Privacy Policy

1. Who we are

Chaseboard is operated by Lee Sharon, an individual based in Israel ("we", "us"). We are responsible for the personal information described in this policy. Contact: contact@getchaseboard.com.

Chaseboard is a watchlist and alert service for Pokemon card collectors. This policy explains what information we collect when you use Chaseboard, how we use it, and the choices you have.

2. Information we collect

You do not need an account to browse Chaseboard. Even so, we collect:

• Server logs. Like most websites, our servers automatically record basic technical information about every visit - IP address, browser type, pages requested, and timestamps - whether or not you have an account, and what you search for in our card catalog. We use this to operate and secure the service and to see where people get stuck adding a card.
• Usage data. Where you have not opted out - and, if you are in the EU, EEA, UK, or Switzerland, only if you opt in - we use Google Analytics and PostHog to collect usage information: the pages you view, the buttons you tap, what you search for in the card catalog, sign-up events, and your approximate region. PostHog can also record a replay of how you moved around the site. A replay shows what was on your screen, which can include your board and your alerts. Anything you type into a form is hidden from it, except the card search box, and so is the email address Settings shows. Admin pages are never recorded. We use this to understand how Chaseboard is used and to improve it. See section 3 for the choices you have.
• Advertising measurement. With advertising measurement on, our ad partner receives page details from eligible pages, such as titles and information about the cards you view, and a scrambled (SHA-256 hashed) version of your email when you sign up. We use this to measure our ads and help show them to people who will like Chaseboard. A hash is a matching identifier, not anonymous data. The browser tag runs only on the home page, board, add a card page, sign up, log in and pricing. Password-reset, verification, unsubscribe, settings, admin and token-bearing URLs are excluded. We also report eBay purchases attributed to Chaseboard from our server, with the purchase time, currency, commission or sale value and your hashed email. We never send passwords or payment details. Browser requests also carry your IP address and browser information to the partner; our server purchase reports do not include your IP address or browser details. Section 4 names the partner; section 3 explains your choices.
• Email you send us. If you use our contact form, we store your email address, your message, and the IP address it was sent from. We use the message to respond to you and the IP address to prevent abuse of the form.
• Newsletter. If you sign up for Chaseboard updates, we store your email address, the page you signed up from, and the IP address it came from (to stop abuse). We use it only to send you Chaseboard updates, and you can ask us to remove it at any time.

If you create an account, we additionally collect:

• Account details. Your email address, and a one-way hash of your password - we never store the password itself. If you sign in with Google instead, we store your email address, the account identifier Google gives us, and, if your Google account shares them, your name and profile photo link; we never receive your Google password. We also record whether your email address has been verified. We use what Google shares only to sign you in and to run your account, including contacting you about it. We do not share it with anyone except the providers in section 4 that run the service for us, and never for advertising. You can disconnect Chaseboard from your Google account at myaccount.google.com/permissions; your Chaseboard account stays until you ask us to delete it.
• Billing details. If you buy a paid plan, Paddle, our merchant of record, collects your payment details, billing address and country. We never see or store your card number. Paddle sends us your customer and subscription identifiers, which plan you are on, its status, price and billing dates, and any refunds, which we keep so we can give you the right plan and answer billing questions.
• Alert delivery details. Alerts go to the channels you enable in Settings. Email alerts use your account email address. If you turn on push notifications, we store the push subscription your browser creates - its endpoint and encryption keys - plus a random install identifier and the browser's name, so we can reach that device and show it to you in Settings. If your account has Telegram linked, we store the Telegram chat ID our bot messages. Every channel is optional - turn one off in Settings and we stop sending to it.
• Watchlist data. The cards you track and your alert preferences, so we can build your board and send the alerts you asked for. We also keep a record of the alerts we have already sent you, so we do not send the same one twice, and the date your account saved its first card.
• Feedback. If you send feedback from inside the app, we store it with your account so we can reply and follow up.
• Affiliate reference codes, and the reports they produce. Every eBay link we build for you carries a reference code for your account (section 3), unless your browser sends Global Privacy Control, in which case the links we serve you carry none. We create it when we build the link, not when you click, and the alert history we keep stores the tagged link either way. If you do follow one, the eBay Partner Network reports that code back to us with each click - its time, the eBay page it opened, and the device type, operating system and browser it came from - and, when a purchase follows, details of the purchase and what we earned on it. We copy those reports into our own database and link them back to your account and to the card or alert the link came from, so we can see which parts of Chaseboard lead to purchases. EPN's click reports also include an IP address and a rough location; we do not store either. Those reports do not tell us your eBay account, your name, or your payment details.
• Alert delivery and opens. For each alert, which channel delivered it (Telegram, push or email), and whether you opened it in Chaseboard from that email or push notification. We learn the second from the link in the message itself, not from a tracking pixel, and use both to see which channels are useful.
• Activity days. The days you open Chaseboard while signed in, and the time of your latest visit on each of those days. We use this to understand whether people keep using Chaseboard and whether our emails are useful. We do not record your IP address or the pages you view for this.

