GrailTab Privacy Policy
Last updated 28 October 2026
GrailTab is an app for trading card sellers: stock, buying, selling and trading at card shows. Hanamori Labs, LLC, 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States ("we") makes it. This policy covers the GrailTab app for iPhone and Android and its servers. The website hanamorilabs.com has its own policy.
We do not sell your data. The app and GrailFind show no ads and have no advertising, measuring or tracking tools. This page loads none either.
What we collect, and why
- Your account. Your email address, your name, and how you sign in (email and password, an email link, Google or Apple). We use it to sign you in and to show your name to your team.
- Your teams. The teams you make or join, each member's role and what they may do, and the email addresses you invite. We use it so that a team sees and changes only its own data.
- Your business records. Your stock (cards, slabs, sealed product, prices, costs, binders, sticker sheets), buys, sales, trades, deals, holds, shows, cash counts and expenses. We keep them so the app works on every phone of your team, also when you were offline. A record of who changed what is kept for the team.
- Your customers. A customer's name, phone number, note and photo, when your team adds them. Only your team sees them. You must ask the customer before you take their photo or keep their details. When you remove a customer, we delete their photo. Their name stays on your team's old deals and buys.
- Photos of cards. When you scan a card, we keep a straightened cut-out of that card as the card's own photo. You can also add a photo to a card yourself. A card's photo stays while the card is in your stock. Each photo opens at a random web link with no sign-in: anyone who has the link can see it, and phones, browsers and web caches can keep a copy for up to a year. A cut-out that no card uses goes after 2 days.
- Card scan photos. When you scan cards, we also keep the whole photo you took and what the scan found, for 30 days. We use them only to check and improve how well scanning works. Only GrailTab's own admins can see them. This photo has no public link and goes to no one else. After 30 days we delete it.
- Cards our list does not have. When you add a card under your own name, we note that name and its language, so that we can add the card to our list. The note has no photo and nothing about you.
- Feedback you send. When you send us a problem, an idea or a question from the app: your words, what kind it is, the screen you were on, the app version, your phone's system and model, your team and your role. If you leave Send the screenshot on, also a screenshot of that screen with your drawing on it. A screenshot can show your stock, your prices or a customer: draw a black box over anything you do not want us to see, or turn the screenshot off. Only GrailTab's own admins see your feedback and its screenshot, and you see our status and reply in the app. The screenshot has no public link and goes to no one else.
- Server records. Our servers keep short records of requests (the time, the address of the request and any error) to run and protect the service.
The app uses your phone's motion sensor only to notice a shake, which opens Send feedback. The readings stay on your phone. You can turn this off on the Team page, under Shake to send feedback.
The app uses your camera only when you scan a card, take a photo of a card or of a customer. It does not read your contacts, your location or your photo library, except a photo you pick yourself.
GrailFind, for buyers at card shows
GrailFind is our web pages where buyers find cards at shows and ask a shop to hold one. You can use it without an account: then your list stays on your phone only.
- Sign-in. Your email address and name, when you sign in with Apple, Google or an email link (through Firebase).
- My list. The cards you save, so your list is on every phone you sign in on.
- Holds. When you ask a shop to hold a card: your name and, if you give it, your WhatsApp number. Only the members of that shop see them, so they can message you. Their messages go through WhatsApp, under WhatsApp's own terms.
- One cookie.
_grail_keykeeps your sign-in for up to 90 days and short notes from one page to the next. The pages need it to work. GrailFind has no measuring or advertising cookies.
We keep your list and your holds while your account exists. To delete them with your account, see Delete your account.
Who processes it for us
These companies process data only to run GrailTab for us, under their own terms:
| Company | What for | What it receives |
|---|---|---|
| Railway | Hosts our servers, our database and our card reader | Everything the app stores |
| Google Firebase | Sign-in | Your email address, name and sign-in method |
| Resend | Delivers the sign-in emails that Firebase sends, such as sign-in links and password resets | The email address and the message |
| A card image recognition service | Identifies a card that our own card reader cannot read, and estimates a card's grade when you ask | The photo of that card only |
| Cloudflare | Our web addresses and, when it is on, a second card reader (Workers AI) | Web requests, and the photo of a card our reader is not sure of |
| GitHub | Our list of cards to add | The card name and language a seller typed, with no photo and nothing about the person |
| Our issue tracker | Our private list of things to fix | For a feedback our admins choose to track: your words, the screen, the app version, the phone and your role in the team, with no screenshot and no name or email |
| RevenueCat | Keeps track of purchases in the app, when paid seats start | Your account's id and what you bought |
| Apple and Google | The app stores, sign-in with Apple or Google, and any purchase in the app | What their stores and sign-in need |
To find cards and prices, our servers ask card data services (such as Scrydex and TCGdex) about card names and numbers. They receive no personal data. When you check a grading certificate, the app opens the grader's own website, which sees your phone as any website visit does.
These companies may process data in the United States and other countries.
How long we keep it
- Card scan photos: 30 days, then we delete them.
- Feedback and its screenshot: while your account and your team exist. When you delete your account, or your team is deleted, we delete your feedback and its screenshot. A feedback our admins chose to track stays in our issue tracker, with no screenshot and no name or email.
- Your account, teams, records, customers and card photos: while your account or your team exists. When you delete them, we delete this data.
- Server records: up to 90 days, as our host keeps them, to run and protect the service.
Delete your account
Email [email protected] from the address of your account, and we delete it within 30 days.
We delete your account, your sign-in, your scan photos, your feedback and its screenshots, your GrailFind list and holds, and the data that only you use. The words of a feedback we track stay in our issue tracker, with no screenshot and no name or email. A team that has other members stays for them. If you are the only owner of a team with other members, tell us in your email which member becomes the owner, or that we should delete the team.
A team that stays keeps its history of changes, with your name on the changes you made. Copies of card photos that phones, browsers and web caches already keep can stay with them for up to a year.
Your rights
Depending on where you live, you can ask to access, correct or delete personal data we hold about you, object to or restrict its use, and withdraw consent at any time. Email [email protected] and we will answer within 30 days. In the EU or UK you can also complain to your data protection authority.
If you are a customer of a seller who uses GrailTab, ask that seller first: they decide what they keep about you. You can also write to us.
California residents: we do not sell or share personal information.
Children
GrailTab is for card sellers, not for children. We do not knowingly collect data from anyone under 13.
Changes
We will post any change here with a new date, and tell you in the app about a big change.