Daicho

Privacy Policy

Effective October 24, 2026 · updated November 5, 2026 · version 2026-10-24

This policy explains what Daicho (“we”) collects on daicho.co and in the Daicho app, why, who else sees it, and how to have it changed or deleted. Our Terms of Service cover store data in more detail.

What we collect

  • Store requests: your name, business, email, city, what you run and your message, and whether our reply went out (and, if not, why).
  • Emails you send us: your address and what you write, to answer you. Report a problem in the app, and Report this page on Discover, open one in your mail app with the page you were on, the time and any error reference filled in, and nothing else; it reaches us only if you send it.
  • Accounts: your email and name (the one you set in Settings, or the one your sign-in service gave us). If you sign in with Google, Apple or Discord, we keep that service’s account id for you, and never your password there or its access tokens. Sign-in codes we email are stored only as a scrambled (hashed) value; each works for ten minutes and is deleted within a day. When you sign out of the website, or disconnect Google, Apple or Discord, we keep the time, which ends your website sessions in every browser. When you sign in to the Daicho app on a phone, we keep a record of that phone: an id the app makes for it, its kind (such as iPhone), the app’s build number, when it was last used and how many sales it was still waiting to send, with its sign-in stored only as a scrambled (hashed) value. Signing out of the website leaves the phone signed in; signing that phone out (in the app, or under Sign-in methods in the website’s Settings), disconnecting Google, Apple or Discord, or deleting your account ends it. When you accept our Terms we record the time, the versions you accepted, and the IP address and browser you used. When your account has no store, store approval, store request or store invitation, and you have not agreed to our Terms as a collector, we ask whether you collect cards, sell them or both; any account with no store, approval or invitation can also answer, or change its answer, later. We keep your answer and when you gave it, also once you have a store, until you answer again or delete your account. A store owner can invite someone to their store by email: we keep the address, the store and who invited it until the person joins or declines when they sign in with that address, or an owner cancels it; it adds them to nothing until they join. A store can have several owners: an owner can make someone who joined an owner too, and each owner sees the invitations and gets the store’s price alert emails. Everyone in a store sees who belongs to it (each person’s email address, and their name if they have one) and, once a store has had more than one person, who recorded each sale and purchase (by name, or email address without one, and by both when the name is someone else’s too or is another person’s address), on screen and in the store’s exports. Someone who leaves a store stays named, as having left, on what they recorded there, by the name they go by now (or email address without one), until they delete their account.
  • Store data: what you enter: store name and settings (including a Discord webhook link, if you add one), inventory, costs, sales and purchases, shows, pricing rules, alerts and storefront details. The sales records have no fields for your customers’ names or contact details. Each sale, purchase or trade recorded at the counter also keeps a receipt, so one sent twice is recorded once: who recorded it, its total and payment, when it arrived, any check it was flagged for (such as a slab with no cert number), and, from the Daicho app, the phone’s id, the time on the phone when it was recorded and how far the phone’s clock was from ours. A receipt stays with the store’s records, even after its sale is undone or deleted, so a late copy cannot record the sale again. If the store connects Square: its Square account and location ids and the location’s name, the Terminals it pairs (their names and Square’s ids for them), and for each sale charged on a Terminal, Square’s checkout and payment ids, each checkout’s status, and the sale as it waited for payment. We keep the store’s Square access keys encrypted and delete them when Square is disconnected. We never receive full card numbers. To check a payment, our server reads Square’s record of it, which can include the card’s brand, first six and last four digits and expiry, and the cardholder’s name and email; we keep none of these.
  • Activity record: to find out what happened when a record goes missing or is changed without permission, we record which account did these things, when, and what changed: deleting a sale or purchase, deleting an inventory line or marking it not carried, applying, reverting or discarding a repricing, or taking, keeping or undoing a new price on the sticker walk, replacing counts from a spreadsheet, saving the storefront or changing the Discord webhook, connecting or disconnecting Google, Apple or Discord, connecting or disconnecting Square (or changing the location its Terminals take payments at), pairing or removing a Terminal, marking a Square payment checked, signing out, our approving, removing or re-sending a store approval, and our changing a product’s type (which converts every store’s lines of it). It holds no passwords, webhook links or anyone’s contact details.
  • Want lists and email alerts: your email, ZIP code, distance, the card you want (and the printing and most you’d pay, if you say), and which alerts we sent. A want list is these alerts kept on your account: every alert to your account’s address, which you add, change, turn on and remove on My want list, where we also show which stores near you list each card now.
  • Collections: the cards you record (the card, its printing, condition and language, the grader and grade of a graded card, and how many), the names of any binders you make, and, if you enter it, what you paid and for how many copies.
  • Card scanner (at a store’s counter, or adding cards to your collection): the camera picture stays on your device. Only the text read from the card is sent to us, to find the card in the catalog, and we don’t keep it.
  • Automatically: our hosting provider logs each request (IP address, browser, page and time). To stop abuse we keep a scrambled (hashed) form of IP addresses and emails; each record counts for at most 24 hours and is deleted within a day after that. Cookies keep you signed in, protect the sign-in forms and an owner’s Connect Square (a ten-minute check that Square’s answer comes back to the owner who asked), and remember your time zone and whether you hid the side menu.
  • Page views: to see which pages and features get used, Vercel Web Analytics counts each page you open: its address without anything after a “?” or “#” (and without the private link from a shopper-alert email), the address of the page that sent you here, as much of it as that site shares (from our own pages, only our site’s name), your approximate location (country, region and city), your browser and operating system (with their versions), your device’s type, make and model, and the time. It sets no cookies and stores nothing on your device. Vercel says it tells visits apart by a scrambled (hashed) value made from your request, discards that value after 24 hours and can’t use it to follow you to other sites.
  • Page speed: to see how quickly pages load and respond, Vercel Speed Insights measures the first page you open on a visit, or one you reload (not each page you then go to in the app): up to six timings, such as how long the page took to show, how quickly it answered a tap or click and how much it jumped around, with the page’s address cut the same way as page views, which part of the page a timing is about (such as “an image in the header”, never its text), your connection’s speed (such as “4G”), your approximate location (country, region and city), your browser and operating system (with their versions), your device’s type and make, and the time. It sets no cookies and stores nothing on your device. Apart from these page counts and speed measurements we use no analytics, and no ads, tracking pixels or session recording.

