This notice describes Card Horse at https://card.horse, including Google sign-in, private collections, card-photo processing, AI identification, and public-web market research.
Information Card Horse stores
- Google identity data needed for sign-in: issuer, immutable account subject, verified email, display name, and an optional profile-image URL.
- Revocable session records, including issuance, expiry, last-seen, revocation, and a one-way digest of the random session token. The raw token remains in an HttpOnly cookie.
- Identified card details, value ranges, confidence, research dates, source links, limitations, folders, tags, saved views, organization choices, activity history, and daily quota ledger entries.
- For each accepted upload, a normalized JPEG front image and optional back image retained with a private, tenant-scoped card until the member deletes that card or account.
- Narrow security audit records needed to protect accounts and operate the service.
Card photos
Front and optional back photos are uploaded over HTTPS for one request. Card Horse checks the file, removes metadata, resizes and re-encodes it. After Card Horse accepts an upload, it stores the normalized JPEG front and optional back in private, tenant-scoped Google Cloud Storage with the card until the member explicitly deletes that card or the account, including when research is unsuccessful or inconclusive. When automatic research runs, Card Horse sends the normalized pixels to Google Vertex AI for identification. Original upload bytes are released after normalization and acceptance.
Do not upload secrets, payment information, illegal material, or images you do not have permission to process. A photo can still reveal information visible in the frame, so crop unrelated people, addresses, labels, or surroundings.
AI and market research
Google Vertex AI provides image understanding and structured analysis. Tavily processes a bounded text-only market query derived from the identified card and returns public-web result snippets and links; Tavily does not receive card photos. Google and Tavily process submitted data under their own terms. Card Horse stores the resulting card facts, estimate, confidence, evidence summary, research date, validated source titles and links, and normalized private collection photos. Raw Tavily result content is discarded after validation.
Results can be incomplete or wrong. Card Horse does not authenticate a card, assign a professional grade, or provide a formal appraisal.
Why data is used
Data is used to authenticate members, isolate private collections, identify and research cards, save results and organization choices, enforce five successful estimates per UTC day, prevent replay, and operate the service securely. Card Horse does not sell personal information and does not use card photos for advertising.
Service providers and access
Google provides OpenID Connect sign-in, Cloud Run hosting, Firestore and Cloud Storage, and Vertex AI image processing. Tavily processes text-only public-web market queries. Vertex AI receives normalized card pixels. Tavily receives no card photos, nor does any marketplace, grader, payment, analytics, or advertising service. Google and Tavily handle submitted data under their respective terms and privacy practices.
The owner console exposes masked account identity and aggregate counts only. Impersonation and full-account inspection remain disabled.
Retention and choices
Sessions expire after seven days unless revoked sooner. Account and collection records remain while the account is active so Card Horse can preserve the collection, research, organization, and quota history. Accepted normalized card photos remain private with their tenant-scoped cards until the member explicitly deletes the card or account, including after unsuccessful or inconclusive research.
Members can delete a card and its photos or delete a non-owner account from the private collection screen. Account deletion removes collection and quota data, deletes every object under the account's private photo prefix, revokes active sessions, and de-identifies the account record. The sole OWNER account is blocked until a verified ownership-transfer flow exists. Narrow security records may be retained to prevent abuse and document account actions.
The photo bucket enforces public access prevention and uniform bucket-level access, with versioning disabled and a zero-second soft-delete policy so an application deletion does not leave a recoverable object version in the bucket. For access, correction, or export requests, use the invitation or support channel through which access was granted. Do not send authentication secrets or card images in that request.
Security and changes
Card Horse uses secure host-only cookies, same-origin mutation checks, tenant-scoped records, strict upload limits and image decoding, no-store responses, and noindex headers. No system can guarantee absolute security. Material changes will be reflected on this page.