Privacy Policy
Unvayl is made by BAK Holdings LLC, a Connecticut company doing business as Unvayl ("Unvayl", "we", "us"). This policy explains what the Unvayl app and the Unvayl service collect, why, and what you can do about it.
The short version: we keep what is needed to run your account and your inventory, nothing more. We don't sell your information, we don't show ads, and we don't track you across other apps or websites.
What we collect
Your account
- Your email address, and a display name if you give one.
- Your password, stored only in a one-way scrambled form (a "hash"). We can't see or recover it.
- If you turn on two-factor sign-in: the secret for your authenticator app (stored encrypted) and your recovery codes (stored as one-way hashes).
- Your signed-in sessions: a name for the device or browser, when the session started and when it was last used. Sessions end after 90 days without use, or when you sign out.
Your inventory and sales
- The cards you add: card details (name, set, number, grade, certificate number, picture link), your prices and costs, and which table and slot they sit in.
- Your tables and their names.
- Sales you record: the card, sale price, cost, tax, and the payment method and reference you enter.
- Devices you pair with your account (trays, scanners, CardDisplays): their name, type and when they were last used.
- Card pictures you take and add to a card (see below).
This is your business data. We keep it so it is backed up and shows up on all your devices.
Card pictures you add
If you take your own picture of a card and add it to that card, the app sends it to our server, which stores it so it shows on all your devices. Each picture gets its own web address made of random characters that can't be guessed or listed. Anyone who has that exact address can view the picture without signing in, which is how your table screens can show it. Only you can add or delete your pictures.
Photos used to identify a card
When you use the camera to identify a card, the app sends a cropped photo of the card to our server, which compares it with our card library and sends back the match. That photo is not saved. It is used for that one lookup and discarded.
Security information
If someone enters a wrong password or wrong two-factor code for your account, we record how many times it happened, when, and the internet (IP) address of the last attempt, so the app can warn you. This is deleted when you dismiss the warning. Our server also briefly uses IP addresses to slow down repeated sign-in attempts.
Service usage
Our server logs which features are used (for example, "card search", with the time and whether it worked) and which account used them, so we can measure costs and keep the service running. It doesn't record what is on your screen.
Server logs
Our hosting providers keep standard server logs, such as IP addresses and the pages or addresses requested, for a limited time, to operate and protect the service.
What stays on your device
- Face ID, if you turn it on, is handled entirely by your device. We never receive your face data.
- The app keeps a copy of your inventory and sales on your device so it works without internet, and stores your sign-in in the device's secure keychain.
- Try Demo uses made-up sample data built into the app. It doesn't contact our server and saves nothing.
What we don't do
- We don't sell or rent your information.
- We don't use your information for advertising, and there are no ads in the app.
- We don't track you across other companies' apps or websites.
- The app contains no third-party analytics or advertising tools, and this website uses no cookies or analytics.
Who else is involved
- Render (render.com) hosts our server and database in the United States.
- Cloudflare (cloudflare.com) hosts this website and handles our domain and incoming email.
- Email you send us passes through Cloudflare and is stored in our Google email account.
- Card pictures are loaded by the app directly from the card publishers' and card-data providers' image servers. Like any website, those servers receive your device's IP address when a picture loads. They don't receive your account information.
- Card details and prices are looked up by our server from card-data providers (such as Scrydex). We send the details of the card being looked up, not your account information.
- Certificate checks open the grading company's own website (for example PSA, BGS or CGC) on your device. That website receives what any website receives when you visit it, under its own privacy policy.
- We may disclose information if the law requires it, or to protect the safety and security of our users and service. If Unvayl is ever sold or merged, your information would move to the new owner under this policy.
How long we keep it
We keep your account and business data for as long as your account exists. When you delete your account (in the app: Account → Delete account), we delete your account, sessions, paired devices, cards, card pictures, tables, sales and security records from our live database right away, and remove your account from our usage records. Copies in our nightly backups are deleted automatically within 30 days.
A card picture you replace, or one of a card you've sold, stays stored until you delete your account. To have it removed sooner, email us.
Your choices and rights
- See and take your data: in the app, Account → Delete account → Export my data first saves a file with all your data. You can stop there without deleting anything. Sales & Ledger → Export All gives a spreadsheet (CSV) of your sales.
- Correct it: edit your cards, tables and sales in the app, or contact us.
- Delete it: Account → Delete account, or email us and we'll do it.
- Security: you can turn two-factor sign-in and Face ID on or off at any time.
Depending on where you live (for example Connecticut, California or the EU), you may have additional rights to access, correct, delete or move your data, or to object to how it's used. Email us to use any of them; we'll answer within 30 days.
Security
Passwords are hashed, two-factor secrets are encrypted, all traffic to our server is encrypted (HTTPS), and backups are kept on private storage we control. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.
Children
Unvayl is a business tool for card dealers and collectors. It isn't directed to children under 13, and we don't knowingly collect information from them. If you think a child has given us information, contact us and we'll delete it.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know in the app or by email before it takes effect.
Contact
BAK Holdings LLC, doing business as Unvayl
Connecticut, USA
Email: support@unvayl.io