Beltstra Co

Privacy Policy

Last updated: 17 October 2026 (version 2026-10-17). Changed: sign-in with Google and Apple; what is stored for binders, photos, shows, ledgers and buys and for how long; what a shared page shows with no sign-in; the services that process email and card photos; how to export and delete.

This Privacy Policy explains what information Beltstra Co ("we", "us"), a sole proprietorship based in Aubrey, Texas, USA, collects and how we use it.

1. Information we collect

Payment information

We do not collect or store your card or bank details. All payments are processed by our Merchant of Record, Paddle.com, who collects the information needed to complete your purchase (such as name, email, billing country, and payment details) under their own privacy policy.

Your account

To run your account we store your email address, a salted hash of your password (never the password), the first name you choose to show, your avatar if you add one, when the account was made, and the license record that says which plan you are on and until when.

Sign in with Google or Apple

If you sign in with Google, Google tells us your email address, that it is verified, your first name, and a Google account ID; we store the email, the first name (if you had none yet) and the ID, so the same Google account signs you in next time. We never see your Google password and we ask Google for nothing else. Apple sign-in, where we offer it, works the same way with Apple's ID and the name Apple sends once. Google and Apple see that you signed in to Beltstra, under their own privacy policies.

Card photos and the services that read them

When you scan a card or a binder page, the photo goes to our server, which sends it to an image-reading service to identify the cards. Today those services are Groq and Google (Gemini); they receive the photo and return the card names, under their own terms, and we do not send them your name or email. The scan photo itself is deleted from our server after the read. What stays is what you choose to keep: when you keep a card that the app could not match to a catalogue picture, its photo is saved on that card so your binder can show it; the pictures you upload for a binder cover, your avatar and the childhood-binder feature are saved too. All of these stay until you remove them or delete your account. We record per-scan usage (a count, a time, and basic device and connection information) to enforce your plan's scan allowance and to detect account sharing or automated abuse.

Your collection, binders, ledgers and buys

We store what you put in: the cards in your collection with their prices, what you paid where you told us, your binders and where each card sits, the people you sell for and their share of each sale, your Piggy Bank entries, payouts, buys and show tables. These stay for as long as your account exists. Every change to a money record is kept in a history (an undo, a removal, an edited cost) so a figure can always be traced. When you delete your account the collection, binders, photos and most records are removed at once; money records (sales, Piggy Bank entries, payouts) are kept with your name and email removed, because the other side of each sale belongs to someone else's records; our account deletion page lists it exactly.

What a shared page shows with no sign-in

A binder link, an Explore listing, a show table or a person's no-login page can be opened by anyone who has the link, with no account. It shows what you chose to share: the cards, their pictures and market prices, the binder's name, your first name if you set one, and for a show table its place and days. It never shows what you paid, your cash, your email address, or your other binders. A person's no-login page shows only their own cards, sales and payouts.

Email

We send email through Resend: sign-in codes, a welcome note, order confirmations, friend requests you make, the morning email if you turn it on, and notes when a trial is ending. Resend processes your email address and the message under its own privacy policy. We do not send marketing email to a list.

Links page visits

When you open our links page (the page our printed QR code opens) or tap one of its buttons, your browser sends a small visit notice to our server. We record the time, which button was tapped, your browser type, and your network address with its last part removed. We use this only to count visits. The links page itself sets no cookies and stores nothing on your device. The app pages its buttons lead to may keep things there, such as the cards you price or an ID (see "App visits and error reports" below).

Short link visits

Some shared binders have a short link on beltstra.com, such as beltstra.com/premiumcardco. It sends you on to the binder in the app. When the binder opens, the page tells our server, as it does for every shared binder link, and the server counts the visit for the binder's owner, noting that it came through the short link and whether it opened inside Instagram's app. To count each visitor once, it keeps a coded form of your network address and browser type, never the address itself, for about four months. The short link page itself sets no cookies and stores nothing on your device.

