Privacy policy

This policy explains how Dekkly collects and uses information when you browse the site, create an account, search marketplace listings, purchase or spend digital tokens, request an AI-assisted price analysis, save a watchlist, receive alerts, or submit feedback.

Information we collect

• Account information: name, email address, profile image, authentication-provider identifiers, salted password hashes for password accounts, email-verification status, session identifiers, token balance, and purchased watch-slot capacity.
• Watchlist and saved-item information: search terms, card labels, marketplace selection, alert conditions, saved listing URLs and identifiers, alert frequency, verified alert email, consent and unsubscribe status, scan timestamps, and notification history.
• Search and product activity: search terms or card codes, result counts, listing clicks and URLs, page viewed, timestamps, pseudonymous visitor or event identifiers, Rare Finds activity, and AI price-analysis requests and results.
• Transaction information: selected token pack, Stripe Checkout and payment identifiers, payment status, amount and currency, product and price identifiers, and fulfillment records. Dekkly does not receive or store full payment-card numbers.
• Feedback and communications: feedback category, message, optional email address, submission time, verification messages, alert emails, and related delivery records.
• Device and usage information: browser or device data, IP-derived request identity used for security and rate limiting, referral information, cookies, local-storage preferences, and Google Analytics usage data when analytics is enabled.

How we use information

We use information to operate and secure Dekkly; authenticate accounts; retrieve, compare, and display marketplace listings; provide estimates and AI-assisted analysis; maintain watchlists; deliver alerts you expressly request; process token purchases and fulfillment; prevent fraud and duplicate credits; enforce rate limits; measure and improve the service; respond to feedback and privacy requests; and comply with legal obligations.

Processors and other recipients

Depending on the feature you use, information may be processed by:

• Vercel for hosting, request delivery, deployment logs, and infrastructure security.
• MongoDB for account, watchlist, token, rate-limit, verification, analysis, and application records.
• Google for optional Google sign-in and Google Analytics. Google receives information under its own terms and privacy policy.
• Stripe for Checkout, payment processing, fraud prevention, receipts, refunds where applicable, and payment-event delivery.
• eBay for listing searches and item pages. Affiliate links may include referral identifiers, and Dekkly may receive a commission from qualifying purchases.
• OpenAI for AI-assisted listing identity and pricing analysis. Listing details and the analysis prompt may be sent to OpenAI; do not submit personal or confidential information in listing text.
• Resend for account-verification and opted-in watch-alert email delivery.
• WordPress infrastructure used by the operator for private feedback and limited operational analytics records.
• Public card-data and pricing sources, including Pokémon TCG data providers, Scryfall, and YGOPRODeck, when Dekkly retrieves catalog or reference information.

We may also disclose information to professional advisers, authorities, or transaction counterparties when reasonably necessary to comply with law, protect users or the service, investigate abuse, or complete a business reorganization. We do not sell personal information for money.

Cookies and local storage

Authentication and security features use cookies. Google Analytics may use cookies or similar identifiers. Guest watchlists, saved listings, page-size selections, marketplace preferences, and pseudonymous event identifiers may be stored in your browser. You can clear browser storage or adjust browser settings, but doing so may remove saved guest preferences or sign you out.

Retention

We retain account, purchase, token, and fraud-prevention records while your account is active and as needed for financial, security, and legal obligations. Watchlists and alert consent remain until you delete or replace them, unsubscribe, or request account deletion. Verification links expire after one hour. Operational logs, rate-limit buckets, analytics snapshots, feedback, and AI-analysis records are retained only as long as reasonably necessary for their stated purpose, troubleshooting, security, or legal compliance. Backup copies may persist temporarily after deletion.

Your choices and rights

You may stop watch-alert emails at any time using the one-click unsubscribe link in an alert or by changing alert consent in your profile. You may also clear local browser data, avoid optional Google sign-in, or refrain from using AI analysis. Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to appeal or complain to a regulator.

Security, children, and international processing

We use reasonable administrative and technical safeguards, but no online service can guarantee absolute security. Dekkly is not directed to children under 13, and users who are not old enough to consent to online services in their jurisdiction should not use it without appropriate parental authorization. Service providers may process information in countries other than your own, subject to their legal safeguards.

Contact and policy changes

Contact hello@dekkly.com for privacy questions, rights requests, or account deletion. We may update this policy as the service changes and will revise the date above. Material changes may also be communicated through the service.

See also the Terms of Service and Token Refund Policy.