When you sign in
You sign in with Google. We receive your name, email address and profile picture, and nothing else from your Google account. Your email is how we know which portfolio is yours.
What you give us
- Your cards. What you add, upload or import: each card's details, quantity, what you paid, its value from your export (CollX, Card Ladder or a spreadsheet), and its photos.
- Card photos. Photos you take are stored in cardstock's private storage. To read a card from a photo, the photo is sent to Kumori's own text reader (OCR), and the text it reads goes to a free AI model Kumori routes to (providers such as OpenRouter, Mistral and Groq), which returns the card's details for you to confirm. When the photo has too little readable text, the photo itself goes to one of Kumori's free image models instead.
- Your choices. Favorites, cards and players you mark PC (personal collection), your watch list and the prices you'd pay, and whether your portfolio is shared.
- A shared export folder. If you set one up, we read the newest CollX or Card Ladder export in it each night to keep your portfolio current.
What we make from it
- A daily reading of each card's value and your total, so your portfolio can show how it moved.
- Prices we look up for your cards, each kept with the link it came from.
- Your style: who you collect and how, counted from your cards. Kumori's language models may word it in one line, from those counts only.
- Notifications in the bell on the site. cardstock does not email you.
Who can see it
- A portfolio you build here is private until you share it; a shared one opens for anyone with its link. You can switch it back on your profile page.
- The site's operator can view the site as you, to fix a problem you've reported or check what you'll see. That's the only person who can, and it's logged in the app.
- We don't sell your data, show ads, or share it with anyone except the services that run the site: Google Cloud (hosting, storage, the database) and Kumori (reading card photos, price lookups, card stories and style lines, through the free AI models it routes to).
Technical records
Like any website, our servers record requests (pages, times, IP address and browser) to run and secure the site. Your session is kept in a cookie named cardstock_session.
Keeping and deleting
We keep your portfolio for as long as you use cardstock. Ask us to delete it, or your whole account, and we will: email [email protected] from the address you sign in with.
Changes
If this changes, the date at the top changes with it, and anything that affects you is said here first.