How we use it

  • To run the Service: sign you in, show your store, and send the emails you asked for (sign-in codes, replies to store requests, alerts).
  • To choose where you start, where we take you when you come back and which links we show you (in your collection, on Discover and in a store’s app): from your answer to that question or, if you have not answered, from whether you agreed to our Terms as a collector. Your answer never decides whether you can set up a store.
  • To show you your collection and an estimate of what it is worth.
  • Which cards appear in collections (never who holds them) decides which prices and graded sales we refresh first. Collection records never feed street prices or sales counts, are never shown to any store (including one you work for), and are never sold.
  • To prevent abuse and keep the Service secure, and to answer you when you contact us.
  • To see which pages and features are used and how fast they load, from the page counts and speed measurements above, so we know what to improve.
  • To build street prices and weekly sales counts: aggregates of the sales stores record. They contain no personal information and never name a store.
  • The people who run Daicho can see store requests, and can see store data and collections when they need to for support, security or operations.
  • We don’t sell personal information, and we don’t share it for advertising.

Who else sees it

  • Vercel hosts the site, keeps its request logs, counts page views and measures page speed (above).
  • Neon hosts the database.
  • Resend delivers our email, so it sees each recipient and message.
  • ImprovMX forwards email sent to our daicho.co addresses to our inbox at Google (Gmail), so both see those messages.
  • Sentry receives a report when a page or our server runs into an error: the error, the page’s address without anything after a “?” (and without the private link from a shopper-alert email), the pages opened and requests made just before it (cut the same way, another site’s by its name only), your browser and operating system, and the time. It doesn’t get names, email addresses or cookies, or what you clicked or typed. Your browser sends its reports straight to Sentry, so Sentry sees your IP address; we set it not to keep it.
  • Google, Apple and Discord, only if you sign in with one of them: they learn that you signed in to Daicho.
  • Discord receives the price alerts a store sends to its own webhook (cards and prices, no personal information).
  • Square, only if a store connects its Square account: when a sale is charged on the store’s Square Terminal, our server sends Square the amount and a random reference for the sale, and, when an owner pairs a Terminal, the name they give it. Square handles the card payment under the store’s agreement with Square and Square’s own privacy policy. We send Square nothing about the cards sold or about the store’s customers.
  • Card image servers (TCGplayer’s, and pokemontcg.io’s on sample pages): your browser, or the Daicho app, loads card pictures straight from them (the app only from TCGplayer’s), so they see your IP address and your browser’s or the app’s standard request headers, but not which page or screen you are on.
  • CardSight AI or eBay: to find what graded copies of a card sold for, our server sends them only what names the card (its name, collector number, set or language), and nothing about a person, a store or a customer.
  • eBay, only if you open a “Sold on eBay” link in the Daicho app (the website has none): the app opens eBay’s search for that card and grade, so eBay sees that search and your visit under its own privacy policy. We send eBay nothing, and it doesn’t see which of our screens you came from.
  • The public: a store’s storefront details and listings on Discover, once the store turns its storefront on.
  • Others, only when needed: when the law requires it, to protect people’s rights or safety, or to a company that takes over the Service (including one we form), which must keep to this policy.

