Privacy Policy

Masterball, LLC ("Masterball") operates this app and masterball.io, and is the controller of the personal information described here.

This policy covers the iOS app, the website, and the emails and push notifications we send you. It does not cover what a third party does with information you give them directly.

Account and profile: name, email address, password (stored only as a cryptographic hash, never in readable form), handle, profile photo, banner, bio and location. Most of these are optional.

Application: the answers you give when you apply, including what you collect, how long you have collected, and how you intend to use the network.

Your collection: the cards you record, their grades, quantities, purchase dates and what you paid. What you paid is yours and is never shown to another member.

Market activity: watchlists, price alerts, offers, commitments, bids and anything you post to a listing.

Support: what you write when you contact us or report something.

Device and session: a device identifier, app build number, platform and the environment your push token belongs to. This is what lets a notice reach the right phone and lets you sign a device out.

Usage: which screens you open and which cards you look at, as product analytics.

Diagnostics: crash reports and error traces, including device model, OS version and app version at the moment of the failure.

Push token: your Apple Push Notification token, if you allow notifications.

Approximate location: inferred from your IP address at a country level. We do not collect precise location.

Apple: subscription and transaction identifiers for any in-app purchase, and, if you use Sign in with Apple, a name and an email address which may be a private relay address. Apple does not give us your payment card details.

Market data providers: prices, sales histories and population counts. Those are facts about cards, not about you. Nothing we receive from a price feed is personal information.

To run your account and review your application. To draw your collection, your portfolio and the market screens. To check what your membership opens. To run offers, commitments, bids and settlement. To send you the notices you have asked for, and the ones that are transactional: application decisions, outbids, settlement, account notices. To keep the network safe: investigating reports, and suspending or removing accounts that break the Terms. To diagnose crashes and fix bugs. To understand aggregate usage so we can improve the product. To meet legal, tax and accounting obligations.

We do not use your collection to train artificial intelligence models, and we do not allow our providers to do so on our behalf.

With other members, and only what you have chosen to make visible: your profile, your handle, and your collection if you have turned that on in Preferences. What you paid is never shared, in any setting.

With the other side of a trade, when you make an offer, take a commitment or win a lot, and only what is needed to complete it.

With our service providers, who process data on our instructions under written contracts.

For legal reasons, where we reasonably believe disclosure is required by law or necessary to protect members, the public or us.

In a business transfer, if we are involved in a merger, acquisition or sale of assets. We will notify you before your information becomes subject to a different policy.

Each is bound by contract to use your information only for the purpose we set:

• Supabase: database, authentication, file storage, server functions
• Amazon Web Services: hosting for the above, in the United States
• Apple: in-app purchases, Sign in with Apple, push notifications

Market data providers supply prices and populations about cards and receive nothing about you.

We update this list when a provider changes. Ask us for the current list at any time.

We have never sold personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA.

There are no advertising networks and no data brokers in Masterball. In particular, we do not sell or license what you own or what you paid for it. What a member holds is the most sensitive thing in this product and it is treated that way.

• Account and profile: until you delete your account, then removed within 30 days
• Collection records: deleted with your account
• Trade records, meaning offers, commitments, bids and settlement: up to 7 years, because tax and accounting law requires it
• Moderation and safety records: up to 2 years after an account closes, so a removed account cannot simply return
• Price reports we acted on: kept with your name taken off them
• Entries in a giveaway already drawn: kept as an anonymous ticket, so the draw stays checkable
• Crash reports: 90 days
• Analytics events: 14 months
• Backups: up to 90 days, after which deleted data ages out of the backup cycle

Nothing in the last four lines identifies you or can be traced back to your account.

We are based in the United States and our infrastructure runs in the United States. If you are outside the United States, using Masterball means your information is transferred there, where privacy law differs from your own.

For transfers out of the European Economic Area, the United Kingdom or Switzerland we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where it applies.

Edit or correct your profile at any time from Edit profile.

Choose which notices reach you, and by which channel, from Notification settings. Push for the whole app is controlled in iOS Settings.

Decide whether you appear in the member directory, whether members can message you, and whether your collection is visible, from Preferences.

Require Face ID or Touch ID before the app opens, also from Preferences. That is a device setting and never travels with your account.

Delete your account from Delete account in your profile. It takes effect immediately, it cannot be undone, and the screen lists what goes and what is kept before you confirm.

Wherever you are, you can ask us for a copy of your information, ask us to correct it, or ask us to delete it. Write to support@masterball.io and we will respond within 30 days.

EU, UK and Switzerland: you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may withdraw consent at any time, and you have the right to complain to your local supervisory authority. We would appreciate the chance to address your concern first.

California: under the CCPA as amended by the CPRA you have the right to know, access, correct, delete, and not to be discriminated against for exercising any of these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.

Other US states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas and Oregon: you have comparable rights of access, correction, deletion and portability, and the right to appeal a decision we make.

We verify requests using the email address on your account.

All traffic is encrypted in transit with TLS, and data is encrypted at rest.

Passwords are stored only as bcrypt hashes. Nobody at Masterball can read your password.

Access to your data is enforced by row-level security in the database, so one member's account cannot read another's, and every aggregate view staff use goes through a function that checks staff first. Whether your membership opens a screen is checked on our servers, never on the device.

No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the relevant regulator as required by law.

Masterball is for adults. It is not directed at children and you must be at least 18 to hold an account.

We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to support@masterball.io and we will delete it.

We update this policy when the product changes. The date at the top always tells you which version you are reading. If a change materially affects your rights we will tell you in the app before it takes effect.

Privacy questions and data requests:

Masterball, LLC support@masterball.io

A person reads that inbox. You do not need special wording to make a request.