Privacy policy

Last updated: October 29, 2026

Cardwright is a desktop app for grading trading cards from scans. This page explains what the app and this website do with information about you. In short: your scans and your collection stay on your computer, there are no accounts, and nothing tracks you.

What stays on your computer

Everything you put into Cardwright stays on your computer: your scans and photos, the grades and measurements, your collection, what you paid and sold cards for, your scanner calibration, your settings and any price-service key you add. The app's backups are saved to your own Documents folder. We never receive any of it, except the real grades you choose to share (see below).

What the app sends over the internet

Grading works offline. The app goes online only for the things below, and you can turn online lookups off in Settings.

• Recognising a card and looking up its price: the card's name, set and number are sent to TCGdex (api.tcgdex.net), which lists cards and their TCGplayer and Cardmarket prices. For PSA and other graded prices, a copy with a license key asks the Cardwright server (api.cardwright.app), which gets them from PokemonPriceTracker: it sends the card's TCGplayer product number, or its name, set and number. If you add your own key for PokemonPriceTracker or PriceCharting, the same details and your key go to that service. Your scans are never sent.
• Official card pictures: to recognise a card and to measure the centering of full-art cards, the app downloads the card's official picture from TCGdex (assets.tcgdex.net) or pokemontcg.io (images.pokemontcg.io).
• Exchange rates: to show euro prices in dollars, the app asks Frankfurter (api.frankfurter.dev) for the current rate.
• Updates: the app checks a small file on GitHub (raw.githubusercontent.com) for a new version, and downloads it from there.
• Your license key: when you unlock Cardwright, and about every two weeks after that (every few days for a Pro subscription), the app sends your license key and our product ID to Gumroad to check the key.
• The Cardwright server (api.cardwright.app): a copy with a license key checks in about once a week. It sends the key, a random ID the app made for this computer (not your name or anything about the computer itself) and the app's version, so the server can confirm the key with the store and let it work on up to two computers. Price lookups (above) carry a pass from that check-in. The server keeps only a scrambled (hashed) form of the key and the computer ID, the first letter and domain of the purchase email, which version of Cardwright and when each computer last checked in, and which cards each license priced that day (to count Standard's daily cards, deleted after a few days). Pressing Remove the key from this computer frees that computer on the server.

Like any website, these services see your computer's IP address when the app connects to them, under their own privacy policies.

Sharing your real grades (only if you choose to)

Sharing is off until you turn it on (the app asks once, in History, after you type in a real grade, and it's in Settings, Learning from your real grades). When it's on and you type in the grade a card got from PSA, Beckett, CGC or another grader, the app sends the Cardwright server: the card's name, set and card ID; what the app measured on your scan of the raw card (centering, the corner, edge and surface grades, your light check answers and its estimate); the grade, the grading company and the slab's cert number if you typed it; and the dates. It never sends your scans or photos, what you paid or sold cards for, your notes, or anything about you. Each result is linked to your license only in scrambled form. We use the results to make Cardwright's grading more accurate, and may publish overall accuracy figures that no one can be identified from. You can turn sharing off at any time, and Take back what I shared in Settings deletes everything your license shared from the server.

Show mode (Cardwright Pro)

When you grade cards for customers in Show mode, the customer's name, email address and card grades are kept on your computer only. When you email a report, the app sends it through your own email account (for example Gmail), from the computer you're using, straight to your customer. We never receive your customers' details or their reports. The app asks you to confirm each customer agreed to get the report by email, and customers are let go from the app a month after you finish with them. If you run Show mode as a business, you're responsible for how you use your customers' details.

The password for your email account is kept on your computer, apart from your settings, and is never in a backup.

Buying Cardwright

Purchases are made through Gumroad, which acts as the seller of record and handles payment, sales tax and receipts. Gumroad collects your email address and payment details under its own privacy policy; we see your email address and the order, and use them only to send your license key, answer you and handle refunds. We don't sell or share them.

This website

This website has no analytics, no advertising and no cookies. It's hosted on Cloudflare Pages, which keeps standard server logs, such as IP addresses, to run and protect its service.

Emailing us

If you email [email protected], we use your message and address only to answer you, and delete them when they're no longer needed.

Children

Cardwright isn't directed at children under 13, and we don't knowingly collect information from them.

Changes

If this policy changes, the new version is posted here with a new date.

Contact

Questions about privacy: [email protected].