App visits and error reports

We use PostHog to count visits, sign-ups and orders, and Sentry to find and fix errors. Here is what PostHog gets from your browser:

Our server also tells PostHog when you make an account; when you save your first card, and each time you save a card; when you make your first binder, and each time you make a binder; each time you scan cards or post a show table; and when you start a checkout or pay for an order. If you scan with a free price check before you have an account, our server notes that scan too, under the random ID from your visits when your browser has one. These notes carry only plain details, such as how you signed up, which screen a scan came from and how many cards a free scan read, whether a saved card is new to your collection or another copy, how many pockets a binder page has, how many days a show table stays up, or what you bought and its price. They never say which cards you have. We never send PostHog your name or email address: it knows your account by a coded ID. When you sign up, that coded ID is linked to the random ID from your visits, so PostHog can tie your account to those visits and to your rough location.

Sentry gets a report when something breaks. Only our server sends reports to Sentry: if the app hits an error on your phone while you are signed in, the app tells our server, which may pass it on. A report says what went wrong, where in our code, on which page and in which browser. Our server is set up to leave out your account, cookies, network address and the forms and photos you send us, and to remove email addresses, sign-in codes, the codes in shared links and payment IDs before a report is sent.

Your eBay account, if you connect it

If you connect your eBay account, we keep the sign-in token eBay gives us, so the Service can create the listings you ask for and show your open eBay orders on the Pack orders screen. We only read your orders; we never change them. While you pack, that screen shows each buyer's first name and last initial so you can match the order to its envelope. We do not store buyer names or addresses. When you mark an order packed, we keep its order number, the listing title and what eBay pays you for the card, so your collection and profit stay correct. You can remove the Service's access at any time in your eBay account settings.

Friends

You can add friends in the app by scanning each other's friend code in person. The code changes every minute and does not contain your email address. Your friends see the name you chose and, unless you choose to keep your cards private, the cards in your collection: card names, printings, how many you have and their market prices. Friends never see what you paid, your cash, cards you sell for other people, or your email address. You can remove a friend at any time.

If you give a card to a friend in the app, that friend sees the card, its market price when you gave it and your name, and the card only moves into their collection if they allow it. They never see what the card cost you. Both of you can see the gift in your own history.

Binders and card pictures

A binder in the app is your own page-by-page arrangement of cards you already have in your collection. While you share your cards, a friend can flip through your binder pages read-only, in the order you arranged them; they never see what you paid. Card pictures are not stored by us: your browser asks the card's own price source (TCGplayer or pokemontcg.io) for the picture, so that site sees the request coming from your browser. The address of the page you are on is not sent with it, and neither is your name or email.

2. How we use information

3. Sharing

We share information only with service providers necessary to run the Service: Paddle.com for plan payments and Stripe for shop orders; Groq and Google (Gemini) to read card photos; Resend to send email; Google and Apple when you sign in with them; Hetzner, which hosts our server and holds the encrypted backups; PostHog, for counting visits, sign-ups and orders, and Sentry, for error reports (see "App visits and error reports" above). We do not sell your personal information.

4. Data retention

Your account, collection, binders, kept photos and records stay for as long as your account exists. Scan photos are deleted after the read. Visit counts for shared pages keep a coded form of a network address for about four months. Server backups keep a copy of the databases and kept photos for 7 nightly and 4 weekly cycles, so a deleted account leaves the backups within about five weeks. License and order records stay as long as the law requires for tax and billing (largely held by Paddle and Stripe).

5. Your rights: export and deletion

Export: from the app you can download your collection and each ledger (sales, Piggy Bank, payouts, buys) as a CSV file at any time. Deletion: Account > Delete account removes your account in the app; the account deletion page says what is removed and what is kept and why. You may also ask us by email to export, correct or delete your information. For payment data held by Paddle or Stripe, contact them directly.

6. Contact

Privacy questions or requests: soliskenny2@gmail.com.