Card Tally Privacy
Last updated: October 15, 2026
The Short Version
- Card Tally stores your business records so you can use them: your cards, costs, sales, deals, shows and photos.
- It has no ads and no trackers. It does not sell your data.
- It shares your information only with the services that run it, listed below.
- To delete your account, email hello@cardtallyapp.com. It is done by hand.
- This website, cardtallyapp.com, sets no cookies and has no analytics or tracking. Its only script sends the waitlist form.
- If you join the waitlist, Card Tally keeps your email address, your choice about news, and the date, to write to you when Card Tally opens. It is never sold or shared. To be removed, email hello@cardtallyapp.com.
Who Runs Card Tally
Card Tally is run by Tucker Mullen, an individual, who also sells cards at shows as Mullen Card Co. Contact: hello@cardtallyapp.com.
What Card Tally Stores, and Why
Your account. Your email address, your display name, and the passkey you sign in with (Card Tally stores the passkey's public part, never a password). We store this to know who you are and to keep your records yours.
Your business. A name, a plan, a time zone, and the people who belong to it with what each may see. A business owns its records, and every record is kept under the business it belongs to.
Your cards. Category, player or character, year, set, card number, variation, serial, grader and grade, certification number, selling lane, status, your own sticker number, notes, and the values you enter, each marked with its source and date.
What you paid and what you sold for. Purchase date, source, price, shipping, tax, fees, payment method, and the same for each sale, plus show names and dates, deals, and the notes you type. This is the point of the app: working out your cost and profit.
Photos. Photos you take or choose are kept in private storage under your business, and only members of your business can see them. When you pick a reference picture of a card (Pokémon, Lorcana or One Piece), Card Tally copies that picture into your storage.
Your To Do list. Items waiting for your decision.
Settings and sign-in. Your preferences and the devices you have signed in on. The Card Tally app sets one cookie, named __Host-card-tally-session, to keep you signed in. It is marked secure, HttpOnly and SameSite=Lax, it holds a random code (the server keeps only a scrambled copy of that code), and it lasts up to 400 days, starting over each time you open the app. Signing out clears it.
A copy on your device. So the app works with no signal, your phone or computer keeps a copy of your records and photos in the browser's own storage. Signing out removes it.
A count of label readings. For each label reading Card Tally keeps the business, the person, the card, the day, how many model calls it took, its cost and whether it worked. It keeps the text that was read, for three days. It does not keep the picture.
Server logs. Card Tally runs on Cloudflare Workers with Workers Logs turned on. Cloudflare records requests to the site and any error messages the app writes, and keeps them for at most 7 days (3 days on Cloudflare's free plan), per Cloudflare's documentation.
Card Tally does not store the names of other eBay users. Card Tally never fetches prices or market values. Values come from you.
The Waitlist
The home page has a form to join the waitlist. When you send it, Card Tally stores your email address, whether you ticked "Email me Card Tally news", and the date and time. It also notes which form you used (the top or the bottom of the page).
Why: to write to you once, when Card Tally opens. If you ticked the news box, Card Tally may also email you news about Card Tally. If you did not, you get that one email and no more. Joining twice with the same address stores nothing more.
To limit abuse, Card Tally keeps a scrambled copy of the network address of each sign-up attempt for ten minutes, only to count how many one address sends in a minute. It is not linked to your email address.
Your email address is never sold and never shared with anyone. It is stored in Card Tally's database, which runs on Cloudflare (listed below).
To be removed, email hello@cardtallyapp.com from the address you joined with and say "remove me from the waitlist". Tucker does it by hand.
Reading Labels
When "Read Labels When Scanning" is on (it is on by default; Settings turns it off), scanning a graded slab sends a cropped picture of the slab's label to Anthropic, which runs the AI model that reads it. Card Tally sends the picture and a fixed set of instructions telling the model what to read. Nothing else goes with it: not your name, email, account or other cards. The Card Tally server does not store the picture it sends. It keeps the text that came back, and the card's photo is whatever photo you chose to keep for the card. With the setting off, no label picture is sent anywhere.
Anthropic's own pages say it deletes inputs and outputs from its API within 30 days (with exceptions, for example when it finds misuse) and does not use API data to train its models by default. Read them here: how long Anthropic stores data, whether it is used for training, and Anthropic's privacy policy.
Reference Pictures
When you ask for a reference picture of a Pokémon, Lorcana or One Piece card, Card Tally's server asks TCGdex, Lorcast or optcgapi.com for the card by its set and card number, then copies the picture it finds into your storage. The request is made by the server, carries no account, name, email or cookie from you, and the three services do not learn who asked.
Who Gets Your Information
Only the services that run Card Tally, and only for that:
- Cloudflare hosts this website, the app, the database and the photo storage.
- Anthropic reads label pictures, as above.
- TCGdex, Lorcast and optcgapi.com are asked for reference pictures, as above, with no information about you.
- eBay, when you press Recent Sales: your browser goes to eBay's website or app. The link contains search words built from the card: year, set, player or character, card number, variation, and the grader and grade (or, for a raw card, words that leave graded cards out). It contains nothing else about you or your account. Your browser is sent with no referrer.
Card Tally does not sell your data and does not share it for advertising.
No Ads, No Tracking
Card Tally shows no ads and has no analytics, advertising or tracking scripts. This website and the app load every script, style and font from their own site; their security policies allow nothing else. The one other place this website talks to is the Card Tally app, to send the waitlist form.
eBay Links and Cookies
The Recent Sales button opens eBay. eBay may set cookies and collect information on its own site and app, under its own privacy notice. Card Tally does not control that.
Keeping and Deleting Your Records
Your records stay while your account is open. To delete your account, email hello@cardtallyapp.com from the address on your account and say "delete my account". Tucker does it by hand: your records, photos and sign-ins are removed from Card Tally's database and photo storage. You can use the same address to ask what Card Tally holds about you.
Children
Card Tally is for adults who run a card business. It is not for anyone under 18.
Changes
When this page changes, the date at the top changes.