, to publish and update your listings on the marketplaces you connect, to keep your stock and prices aligned across them, to respond to your requests, and to understand how Sync is used so we can improve it. We do not sell, trade, or rent your information, and we do not use it for advertising.

The marketplaces you connect — such as Shopify, eBay, and Mana Pool — receive listing and inventory data because you directed Sync to publish to them. They are not our service providers; their own privacy policies govern what they do with it.

Stashtab Sync relies on the following providers to operate. Each processes information on our instructions and for no other purpose.

• Neon — Managed Postgres database hosting

  Seller accounts, encrypted platform credentials, listings, pricing rules, shipping profiles, and sale receipts.

• Vercel — Application hosting, scheduled jobs, and private object storage

  Application traffic, scheduled job execution, and private storage of compressed public card-catalog snapshots.

• PostHog — Product analytics

  Product usage events such as sign-in, platform connected, and listing created, keyed to a seller account identifier.

• Sentry — Error monitoring

  Error reports and diagnostic context from failed requests and background jobs.

Account, listing, pricing, and shipping data is kept for as long as your Sync account is open. Credentials for a connected marketplace are kept until you disconnect it or the connection is deleted. Sale receipts and monthly sales rollups are retained as the operational record of what Sync synchronized. Provider request records are deleted after 30 days. Card catalog data is public reference data and is retained independently of any seller account.

You can disconnect any marketplace from Sync at any time, which removes the credentials Sync holds for it. To close your Sync account and have its data deleted, email us at contact@stashtab.gg.

Sync also honors eBay’s marketplace account-deletion notifications. eBay notifies Sync when an eBay user closes their account; Sync verifies the notification’s signature and then deletes every connection belonging to that eBay account, including its encrypted credentials and sale receipts. We retain only a one-way SHA-256 hash of the deleted account identifier, so that a later reconnection attempt for the same closed account can be recognized. The identifier itself is not kept.

Your password is stored only as a salted hash. Marketplace credentials are encrypted at rest with AES-256-GCM as described above. All traffic between your browser, Sync, and the marketplaces travels over TLS, and our infrastructure providers restrict access to the systems that hold your data.

These measures do not guarantee that your information will never be accessed, disclosed, altered, or destroyed by a breach of our safeguards. We urge you to keep your account credentials confidential and to sign out after each session on a shared device. By using our Service, you acknowledge that you understand and agree to assume these risks.

We may share information with outside parties if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce our Terms of Service, including investigation of potential violations; to address fraud, security, or technical concerns; or to protect against harm to the rights, property, or safety of our users or the public as required or permitted by law.

In the event we undergo a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, your information may be among the assets transferred. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy, and that any acquirer of our assets may continue to process your information as set forth in this Privacy Policy.

You may ask us at any time what information we hold about your account, ask us to correct it, or ask us to delete it, by emailing contact@stashtab.gg. We will verify that the request comes from the account holder before acting on it, and we will respond within the time applicable law requires.

We do not send promotional email. The email we send is administrative — for example a security notice, a service change, or a response to your request — and you cannot opt out of administrative email while your account is open.

As part of the Service, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Service. It does not apply to your use of a third-party website or service reached from our Site, and the privacy policy of that website or service governs your use of it. We encourage you to read the privacy statements of other websites before proceeding to use them.

The Site and the Service are business tools and are not directed to anyone under the age of 18. We do not knowingly collect or solicit information from anyone under the age of 13, or allow anyone under the age of 13 to sign up for the Service. If we learn that we have gathered personal information from anyone under the age of 13 without the consent of a parent or guardian, we will delete that information as soon as possible. If you believe we have collected such information, please contact us at contact@stashtab.gg.

We reserve the right to change this Privacy Policy and our Terms of Service at any time. We will notify you of significant changes by sending a notice to the primary email address on your account or by placing a prominent notice on our Site. Significant changes will go into effect 30 days following such notification; non-material changes or clarifications take effect immediately. The revision date at the top of this page records the latest change, and you should check this page periodically for updates.

If you have any questions about this Privacy Policy or the practices of this Site, contact us by email at contact@stashtab.gg.