3. Cookies and affiliate tracking

Strictly-necessary cookies. When you sign in, Chaseboard sets three cookies that are essential to keep you logged in and to protect your account: cb_access and cb_refresh hold your signed-in session (sent only to Chaseboard), and cb_csrf is a security token that blocks cross-site request forgery. These are required for the app to work, are never used for advertising, and are not subject to consent.

Affiliate cookies. Chaseboard participates in the eBay Partner Network (EPN), eBay's affiliate program. Links from Chaseboard to eBay listings are affiliate links. When you click one:

• eBay and the eBay Partner Network set tracking cookies on your device. These cookies attribute any resulting purchase to Chaseboard so that we can earn a commission. They are set and controlled by eBay, not by us.
• We may earn a commission on qualifying purchases you make on eBay after clicking, at no extra cost to you.
• The link already carries a reference code, put there when we built the link, that lets us tell which of our own links a click came from: which account, which watch or alert, and which part of the app. eBay reports that code back to us alongside click and purchase totals, so we can tell which parts of Chaseboard are actually worth running. The code is a one-way cryptographic hash, not your account id and not anything readable: it carries no name, email address or payment detail, only we can match it back to an account, and eBay cannot work out your Chaseboard account from it. It has a stable part, though. The piece of it that stands for your account never changes, so eBay can tell that separate clicks came from the same person, and if you buy something eBay knows who you are anyway. If your browser sends Global Privacy Control, the links we serve you carry no reference code at all - sections 8 and 9 set out exactly what that does and does not cover.

For details on how eBay uses these cookies, see the eBay User Privacy Notice. You can block or delete eBay's cookies in your browser settings without affecting Chaseboard. Blocking our own sign-in cookies will stop you staying signed in.

Analytics cookies. When analytics is active we use Google Analytics to measure how Chaseboard is used. It sets first-party cookies (_ga and _ga_*) to count visits and measure basic usage, and we store your analytics choice in your browser's local storage (cb.consent.analytics). PostHog, when active, keeps an anonymous visitor id in a first-party cookie and in local storage (both named ph_*), and links it to your account while you are signed in. If you are in the EU, EEA, UK, or Switzerland, analytics stays off until you opt in. Everywhere else it is on by default, but we show you a notice and you can turn it off any time from Your privacy choices or the Usage analytics toggle in Settings. We also honor your browser's Global Privacy Control signal: while it is on, analytics stays off.

While analytics is running, Google Analytics also records the web address of outbound links you click, which includes our eBay links and the reference code inside them. Turning analytics off stops that.

Under the same consent, we also note the site that referred you, the campaign tags of the link you used and the first page you opened, and keep them with your account if you sign up. We use this only to know which channels bring members. It is never sold or given to advertisers or analytics providers; a short summary of it is included in the private notice our team receives when someone signs up. Until you sign up, this note is kept in your browser and used for up to 30 days. Signing up or turning analytics off deletes it.

