Telemetry

What Card Harbor's telemetry sees, and what it never sees.

Card Harbor is a small, unsigned Windows app from an independent developer, not a company you already have a reason to trust. Asking you to install something that runs full-screen over your scanner, your storage layout, and your TCGplayer account is a real ask. The least this page can do is tell you exactly what the app phones home about, in plain language, checked line by line against the actual source code rather than written from memory.

What is sent

Card Harbor uses PostHog for lightweight usage analytics and error reporting. Every event below is a real event name that exists in the app's source. The automatic ones, everything except the feedback form at the bottom of this list, carry no card names, prices, images, or anything else about your inventory.

• App opens and navigation. app_launched when the app starts, tab_viewed with which tab you switched to (Home, Automation, and so on).
• Onboarding progress. onboarding_milestone fires once each time you cross one of five fixed checkpoints: welcome_seen, first_intake_committed, first_card_scanned, first_card_found, first_listing_pushed. The two card checkpoints also carry how many milliseconds passed since the app first opened, so we can tell whether getting started actually takes minutes rather than an evening, and the "found" one carries a true/false sample flag saying whether the card you opened was one of ours from the sample harbor or one of your own. Neither one names the card. Related events mark dismissing the welcome card or choosing scan, import, or sample data as your first action.
• Sample data. sample_data_loaded and sample_data_removed record that you tried the sample harbor and that you cleared it out again. Both are the bare event name with no properties at all.
• The import wizard funnel. Which step of the wizard you're on and how long you spent there, which import format was detected, and a row count rounded into a bucket like "100-999" rather than an exact number. When a batch is committed, the event carries a row count, a copy count, and the estimated dollar value of the batch rounded into a bucket such as "500-4999", never an exact figure and never which cards make up that value.
• Match results. When automatic pull-sheet matching finishes, the event reports how many rows matched, needed a printing pick, or found no match, plus a match rate rounded to the nearest percent. It does not name which cards fell into which bucket.
• The one-click reprice pipeline. Whether a run started, completed, or failed, which outcome it reached, and which internal step failed if any did. Not what got repriced or by how much.
• Crashes and errors. Unhandled exceptions from both the renderer and the main process are reported with a stack trace, so bugs can actually get fixed. Before anything is sent, the app strips your Windows username out of any file path or error message that would otherwise contain it.
• Feedback you send. Nothing about this one is automatic: it fires only when you open the in-app feedback form and press send. The feedback_submitted event carries the message you wrote and the contact email you typed in. It also attaches device diagnostics (app, Electron, and Chrome versions, your Windows release, architecture, locale, and how long the app has been running) and a tail of this session's log, up to 200 recent lines, so a bug report arrives with the evidence already attached. Those lines are redacted for file paths and access tokens before they leave your machine, but they are app logs: unlike every event above, they can mention card names you were working with. The form says so before you send it.

Every install gets a random, anonymous ID that PostHog generates and stores in the app's local storage, the same way a browser would. Nothing ties that ID to a name: it identifies a device, not a person. Card Harbor also does not use cookies for this; file-based app loads don't carry them reliably, so identity lives in local storage instead.

PostHog also sees the IP address every one of these requests comes from, the same as any website you visit. The app does not ask PostHog to discard it, so treat your approximate location as part of what is sent.

What is never sent

Your card inventory itself is not telemetry data: no automatic event ever carries the contents of your inventory. It lives in a SQLite database in your local app data folder, and nothing in that database leaves your machine. Specifically, the automatic events above never include (a feedback report you send by hand is the one exception, and only for the log tail described there):

• Card names, sets, conditions, quantities, or any other inventory contents.
• Scan images or camera frames.
• Prices you set, or the exact dollar value of anything in your inventory.
• Shelf, box, or divider locations.
• Marketplace credentials. Your TCGplayer session and ManaPool access token are encrypted with Electron's safeStorage, which hands the encryption off to Windows' own credential vault, and are stored on disk only as ciphertext. They are never transmitted to PostHog or anywhere else.

Session replay is also off. The app's PostHog setup explicitly disables session recording, so nothing records or reconstructs what was on your screen. Page views and URLs aren't tracked either, partly because a packaged app's internal URLs are meaningless as analytics and partly because they can contain your Windows username, which the app redacts wherever it might otherwise leak into an error report.

How to see for yourself

None of this depends on taking the developer's word for it. PostHog is the named analytics vendor for both the app and this website, the event names above are exactly what's in the app's source, and the ID attached to them is an anonymous device ID. For the complete formal policy, see the Privacy Policy.