Account policies

Privacy Policy

Effective September 27, 2026 · Version 2026-09-27

This policy describes the information WhatLedger processes to operate your account and the features you choose. It also explains account deletion and optional connections.

Information we collect

• Account information: your email address, username, password hash, account creation and sign-in timestamps, email-verification status and the policy versions and time accepted at signup.
• Your app records: inventory, purchases, sales, shows, materials, watchlists, goals, custom layouts, settings and optional tax records or documents you enter or upload.
• Usage and billing records: AI scan request identifiers, usage counts and balances, subscription status, Stripe customer references and account-management history. Stripe processes payment information; WhatLedger does not store full payment-card details.
• Security and support information: session and request-security tokens, account emails, operational logs and internal notes or audit records needed to provide support and manage the service.

How we use information

We use information to authenticate accounts, provide the features you select, calculate reports, synchronize connected services, process billing, enforce scan allowances, prevent abuse, troubleshoot problems and respond to support requests. Authorized administrators can view account identity, subscription and scan information and perform account-management actions. Administrative changes are recorded.

Optional AI card scanning

When you choose AI scanning, your selected card photo and game are sent to OpenAI to suggest a card identity. WhatLedger does not save the submitted photo. It retains request fingerprints, identification results and usage counts to prevent repeat billing and enforce limits. This feature does not send Gmail messages, receipts, account credentials or existing inventory records to OpenAI. OpenAI handles API data under its applicable policies. Review AI results before relying on them.

Optional Gmail connection

Connecting Gmail is optional. Google requests read-only access to email messages and settings. That permission is broader than TCGplayer receipts; WhatLedger uses it to search for and read TCGplayer purchase receipts and identify the connected mailbox. This permission does not allow the app to send, modify or delete mail.

WhatLedger processes matching email text and HTML to identify cards, sellers, order numbers, dates, quantities and acquisition costs. It stores parsed purchase information, source message IDs, import status, corrections and audit history. Full email bodies and attachments are not retained. Unclear matches or totals require your review. Encrypted OAuth access and refresh tokens allow syncing while you are away.

Gmail data is not sold, used for advertising or used to train general-purpose AI models. WhatLedger’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Human access to Google user data is limited to circumstances permitted by that policy, including your affirmative permission for support, security needs or legal requirements.

Marketplace order extension

When you choose to send a marketplace order, WhatLedger stores extracted purchase fields for your account review. For unfamiliar table layouts, only column headings are sent to OpenAI to propose a field mapping. Layout discovery may retry three times. Failed layouts automatically create a developer support report containing the marketplace origin, field headings, counts, and failure reason; no order rows are included. Approved field mappings can be reused by other users without sharing your purchase records.

Marketplace referral activity

For TCGplayer, we receive attributed purchase events from Impact: sale amount, currency, date and pending, approved or reversed status. We match the random referral reference to your account to show administrators referral purchases and spending. This does not reveal all of your marketplace purchases. Associated purchase records are removed when your account is deleted.

When a signed-in user opens a CardTrader or TCGplayer affiliate link in WhatLedger, we record the account, card or shopping destination, app section, click count and last-click time. Administrators use this to measure referral activity. These records do not prove that a purchase occurred. TCGplayer affiliate links include a random referral reference sent to Impact so reported conversions can be matched to your account. We do not include your name, email or internal account ID in marketplace links, or record IP addresses or purchase credentials in these counters. Referral records are removed when the account is deleted.

Service providers, links and sharing

Render hosts the app and its data. Google provides optional Gmail access and account email delivery. Stripe handles payments and subscriptions. OpenAI provides optional AI identification. Marketplace integrations communicate with the marketplace you connect or use. Product images can load from the store or image host associated with a saved Buy again link. Those services receive ordinary connection information, such as an IP address, when contacted.

The app uses Impact affiliate scripts on some pages to track impressions and attribute qualifying marketplace links. These scripts may process browser/device information, link activity and identifiers according to Impact’s privacy policy. Gmail contents, credentials and imported purchase records are not supplied to the affiliate script. Session cookies are used to keep you signed in and protect account requests. Your browser settings control cookies and other site storage, but blocking essential storage can prevent sign-in.

Group participation and sharing are optional. If you enable sharing, selected profit metrics and card performance may include values derived from imported purchases. Gmail credentials and full email bodies are not shared with group members. Downloads and exports can contain business details and message references; you control subsequent sharing. Other users may retain copies of information you previously shared.

Google sign-in

If you choose Google sign-in, we receive your Google account identifier, email address and basic profile information. We store the identifier to recognize your account and use your name to suggest a username. We do not receive your Google password. Google sign-in does not grant access to your Gmail inbox; receipt imports require a separate optional connection. You can also add a WhatLedger password through the password-reset email. Deleting your WhatLedger account removes its stored Google sign-in link.

Security

Hosted account documents, including connected-service credentials and business records, are encrypted at rest. Passwords are stored as salted hashes. Hosted connections use HTTPS and access controls restrict account data. No service can promise perfect security. Keep your password private and contact support if you suspect unauthorized access.

Disconnecting and deleting

Use Purchase imports → Manage an existing email connection → Disconnect email imports to stop syncing and remove active Gmail credentials. The app also requests revocation with Google. You can revoke access in your Google Account’s third-party connections settings. Disconnecting Gmail alone preserves imported inventory and cost records.

To delete your WhatLedger account, open Settings → Your profile → Delete account. After a warning, type DELETE MY ACCOUNT to confirm permanent deletion. This removes the account and its records from the active app database, including stored documents, Gmail-derived records, connection credentials, scan balances and memberships. Groups you own are deleted. Linked Stripe subscriptions are stopped as part of deletion; completed marketplace purchases are not reversed. The app may ask you to wait for active scans or syncs to finish. If a step fails, it will tell you rather than claim deletion is complete.

Active account records are generally kept while your account remains open, unless removed through available controls. Deleted information may remain temporarily in hosting backups or technical caches until their retention cycles expire. Payment providers may retain transaction records for their own legal, accounting or fraud-prevention obligations. We cannot erase exports you downloaded or copies held by people or services outside our control. No fixed backup-deletion deadline is promised here; contact us for details about a specific request.

You can also contact us from your account email address to request access, correction, deletion of retained Gmail-derived information, or help exercising rights available under applicable privacy law. We may verify identity before acting on a request.

Age and updates

Account registration is intended for adults age 18 or older. If you believe a child has provided information, contact us. Updated policies will show a new effective date. We will communicate material changes and obtain additional consent where required, including before new uses of Google user data.

Optional show recordings

If you choose to record and upload your own show, WhatLedger temporarily stores the silent recording to identify cards, visible auction numbers, and final sold or skipped results. Screen content inside the shared tab is included; avoid displaying unrelated personal information. Analysis runs on our server using local recognition software. Review and approve results before inventory changes. Uploaded video is removed from active recording storage after all results are imported or dismissed, or within 72 hours of upload creation. Local upload copies are removed after a successful upload. Approved sale records and auction numbers remain in your account. A recording is not proof that every sale was captured.

Contact

Questions, privacy requests or account support: nickgcodes@gmail.com.