Privacy policy

Draft for counsel review — September 25, 2026. This version covers the whole of grai.ls: the information pages and the app.

grai.ls shows cards by name, number and set, with what is listed for each on the marketplaces it is connected to; where the app offers an account, it holds the cards you name and the limits you set on them. This site is both the information pages and the app itself: you can create an account and sign in. This policy describes what that means for your data: everything we collect, and what each piece of it is for.

What we collect

If you create an account: your email address and a password, and nothing else. No name, no birth date, no phone number. The password is handled by our authentication provider and never stored by us in any form we can read. If you name a card you want, we store that card and the limits you set on it.

When grai.ls builds a link out to a marketplace, we record that link: an identifier for it, the marketplace and the listing it points to, which page it was offered on, the full destination address, and the time. Where a link goes to a marketplace's search results rather than to a single listing, that address contains the card's name. If you are signed in, the record carries your account identifier; if you are not signed in, it carries no account. On a match page the link is built when the page loads, so the record covers links we put in front of you as well as links you followed; elsewhere it is written at the moment you follow the link.

When you open the front page or a card page, we give your browser an identifier: a random value we mint, carried in a cookie, with nothing about you in it. Against that identifier we keep one record — the cards whose pages you open and the listings you follow from here, each with how many times and when. What you type into search is not kept; a card you open from the results is recorded as a card page opened, like any other. No email address, account or name is attached to the identifier, and nothing joins it to an account.

If you email us instead, what we receive is what you send — your email address and anything you write in the message. There are no other forms on this site and no other collection of personal information.

How we use it

Your email address signs you in, carries the code that confirms the address is yours, and is how we reach you about grai.ls. Your password authenticates you and does nothing else — our authentication provider handles it, and we never hold it in a form we can read. The cards you name are what we match listings against: they tell us what to look for, and that is the use we put them to. If you email us, we use your address to answer you. The record of an outbound link is what lets that link resolve — the destination is looked up on our side rather than carried in the address you clicked — and it is how we can tell that a link grai.ls showed you was used, which is what lets a marketplace credit us a commission on a purchase made through it. We keep those records for as long as the marketplace's affiliate programme needs them to audit that credit.

That is the entire purpose of each of them. The browser identifier and its record have one purpose of their own: in each row of listings the front page shows, the cards this browser has opened and followed come first, then cards from the same sets, and — if you are signed in — the cards saved to your account are read at that moment alongside them, never copied into the record. Beyond that record we build no profile, we do not enrich your address with data from anywhere else, and we do not use any of it for anything unrelated to running grai.ls.

What we never do

We do not sell your personal data, and we do not share it with marketplaces, sellers, brokers, advertisers, or anyone else. That is the standing commitment grai.ls is built on. A collector's want list is competitively sensitive information in this hobby, and treating it as private by default is a product principle before it is a legal obligation. Our intent is to apply one privacy standard — set at the strictest applicable US state level — to every user, everywhere, rather than varying our practices by state.

Nor do we record a marketplace seller's name or account. Where a listing names its seller, the name goes no further than the moment we read the listing. Where we keep anything in its place, it is a one-way value of our own, and it names nobody.

Cookies

This site sets two cookies. One is an identifier we assign to your browser; the other appears only once you sign in.

The identifier is set the first time you open the front page or a card page. It holds a random value we minted for this browser and the time it was last signed, signed so it cannot be altered, and nothing else — no name, no email address, nothing about your device. It is what recognises this browser across visits when you are not signed in, and what it recognises is a browser, not a person. The record kept against it is described above: the cards you opened and the listings you followed, with counts and times. It lasts up to 400 days from the last time it was signed — we sign it again when you open the front page or a card page more than a day after the last signing, so it lasts as long as you keep coming back — and the record stays until you delete it: one button, under Deletion below, removes the identifier from this browser and the record from our side at once. A record whose identifier your browser has dropped or let lapse is out of that button's reach, and out of ours: nothing we hold connects it to you or to any browser, and it stays as it is. It is used on this site and nowhere else: never sold, never shared, never sent to anyone.

The second appears only once you sign in: a session cookie telling us which account is making a request. It holds an opaque account identifier and an expiry, signed so it cannot be altered, and nothing else — no name, no email address. The cards you open are recorded against the browser identifier above, not against your account; a link you follow while signed in is recorded as the links paragraph above says, with your account identifier. It is removed when you sign out.

A Global Privacy Control signal does not change which of these cookies we set. GPC tells us not to sell or share your personal information, and we do not: the session cookie does only the thing you asked for, and the browser identifier is used by this site, on this site, and nowhere else. If you would rather we held no identifier for this browser at all, the button under Deletion removes it.

Beyond those: no analytics scripts, no third-party advertising, and no third-party cookies of any kind. What we keep of your visits is what this page describes — the browser record, the record of links you follow, and the technical logs below — and all of it is ours alone; nothing on these pages reports you to anyone else. Card images on match pages are loaded directly from the marketplace that hosts the listing, which means that marketplace can see that some visitor requested the image; we send no information identifying you along with it. Like any website, the server keeps routine technical logs (such as IP addresses) in order to serve pages and maintain security; we do not use such logs to identify or track visitors.

Deletion and your choices

To delete the browser identifier and the record kept against it:

That removes the identifier from this browser and its record from our side at that moment; nothing is kept, and no reason is asked. Open the front page again and a new identifier is minted, with nothing behind it. The identifier is not linked to an account, so it is not something we can find from your email address — the button is how it is deleted.

If you want your account deleted, or want us to delete your email address and any messages you sent us, email hello@grai.ls and ask. We will delete it, including the cards you had saved. You do not need to give a reason, and there is no process beyond asking — we will not make it harder than that.

Children

This site and the grai.ls app are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or emailed us, contact us at hello@grai.ls and we will delete the information.

Changes and contact

If this policy changes, we will update this page and revise the date at the top. Questions about privacy at grai.ls go to hello@grai.ls.