Slab — Privacy Policy

Effective date: June 13, 2026

This Privacy Policy explains what information the Slab mobile app ("Slab," "we," "us") collects, how we use it, and the choices you have. Slab grades trading cards from photos and lets you track a personal card inventory. Slab is operated by Slab Card Grader LLC.

1. Information we collect

Account information. When you create an account we collect your email address and a unique account identifier (user ID). If you sign in with Google or Apple, we receive your email and a provider identifier from them; if you use Apple's "Hide My Email," we only ever see the relay address Apple provides.

Card scan data. When you assess a card, the app captures front and back photos using your device camera or photo library. Here is how those images are processed:

• Core grading measurements — centering, corner condition, edge wear, and surface defects — are computed using on-device machine learning models.
• Card identification uses cloud-based processing, which sends image data to Anthropic's Claude API to identify the card and generate a grading narrative.
• Card photos are not permanently stored on Slab's servers. Images are transmitted to Anthropic transiently to return your result and are not used by Anthropic to train its models.
• Your scan results (verdict, scores, card name, and timestamp) are saved to your account in Firestore so you can review past assessments in your inventory.

Submission tracking data. If you choose to track a grading submission, we store the grading company you selected, the date you logged the submission, and — if you report it — the grade your card received back. This data is associated with your account and the corresponding scan record.

Inventory and assessment data. When you save a card, we store the assessment results and card details (card name, set, number, grade/verdict, category scores, a reference image URL from the public card catalog, and price snapshots) in your account.

Feedback you submit. If you send feedback or report a scan, we store your message along with your email, account ID, device platform, and (for scan reports) the card name and verdict you were viewing.

Diagnostics. We use Google Firebase Crashlytics to collect crash reports and basic performance/diagnostic data (e.g., device model, OS version, and the events leading to a crash), associated with your account ID, to help us fix bugs.

We do not collect payment or financial information — purchases are processed entirely by Apple and Google and we never see your payment details. We also do not collect precise location, contacts, health data, or advertising identifiers. We do not use your information for advertising and we do not track you across other apps or websites.

2. How we use your information

We use the information above to:

• create and secure your account and sign you in;
• analyze card photos and return grading results;
• save and display your card inventory and look up card prices;
• track grading submissions and send return-grade reminders;
• award scan credits when you report grading outcomes;
• respond to your feedback and reports;
• diagnose crashes and improve the app's reliability; and
• improve the accuracy of our grading models through the optional Data Contribution program (see Section 4).

3. Service providers we share data with

We share information only with the service providers that make the app work. They process data on our behalf and are not permitted to use it for their own purposes:

• Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Crashlytics) — stores your account, scan records, inventory, submission tracking, and feedback, and processes crash diagnostics.
• Anthropic — receives your card images and text prompts to identify the card and generate a grading narrative. Anthropic does not use API data to train its models.
• PostHog — we use PostHog for product analytics. PostHog receives usage events such as scan starts and completions, feature interactions, and paywall views, associated with a persistent account identifier (your Firebase user ID). PostHog does not receive card images, card names, or any information that identifies which cards you own or scan. These analytics events are separate from the optional Data Contribution program (Section 4) — they are collected regardless of that setting and contain no card-identifying information. PostHog Privacy Policy: posthog.com/privacy.
• Discord — we use Discord as an internal operations channel. When you submit feedback, your email address and message are sent to our private Discord server. If your scan generates a critical error or significantly exceeds our timing thresholds, your account identifier, device platform, and game/card-type are sent to our private Discord server for monitoring purposes. Your data is not shared with other Discord users and is used solely for operating and improving the service. Discord Privacy Policy: discord.com/privacy.
• RevenueCat — manages subscription entitlements and verifies in-app purchases. RevenueCat receives your device identifier and subscription status. RevenueCat Privacy Policy: revenuecat.com/privacy.
• Scrydex — we query Scrydex for trading card catalog data, set information, and pricing. Queries contain card identifiers (name, set code, number) — no personal information.
• Card data & pricing providers — to identify cards and show prices, we also send card identifiers (not personal data) to pokemontcg.io, PokePriceTracker, TCGplayer, and eBay.

We do not sell your personal information.

4. Data Contribution (optional, opt-in only)

We are continuously improving our on-device grading models. To do this, we would like to use anonymized data from real scans — specifically, image crops of card corners and edges paired with their measured grades — to train and evaluate future model versions.

We will only use your scan data for model training if you explicitly opt in. This is presented as a separate consent prompt after your first scan. You can change your preference at any time in Settings → Privacy → Data Contribution.

• If you opt in: anonymized image crops (not full card photos) may be stored and used to improve grading accuracy. Your data is never shared with third parties for this purpose.
• If you opt out: none of your photos or scan images are retained after the scan session ends. Previously stored crops are deleted within 90 days of opting out.

The separate submission tracking feature (reporting your actual PSA, BGS, TAG, or CGC grade back to Slab) also contributes to model improvement. Reported grades are stored in your account and used to measure how well Slab's predictions match real grading outcomes. This feedback loop operates under the same opt-in consent as the Data Contribution program.

5. Data retention

We keep your account, scan records, inventory, submission tracking, and feedback for as long as your account is active. Crash diagnostics are retained according to Firebase Crashlytics' default retention policy. Card photos transmitted for grading are processed transiently and not retained by Slab. Training data crops (if you opted in) are deleted within 90 days of opt-out or account deletion.

6. Your choices and how to delete your data

• Sign out at any time from the app.
• Delete your account in the app: open the Inventory tab, tap the menu (⋮), and select "Delete Account." This permanently deletes your account, scan history, inventory, and feedback.
• Opt out of Data Contribution at any time in Settings → Privacy → Data Contribution.
• You may email us at contact@slab-grader.com to request a copy of your data or to ask questions about this policy.

7. Children's privacy

Slab is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

8. Security

We use industry-standard measures provided by Google Firebase, including authentication and per-user access rules so that you can only read and write your own inventory and feedback. No method of transmission or storage is 100% secure, but we work to protect your information.

9. Changes to this policy

We may update this policy as the app evolves. We will revise the effective date above and, for material changes, provide notice in the app.

10. Contact

Questions about this policy or your data? Email contact@slab-grader.com.