Privacy policy

Effective October 11, 2026

This policy covers the Slot n' Slab app for Android and iOS, the web version at slotnslab.app/app, and this website. Slot n' Slab is run by Centurion Network, North Carolina, USA ("we", "us"). If anything here is unclear, email [email protected].

The short version: we keep what we need to run your account and your collection, we don't show ads, we don't sell your data, and you can delete your account and everything in it at any time.

What we collect

Your account

Your email address, display name, handle (the name others see, like @cardshark) and profile picture if you add one.
Your password, stored only as a one-way hash. We can't read it.
If you sign in with Google, Apple or Discord: that service's account ID for you and the email address it gives us.
The phones and browsers you're signed in on (a device name, so you can tell your sessions apart), and one-time codes we email you to confirm your address or reset your password. Codes expire after 24 hours (confirmation) or 30 minutes (reset).

What you put in the app

Your collections and the cards in them: quantity, condition, finish, language, grade and cert number for slabs, what you paid, notes, and asking prices for cards you mark for sale.
Photos you add to a card (up to ten per card), your wishlist, decks, price alerts and master sets.
Trades: offers, counter-offers, live trade sessions, trades you record, and the cash amounts in them.
If you're a vendor or organiser: your shop page and its contact details, hold requests, events, check-ins, table maps, sales made in show mode, buylist rates and buys (including a customer's name if you type one in).
A nightly snapshot of what your collection is worth, so the app can show how it moved.

Scans

When you scan a card, the phone reads the text on it and turns the picture into a list of numbers. Those, or the cropped photo itself when the phone can't do that, are sent to our server to find the card. We use them to answer the scan and don't keep them.
Help improve scanning (Account, Scanning) is off until you turn it on. While it's on, the app also sends the scan photo, the text read, what the scan answered and the card you kept, so we can measure and retrain the scanner. Pictures you import from your gallery are never sent this way. Turning it off stops new samples. Deleting your account deletes the samples you sent. A scanner model that was already trained with them isn't undone.

Connections you choose to make

tcgpos: if you link your tcgpos store, we keep an encrypted access token for it and a copy of the stock you pull to a show.
Square: if you connect Square to take payments, we keep encrypted Square access tokens, your Square merchant and location, and a record of each payment you take (amount, description, status). Card details go straight to Square. We never see or store them.
Subscriptions: if paid plans are offered, purchases are made through Google Play or the App Store and handled by RevenueCat. We keep which plan you have and its status, not your payment details.

Technical information

A push notification token for your phone, if you allow notifications.
Server logs with your IP address, the time and the address requested, used to keep the service running and to slow down repeated sign-in attempts.
Counts of how often you use features that have monthly limits.
Problem reports you send (More, Report a problem): what you write, a screenshot if you add one, and your app version, phone model and system version so we can try it ourselves. Each report is also emailed to our support inbox so we can reply to you.

The app has no advertising, analytics or tracking SDKs. It doesn't ask for your location or your contacts. The camera is used only while you're scanning or taking a photo of a card.

On your phone, the app keeps a copy of what it has loaded (for up to 7 days) and any changes you make offline, so it works at a show with no signal. Signing out clears it.

How we use it

To run your account and show your collection on every device you sign in on.
To price your cards, answer scans and send the alerts you set up.
To deliver trades, hold requests and messages between you and the people you deal with.
To send account emails (confirmation codes and password resets). We don't send marketing email.
To keep the service secure, fix problems and, with Help improve scanning on, improve the scanner.

What other people can see

Collections are private unless you make one public. Other users can see your handle, display name and profile picture. They can also see a collection you make public, your trade binder cards, your sell list once you turn on Show my sell list, your shop page, and events you list. Traders at a show see your trade binder cards only if you turn on Match me with traders there. People you trade with see the cards and cash in that trade.

We don't sell your personal information or share it for advertising. We pass the minimum needed to these services, which act for us or for you:

Google, Apple and Discord, to sign you in when you choose them.
Expo (Expo push service), to deliver push notifications to your phone.
Google Workspace, which carries our account emails.
Cloudflare, which sits in front of our servers and passes traffic to them. On this website and the web version, Cloudflare Web Analytics counts page visits and load times without cookies and without identifying you.
Square, tcgpos and RevenueCat, only when you connect them or buy a plan, as described above.

Card names, numbers and prices come from Centurion Network's own card catalog service. What we send it from a scan is the text and numbers read from the card, not who you are. We may also disclose information if the law requires it, or to protect people from fraud or harm.

How we protect it

Everything between the app and our servers is encrypted in transit (HTTPS). Passwords are hashed, and tokens for Square and tcgpos are encrypted before they're stored. No system is perfect, so use a password you don't use anywhere else.

How long we keep it

We keep your account and collection for as long as you have an account. When you delete your account, it and everything in it is deleted straight away from the live service: your collections, cards and photos, wishlist, decks, trades, shop, events, scan samples, problem reports, connections and sessions. Copies of problem reports already emailed to our support inbox are kept there until the problem is dealt with. Copies in our nightly database backups are deleted as those backups roll off, within 14 days. Server logs are kept for security and troubleshooting for 30 days, then deleted.

Your choices and rights

See and change your details in the app under Account.
Export any collection as a CSV file from its edit screen.
Turn off Help improve scanning, notifications, a public collection or your sell list at any time.
Delete your account in the app, on the web, or by email. See Delete your account.

Depending on where you live, you may have rights to access, correct, delete or get a copy of your information. Email [email protected] from your account's email address and we'll answer within 30 days.

Children

Slot n' Slab isn't directed at children under 13 and we don't knowingly collect information from them. If you believe a child under 13 has made an account, email us and we'll delete it.

Changes to this policy

If we change this policy we'll update the date at the top. If a change affects how we use what you've already given us, we'll tell you in the app before it takes effect.

Contact

Centurion Network, North Carolina, USA. Email [email protected].