Compy is a mobile app for trading card vendors and collectors: scan a card, see its identity and price, and keep track of buys and inventory. This page explains what information Compy collects, why, and how it's used.
Who this policy covers
Compy is operated by TJ Cards LLC.
Your account
You can try the scanner without an account. Everything else needs one. You can sign up with an email address and password, or with Google. If you use Google, we receive the email address it shares with us. We never see or store your Google password.
What we collect
Your email address, when you create an account.
Photos you take to scan a card. Cards are identified on your phone. Only if that can't run (for example the first scan while the scanner is still downloading) is the photo sent to a card identification service. Small thumbnails of cards you save, and photos you choose to add to your Collection, are kept with your account.
Buylist information, if you buy or sell on the buylist: the photos of the front and back of each card you sell (and, for buyers, photos of cards you flag), the sale's history and any review decision, your shipping or return address, buyer applications, strikes, and our own internal notes on problems with your sales, kept to prevent fraud and settle disputes. A seller's photos and condition are shown to the buyer; a buyer's address is shown to a seller only for a paid sale; a seller's return address is shown to a buyer only while they owe a return. People at Compy see these when reviewing a problem.
Buyer applications, if you apply to post buy orders: your business name, the state and number of your sales tax resale permit, and the certificate file you upload. We keep these to approve buyers and to show tax authorities why buylist sales to resellers weren't taxed.
Your buyer profile, if you're an approved buyer. This is shown to other Compy users: your buyer name, when you started buying, your badges, the bio and links (for example Instagram) you choose to add, how many cards you've bought and from how many sellers, how you usually handle sales (how often you offer less or send cards back, and how fast you check cards), the star ratings and reviews sellers leave you, and the buy orders you have open.
Your public page, if you turn one on (Vendor Pro). Anyone with its link or QR code can see the name, picture, bio, links and buying percentages you add. If you switch them on, it also shows your public collections, how many cards you've scanned and sold, when you joined, your badges and your seller reviews. It never shows what you paid or what your cards are worth in total. Any payment names, Zelle email or phone, Zelle QR picture and updates you add are public too, and we keep a list of who follows you so we can tell them about your updates. Turn it off on your Profile page at any time.
Reviews you write about a buyer after a finished sale (stars and an optional comment). Reviews are shown on the buyer's profile without your name.
Invites: your invite code, and who joined with it, so we can add the free Vendor Pro time for both of you. If you joined with a Compy partner's link, the partner earns a share of Compy's fees from your sales and subscriptions for 12 months; they see only counts and amounts, never who you are.
Payment details for buylist sales are collected and held by our payment processor (Stripe), not by Compy. We see only what we need to run a sale - for example that a payment cleared, the last digits of a bank account, and payout status.
The cards, prices and notes you save - your scan history, buy lists, folders, and your Collection - so they can be backed up to your account and used across your devices.
Basic scan performance data - how long a scan took and whether it worked - to help us keep the app fast and accurate. This isn't tied to your identity unless you're signed in.
Team information, if you create or join a shop/team account - who owns the team, who's a member, and the team's shared buy and inventory data.
Things you set up: price alerts, your wishlist, share links, notification choices, and, if you turn on notifications, the push address your phone gives us to deliver them.
Messages you send us through Help & support, and our replies.
Crash reports: when something breaks, the error, the page it happened on, and your browser and phone type, so we can fix it.
Page visits: we use Vercel Web Analytics to count which pages are used. It doesn't use cookies and doesn't identify you.
Days you use Compy: if you're signed in, we note each day you open the app, just the date, to see how many people keep coming back.
Where you came from: if you opened Compy from one of our promotion links, we count the visit and note on your account which link it was, so we know which promotions work. We keep a one-way scramble of your connection for that count, not your IP address.
We don't collect your precise location, we don't use advertising trackers, and we don't sell your information to anyone. The short ads free accounts see are Compy's own, shown from the app itself - no ad network, and nothing about you is shared with advertisers.
People you deal with
Vendors can add names, contact details and notes about people they buy from or sell to, to keep track of their own deals. These are saved to the vendor's account, are only visible to that vendor, and are never part of our market data. Vendors are responsible for what they add. Deleting an account removes them.
Sale prices (anonymous market data)
When a card changes hands through Compy - a finished buylist sale, or a buy, sale or trade a vendor saves in the app - we keep the card, its condition or grade, the price and the date in a separate sales record, so Compy can show real sold prices and may share or license that market data in the future. This record never includes your name, email, account, notes, photos or who the other person was; it only keeps a one-way code so one account can't skew the numbers. You can stop your vendor deals being added at any time in Settings > Account ("Share my deal prices"); turning it off removes them from the record within a day. Buylist sales are always recorded, because Compy is part of them.