Advertising measurement cookies. Advertising measurement follows the same rule as analytics, as its own switch. If you are in the EU, EEA, UK, or Switzerland it stays off until you opt in. Everywhere else it is on by default, we show you a notice, and you can turn it off any time. A yes you gave to analytics before we added it does not count as a yes to this, and if you had already turned analytics off, it stays off too. While it is on, the measurement tag sets two first-party cookies: _rdt_uuid, a random id for this browser, and, if you came from one of our ads, _rdt_cid, the id of that ad click. Both last up to 90 days. We keep your answer in your browser's local storage (cb.consent.ads). While your browser sends Global Privacy Control it stays off. Change your mind any time with Your privacy choices, or with the Advertising measurement switch in Settings. Turning it off stops the events and deletes those two cookies.

Other storage. Paddle's checkout and Google's sign-in button can set their own cookies when you use them. Chaseboard also keeps a few things in your browser's storage so the app works: a board you build before signing up (cb.guest.board), an id for this device's push notifications (cb.push.device), which tips and prompts you have dismissed, and where you were in the card catalog. Only Chaseboard reads them: the push id is sent with your push subscription (section 2), and a guest board is copied to your account when you sign up. None of it is used for tracking.

Other than the cookies described above, Chaseboard does not use advertising or cross-site tracking cookies. Our analytics is first-party only: we do not share it with ad networks or use it to build advertising profiles. The measurement tag and server-side purchase reporting run only while advertising measurement is on. They measure visits, sign-ups, first cards, eBay opens and attributed eBay purchases, and help our advertising partner match and improve our ads.

4. Third-party services

We rely on a small number of third parties to run the service:

• eBay APIs - the listing data shown on the board comes from eBay's APIs.
• eBay Partner Network - affiliate link tracking, as described in section 3. Affiliate links carry a pseudonymous reference code for your account, so clicks and purchases can be attributed back to it.
• Paddle (Paddle.com Market Ltd, UK) - runs our checkout and takes payments as the merchant of record, under its own privacy policy. We pass Paddle your email address and an account id so the purchase reaches your account.
• Railway (Railway Corp., US) - hosts our servers and database.
• Cloudflare (Cloudflare, Inc.) - delivers the site and protects it from attacks, so it handles every request, including your IP address. It also stores our nightly database backups.
• Resend (Resend, Inc., US) - sends our emails on our behalf: account emails (address verification, password resets), the alert emails you turn on, the account and setup emails described in section 5, and copies of contact messages and feedback to our team.
• Zoho (Zoho Corporation, US) - sends our emails on our behalf through its ZeptoMail service: account emails (address verification, password resets), the alert emails you turn on, the account and setup emails described in section 5, and copies of contact messages and feedback to our team.
• Browser push services - if you enable push notifications, they are delivered through the push service built into your browser, which is run by its vendor (for example Apple, Google, or Mozilla) under that vendor's own privacy policy.
• Telegram - if your account has a chat ID linked, those alerts are delivered as Telegram messages and are handled under Telegram's own privacy policy. We also use a private Telegram chat to tell our team about new contact messages, feedback, newsletter sign-ups, new accounts and billing problems. A contact or feedback notice includes your email address and the message text; a newsletter notice, the email address; a new-account notice, your email address, your name if Google shared it, how you signed up and where you came from (section 3). Billing notices name the account by its id.
• Google - if you choose "Continue with Google", Google confirms your identity to us under Google's privacy policy.
• Error monitoring (Sentry) - to keep the service reliable we send diagnostics about application errors and performance to Sentry, a third-party monitoring service. We strip passwords, session cookies and sign-in tokens before anything is sent. An error report can include your account id and details of the request that failed, which occasionally includes an email address or what you searched for. This data is processed and stored in the United States.
• Google Analytics (Google LLC) - where analytics is enabled, we use Google Analytics for first-party usage measurement only. IP addresses are masked by Google, we do not enable ad personalization or Google Signals, and this data is processed and stored in the United States.
• PostHog (PostHog Inc.) - where analytics is enabled, we use PostHog for first-party product analytics and session replays. Form fields are masked before anything is sent, except the card search box, the addresses of our own pages keep nothing but campaign tags, links to other sites (eBay included) are sent without their reference codes, and this data is processed and stored in the United States.
• Reddit (Reddit, Inc., US) - our advertising partner. While advertising measurement is on (section 3), the Reddit Pixel shares eligible page details and a SHA-256 hash of your email at signup. Reddit can collect enhanced page metadata and run automatic advanced matching in an isolated measurement document; we do not expose the app's form fields to it. Our server also sends attributed eBay purchase reports with your hashed email, purchase time, currency and our commission (or sale value), matched using your consented Reddit click or browser identifier. Reddit uses these signals to measure and improve our ads and show them to people likely to be interested. It handles them under its own privacy policy and is not a service provider working only for us. Processing takes place in the United States. We normalize your email by trimming spaces and using lowercase, then hash it before it is sent. We never send your raw email in these matching fields. We keep click or browser identifiers with your account for up to 30 days. Turning advertising measurement off clears them and stops queued purchase reports. Use Your privacy choices or the Advertising measurement switch in Settings; Global Privacy Control turns measurement off and withdraws account permission when we receive it on an authenticated request. A choice made while offline reaches our server when the browser can connect again.

