Privacy Policy

Effective August 12, 2026

The short version

Your card inventory lives on your own computer, not our servers. The only thing we collect is pseudonymous usage analytics, plus whatever you write into the in-app feedback form. We do not sell your data.

This summary describes how Card Harbor works today. If any of it changes, we'll update this policy and bump the effective date before the change ships.

Data stored on your device

Your inventory, scan images, storage locations, app settings, and any marketplace order history the app retrieves are stored in a local database on your machine. They are not uploaded to us. Buyer names and shipping addresses are not kept in that database: the app drops them from every marketplace response before anything is written to it. The one exception is shipping labels. If you connect your own EasyPost account and buy a label for an order, the app fetches that order's delivery address just long enough to request the label, sends it to EasyPost under your own account (see EasyPost's privacy policy), and saves the purchased label file, which shows the destination address, on your machine so you can print it. We never see the address; it moves between your machine, the marketplace, and your EasyPost account. Uninstalling the app leaves this data on disk so it survives reinstalls; you can delete the app's data folder to remove it.

Analytics and diagnostics

The app and website use PostHog for pseudonymous usage analytics and error reporting (which features are used, crash traces). Analytics events do not include your inventory contents. The website's analytics stores its identifier in your browser's local storage, sets no advertising cookies, and has session recording disabled. For a plain-language breakdown of exactly what telemetry contains, see the telemetry page.

Where data lives and how long

Analytics data is held by PostHog under their standard retention and is tied to an anonymous device identifier rather than to your name or email.

Your rights

You can access, export, correct, or delete your personal data. Email john@johncwaters.com and we will handle it. If you are in the UK, EU, or another jurisdiction with data protection rights, those rights (access, rectification, erasure, portability, objection) apply to the data above, and you may also complain to your local supervisory authority.

Changes

Material changes to this policy will be posted here with a new effective date.