Who we share information with
We use a small number of outside services to run Compy:
Card identification services receive the photo you take of a card, in order to identify it. They don't receive your email or account information.
Google or Apple, only if you choose to sign in with them.
Cloudflare Turnstile checks that a real person is signing up or logging in. It looks at basic signals from your browser to tell people from bots, under Cloudflare's privacy policy.
Apple and Google push services deliver notifications, if you turn them on.
PSA receives only a slab's certificate number, when you scan a PSA slab, to look up that slab.
Stripe, our payment processor, for buylist payments and payouts. Stripe may verify your identity and collect tax details for sellers, under its own privacy policy.
Shippo, our shipping-label service, receives the sender's and receiver's names and addresses (and the sender's phone and email, which the carrier requires) when a label is bought in the app, checks an address with the carrier when you save one, and tells us where a package is from its tracking number. Labels are printed by the carrier (USPS, UPS or FedEx), which receives the same details.
Resend sends our emails (confirming your email, resetting your password, buylist updates that carry a deadline or money, and a monthly summary of your Collection's value) and receives your email address and the message to do so.
RevenueCat handles subscriptions bought in the iPhone app. It receives your Compy account id and your App Store purchase history (which plan, when, renewals and refunds) - never your card details, which only Apple sees.
Supabase hosts our database (your account, saved buys, and Collection) and handles sign-in.
Vercel hosts the app itself and provides the page-visit counts above.
Market prices and card images come from third-party card-pricing and marketplace services. Looking up prices or auctions doesn't send your account details to them, but your phone loads card pictures and the scanner directly from those services, so they can see your internet address, like any website you load something from.
Each of these services can see the data needed to do their job (for example, the card identification service sees a photo, and Supabase stores your account data). Their own terms and privacy policies apply to what they do with it.
How long we keep information
We keep your account and saved data for as long as your account exists. You can delete your account at any time in the app (Settings > Account > Delete account), or ask us to. Deleting your account removes your saved buys, Collection, settings, alerts, wishlist, share links, buyer profile, team memberships, unused sale photos and any scans you sent for review. If you have bought or sold on the buylist, the records of those sales (amounts, dates, photos and any review decisions), our internal notes on problems with those sales, and a buyer's resale certificate are kept as long as the law requires for tax and financial records and to prevent fraud, with your sign-in removed. Records of subscription payments (amounts and dates) are kept the same way. We keep a Founding Member number on file so it isn't reused. Support messages are kept with your name and email removed. Copies in our nightly backups are deleted automatically within 14 days. Crash reports and page-visit counts are kept while they're useful for fixing problems and understanding use, without your account attached.
Your choices
Turn notifications on or off, or choose which kinds you get, in Settings > Notifications.
Stop the monthly summary email with the Unsubscribe link at the bottom of any summary, or in Settings > Notifications > Monthly summary. Emails about a buylist sale you're part of follow the Buylist sales switch in the same place.
Keep your vendor deals out of the market data in Settings > Account.
Make any collection private, or stop sharing a share link, at any time.
Edit or remove your buyer profile's bio and links in Buyer Desk > Profile.
Download a copy of what Compy keeps for your account in Settings > Account > Download my data.
Ask us for a copy of your information, or to correct or delete it, by emailing us (see below). We'll answer within 30 days.
Security
Your data is stored with encrypted connections, and access to it is restricted so that only your own account (or, for shared team data, your team) can read it. No method of storing or transmitting data is perfectly secure, but we take reasonable steps to protect your information.
Children's privacy
Compy is not directed at children under 13, and we don't knowingly collect information from children under 13. If we learn we have, we delete it. Buying or selling on the buylist is only for people 18 or older.
Changes to this policy
If this policy changes in a meaningful way, we'll update the date at the top of this page and tell you in the app.
Contact
Questions about this policy or your data: contact TJ Cards LLC at support@getcompy.app.
Compy is an independent app by TJ Cards LLC. It is not affiliated with, endorsed by or sponsored by Nintendo, The Pokémon Company, Bandai, Disney, Ravensburger, Riot Games, PSA, CGC, Beckett, TAG, TCGplayer, eBay or Alt. All game names, card images and trademarks belong to their owners. Some eBay links are affiliate links, so Compy may earn a commission.