5. How we use information

• To provide, maintain, and improve the service.
• To send you the alerts you asked for.
• To send you a small number of emails about your account and your alerts: for example a reminder to confirm your email address, to add your first card or to check a watch that has not found anything yet, or a note of what your board found while you were away. Every one has a one-click unsubscribe link, and you can turn them all off in Settings, under Notifications, with the Account and setup emails switch.
• To respond to your messages.
• To protect the service against abuse.
• To measure which parts of Chaseboard lead people to eBay and earn affiliate commission, which is part of how the service is funded.

We may access your account data, including your watchlist, to operate, support and improve the service.

We do not run a data business. Nobody buys your watchlist, your email address or your activity from us, we do not supply data brokers, and we do not build advertising profiles of anyone. The providers listed in section 4 get only what they need in order to do their job for us, except where section 4 says otherwise.

Three things do not fit that description, so we would rather name them than bury them under a blanket denial. The first is the eBay Partner Network. It is not a "service provider" in the sense California law uses that phrase, because it does not work for us: it is an affiliate network that pays us a commission, and our links carry a reference code for your account when you follow them there (section 3). We do not claim this falls outside California's definition of a "sale" of personal information, because that definition is broad and we think it may cover it. The second is Google Analytics: while analytics is running it records the address of the outbound link, and that address contains the same code. The third is our advertising partner, while advertising measurement is on: it is an ad platform, it gets the events in section 2, and it can use them in its own ads business. Section 9 sets out what all three mean for you.

6. Data retention

• Alerts, including the tagged eBay links in them, are deleted automatically after 90 days, so the reference codes in your alert history are deleted whenever those alerts are.
• Your account, watchlist, settings and activity days are kept while your account exists, and deleted when you ask us to delete the account. Feedback you sent from inside the app is deleted with it.
• Contact messages are kept until you ask us to delete them.
• Newsletter sign-ups are kept until you ask us to remove them.
• Google Analytics keeps usage data for 2 months.
• Your advertising measurement answer stays in your browser until you change it or clear your browser's storage. We also save that permission with your account for purchase reporting. Click and browser identifiers are erased after 30 days or when you turn advertising measurement off. What our advertising partners received stays with them under their own retention rules, and deleting your Chaseboard account does not reach into their systems.
• Deleted data can stay in our nightly backups, and in our hosting provider's server logs, for a limited time until they are replaced.
• Billing records are kept with no set end date, as our record of payments, refunds and disputes. After an account is deleted they are no longer linked to it.

The click and purchase reports also stay in the eBay Partner Network's own reporting system, so eBay's retention applies there, and deleting your account here does not reach back into reports eBay has already produced. Our own copies of those reports, and the alert delivery and open records, are kept as our record of what the service earned and how alerts reach people; when you delete your account, they are no longer linked to it.

7. Where your data is stored

Chaseboard is run from Israel, and our servers and database are in the United States. Some of the providers in section 4 also process data in the United States or the United Kingdom. When we move personal data out of the EU, the UK or Israel, we rely on adequacy decisions where they exist (Israel and the UK have one from the EU) and otherwise on the providers' Standard Contractual Clauses or EU-US Data Privacy Framework certification. Write to us for a copy of the safeguards that apply.