Each service listed above that handles data for us does so only to provide its service to Daicho, under terms that require it to protect the data at least as this policy does. All of this is processed in the United States.

How long we keep it

  • Accounts and store data: while the account is open. Deleted at once when you delete your account in Settings (a store with it when you are its last owner; a store with another owner stays with them), or within 30 days of an emailed request (see the Terms for the export window).
  • Collections: while the account is open. Removing a card deletes it, and deleting your account deletes your collection at once.
  • Store requests: until you ask us to delete them, or delete the account on that address.
  • Emails you send us: while we need them to answer you or fix what you reported.
  • Shopper alerts: an unconfirmed alert is deleted after 7 days, and a stopped one (or one removed from your want list) 30 days after you stop it. Deleting your account deletes every alert to its address at once.
  • Square: the connection, including after it is disconnected (its Square account and location ids and the location’s name, without the access keys), and its Terminals, including removed ones, for as long as the store exists; the access keys until Square is disconnected; each charge on a Terminal (Square’s ids and statuses for it, and the sale as it waited) for as long as the store exists, except a charge with nothing paid, recorded or listed to check, deleted 30 days after its last attempt began.
  • Signed-in phones: until the phone is signed out, the account is deleted, or 30 days after it signed in (deleted within a day after that).
  • Sign-in codes: 10 minutes, deleted within a day. Abuse-prevention records: 24 hours, deleted within a day after. Error reports: 30 days, at Sentry.
  • Page counts and speed: Vercel shows us page counts for up to 12 months and speed measurements for up to 30 days; Vercel says it discards the value that tells visits apart after 24 hours.
  • Activity records: one year. Deleting a store deletes its records; deleting an account deletes the account’s own and takes the account off the rest.
  • Database backups expire on their own within 7 days.

Your choices

  • To delete your account yourself, use Delete account in Settings (an account with no store has the link at the foot of My collection and on its store request page): your account, and your store if you are its last owner, are deleted at once, so export your ledger, inventory or collection first. In the Daicho app, Delete account is also on the screen it shows before a store is set up.
  • In your collection you can change or remove any card, and download the whole collection as a CSV file.
  • In Settings you can set, change or clear the name your store sees.
  • To see, correct, export or delete your information, email legal@daicho.co. We answer within 30 days.
  • Every email about a live shopper alert has a link to stop that alert, or every alert to that address, and you can remove any of them on My want list once you sign in with that address. Store owners can turn email alerts off in Settings.
  • Do Not Track: we don’t track you across other sites and don’t let anyone else do so on ours, so we treat every visit the same whether or not your browser sends that signal.

Children

Daicho is not meant for children under 13, and we don’t knowingly collect their information. Store accounts are for adults (18+). A collector account (a collection and want list) is for people 13 and older, with a parent’s or guardian’s permission under 18. If you believe a child under 13 gave us information, email legal@daicho.co and we will delete it.

Security

Every connection uses HTTPS, the database is encrypted at rest by its provider, sign-in codes are stored hashed, a store’s Square access keys are stored encrypted with a key kept outside the database, and access to data is limited to the people who run the Service. No system is perfectly secure; if your information is ever exposed, we will tell you as the law requires.

Changes

When we change this policy, the date at the top changes. For a material change we will also email account holders.

Contact

Questions or requests: legal@daicho.co.