The short version
- We log
- IP address and request headers
- Every request, for security and troubleshooting.
- Used for
- Four things
- Security, keeping the site running, replying to you, and turnaround reports.
- Cookies
- None
- No cookies of our own, no trackers, no advertising.
- Shared with
- Two providers
- The company that hosts the site and the one that hosts our email.
Never
- Sold or rented
- Marketing or mailing lists
- Advertising
- Profiling
- Training AI models
01What we collect
The site collects information from five sources. This is everything, grouped by where it comes from.
Server logs
Kept on our own servers
- Your IP address and the approximate location it points to (usually just the country)
- Your browser, device, and operating system, as your browser reports them
- The page you requested and the page that linked you here
- The technical headers your browser sends, such as language and accepted formats
- The date and time, and whether the request succeeded
Visit and performance statistics
Collected by our hosting and security provider
- The page viewed, the page that linked to it, and how it was opened (a link, a reload, or the back and forward buttons)
- Country, device type, browser, and operating system
- How quickly the page loaded and responded, including the standard page-speed measures
- When a page loads slowly or its layout shifts, which part of the page is responsible
No cookies or local storage are used, and the statistics are not designed to identify or follow individual visitors.
Security protection
Collected by our hosting and security provider
- For requests that are blocked or challenged: IP address, country, network provider, browser, the page requested, and the reason
- On the contact form and the turnaround report form, technical signals from your browser and device, read by a bot check to tell people from scripts
The contact form
Only if you write to us
- Your name, email address, the reason you picked, and your message
- The date and time it was sent
Your IP address is used for up to an hour to stop repeat submissions and is not stored with your message. Submissions caught by the spam filter are kept for 30 days with the IP address and browser details, so a real message caught by mistake can be recovered.
Turnaround reports
Only if you send one
- The grader, the service level, and the dates you give: received, shipped back, and optionally mailed and arrived back
- The number of cards, the declared value band, where you shipped from, and how you submitted
- A cert number and a note, if you add them
- The date and time it was sent
No name or email is asked for. Your IP address is used for up to an hour to stop repeat submissions and is not stored with your report. The note and cert number are read by us to check a report and are never published.
Not collected: no accounts, no payment details, no advertising or tracking scripts, and nothing beyond what is listed here.
02How we use it
Everything we collect is used for four purposes, and only these:
- 1Security: Detecting, investigating, and blocking attacks and abuse.
- 2Maintenance: Troubleshooting problems and keeping the site working.
- 3Replies: Answering you, if you wrote to us.
- 4Turnaround reports: Checking a report you sent and, once we accept it, listing its tier, dates, card count and how it was sent on that grader's scorecard. Nothing that identifies you is listed.
Your information is never sold or rented, and never used for marketing, mailing lists, advertising, profiling, or training AI models.
03Sharing and third parties
We do not sell or trade your information. Two providers handle it because the site cannot run without them:
Hosting and network
Cloudflare
Our hosting and security provider. Delivers the pages, protects the site from attacks, provides the visit and performance statistics, runs the contact and turnaround report forms and their bot check, and routes the site's email.
Hosts our email. Messages and turnaround reports sent through our forms are delivered to that inbox.
Each provider keeps its own records under its own privacy policy: Cloudflare and Google.
Beyond that, we share information only when the law requires it, or to report an attack to the network it came from or to law enforcement, and then only the log entries related to the attack. If the site ever changes hands, this policy continues to apply to information collected under it.
04Cookies and tracking signals
This site sets no cookies of its own. Our hosting and security provider may set a strictly necessary security cookie to tell people from automated traffic; it is not used to track you.
Because the site does no tracking, Do Not Track and Global Privacy Control signals have nothing to switch off. You get the same treatment either way.
05How long we keep it
Server logs are kept for 90 days and then deleted. Entries that are part of investigating a specific attack are kept until that investigation is finished. The IP address used to limit repeat contact-form submissions is forgotten within an hour.
A message sent through the contact form is stored for 12 months and then deleted automatically. The copy in our email inbox is kept until it is no longer needed, or until you ask us to delete it. A submission caught by the spam filter is held for 30 days, so a real message caught by mistake can be recovered, and is then deleted.
A turnaround report is held by our hosting and security provider for up to 30 days, until we move it into our own records, and a copy is emailed to us. In our records the report itself is kept, because accepted reports are listed on the grader's scorecard; the note and cert number are deleted after 12 months. The copy in our inbox is kept until it is no longer needed.
The visit statistics and security records described above sit with our hosting and security provider, and are kept under its own retention policy. We see visit statistics as totals only.
06Security
The site is served only over encrypted connections, its servers accept no connections from the public internet, and access to the accounts and servers that hold your information is restricted and protected by strong authentication. No system is perfectly secure, but we take reasonable care.
07Your choices
Through the contact form, you can ask what we hold about you, ask us to correct it, or ask us to delete it, and we will respond within 30 days.
Server logs are recorded by IP address, not by name, so to find entries about you we may need the IP address and the approximate time of your visit. Log entries that are part of an active security investigation may be kept until the investigation is finished.
08Visitors outside the US
The site is run from the United States, and your information is processed there and wherever our providers operate. Where laws such as the GDPR apply, we rely on our legitimate interest in keeping the site secure and working, and on your request when you write to us. You also have the right to complain to your local data protection authority.
09Children
This site is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has contacted us, tell us and we will delete it.
10Changes to this policy
When this policy changes, the date at the top changes, and significant changes are noted on this page before they take effect. A change applies only to information collected after it. No change will ever reverse the commitments above about selling, marketing, advertising, profiling, or AI training.
11Contact
Questions about this policy, or a request to see, correct, or delete what we hold, go through the contact form.