8. Your rights (GDPR and Israeli law)

If you are in the EU, EEA, UK or Switzerland, you can ask to access, correct, delete or get a copy of your personal data, object to or restrict how we use it, and complain to your local data protection authority. Where we rely on your consent, you can withdraw it at any time. We use your data on these bases: to perform our contract with you (your account, your alerts, your paid plan); to meet legal obligations (tax and billing records); our legitimate interests (keeping the service secure, answering your messages, account and setup emails, measuring which parts of Chaseboard earn affiliate commission); and your consent (usage analytics, advertising measurement and the newsletter). We answer requests within one month.

The affiliate reference code described in section 3 rests on that legitimate-interest basis. It is pseudonymous rather than anonymous: it still relates to you, and this policy does not pretend otherwise. Because it travels inside the link's web address it goes to the eBay Partner Network, and, while usage analytics is running, Google Analytics records the address of the outbound link as well.

Turning on Global Privacy Control in your browser stops the code travelling: while it is on, the eBay links this site serves you carry none, so following one tells the eBay Partner Network nothing about your account. Two honest limits. We still create the code when we build the link and store it in your alert history, because it is also the record of what we sent. And links we already sent you by email, push or Telegram still carry one, because those are written by background jobs with no browser signal to read. There is no separate per-account switch, and we are not going to imply one exists. You can object by writing to contact@getchaseboard.com; we answer every message, and we will tell you plainly what we can and cannot switch off for you rather than let the request sit.

Our usage analytics runs on the basis of your consent: for visitors in the EU, EEA, UK, and Switzerland it stays off until you opt in, and you can withdraw that consent at any time in Settings. The same goes for advertising measurement: in the EU, EEA, UK, and Switzerland it runs only on your consent, and you can withdraw it at any time from Your privacy choices or Settings. To exercise any of these rights, email contact@getchaseboard.com.

If you are in Israel, you have the right under the Privacy Protection Law to see the information we hold about you and to ask us to correct or delete it. Giving us your information is voluntary, but without an email address we cannot run an account or send alerts.

9. Your rights (California / CCPA-CPRA)

If you are a California resident, you have the right to know what personal information we collect (sections 2 and 3), to request its deletion, and to non-discrimination for exercising those rights. While advertising measurement is on, the events in section 2 go to our advertising partners, and that may count as sharing personal information for cross-context behavioral advertising as the CCPA/CPRA defines it. In California it is on by default. You can opt out of it any time with Your privacy choices (here, and in the footer of our home page) or the Advertising measurement switch in Settings, and Global Privacy Control turns it off for you. We receive no advertising profile from anyone.

The part that matters, stated plainly: when you click one of our eBay links, a pseudonymous reference code for your account travels with it (section 3), the eBay Partner Network reports that code back to us, and we earn a commission on qualifying purchases. We do not claim this falls outside California's definition of a "sale", because that definition is broad and we think it may cover it. So we treat Global Privacy Control as an opt-out of it: see the next paragraph. There is no separate per-account switch. Write to us and we will tell you what we hold for your account and what we can switch off.

You can opt out of our usage analytics at any time using Your privacy choices or the Usage analytics toggle in Settings, and we honor the Global Privacy Control (GPC) signal as an opt-out of all three: analytics, advertising measurement and the reference code. While GPC is on, the eBay links this site serves you carry no reference code, so following one tells the eBay Partner Network nothing about your account, and the analytics record of the outbound link goes with analytics itself. Be clear on the edges, because they are real: we still create the code and keep it in your alert history, and messages we already sent you by email, push or Telegram still carry one, since those are written by background jobs with no browser signal to read. Because we respond to GPC, we do not separately act on legacy "Do Not Track" browser headers. To make any request under this section, email contact@getchaseboard.com.

10. Children's privacy

Chaseboard is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service evolves. We will post any changes on this page and update the date at the top. Material changes will be highlighted on the site.

12. Contact

Privacy questions or requests: contact@getchaseboard.com, or use our contact form.