Mint Predict ("we", "us") operates mintpredict.com, a Pokémon TCG market-intelligence and portfolio web application. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Mint Predict you agree to the practices described here.
1. Information we collect
1.1 Account information
- Username and password hash. Passwords are hashed (scrypt) before storage; we never store or transmit your password in plaintext.
- Optional email address, if you choose to add one for account recovery. Email is verified via a single-use confirmation link.
- Optional Discord identity (Discord user id, display name, and email reported by Discord) if you "Sign in with Discord" or link Discord to your account.
1.2 Portfolio and inventory data
Cards, sealed products, quantities, cost basis, condition, grades, notes, and import files (e.g., Collectr CSVs) you choose to upload. This data is private to your account.
1.3 Connected services (only with your explicit permission)
- Email mailboxes (IMAP) you connect for inbound shipment tracking. We store the host, port, username, and an encrypted app password (Fernet/AES at rest). We scan only carrier and shipping-related messages to extract order totals, tracking numbers, carriers, ETAs, and delivery statuses.
- eBay account, if you connect one. We receive an OAuth refresh token and short-lived access token from eBay. Tokens are encrypted at rest and used solely to perform actions you initiate (read your eBay business policies; create, publish, and end listings on your behalf; read order/fulfillment data for items you list through Mint Predict).
-
Discord, if you sign in with or link Discord. We request only the
identifyandemailscopes — we cannot read your messages, servers, or DMs.
1.4 Technical data
- Server logs (IP address, request path, timestamp, user-agent), retained up to 30 days for security and abuse prevention.
- A signed session cookie used to keep you logged in.
- Failed-login records (username attempted, IP, timestamp) used for rate limiting.
2. How we use information
- Authenticate you and keep your session active.
- Provide the core product: portfolio valuation, P&L, market forecasts, alerts.
- Ingest your shipments and convert delivered items into portfolio holdings (only when you connect a mailbox and confirm in the review queue).
- Create, publish, and manage eBay listings only for items you explicitly choose to list.
- Send transactional email (account verification, password reset, listing or shipment notifications) to the address you provided. We do not send marketing email without your opt-in.
- Detect abuse, secure the service, and meet legal obligations.
3. How we share information
We do not sell your personal information. We share data only with:
- eBay — when you connect an eBay account or publish a listing, the listing details you submit (title, description, condition, item specifics, price, quantity, photos, and SKU) are sent to eBay's APIs and become governed by eBay's User Privacy Notice.
- Discord — when you "Sign in with Discord", a standard OAuth2 round-trip with discord.com is performed, governed by Discord's Privacy Policy.
- Pricing/data providers we use for our own product (TCGplayer, PriceCharting, JustTCG, eBay Browse) — we send product queries (set, card number, name) to fetch market prices and sold comps. These queries are not tied to your identity and do not include your username, email, or portfolio.
- Email/SMTP and IMAP providers you choose to use, only to deliver our transactional email or to read your shipment-tracking inbox.
- Hosting / infrastructure providers that store the database and run the application. Data at rest is on encrypted volumes; sensitive credentials (mailbox passwords, eBay refresh tokens) are additionally encrypted at the application layer (Fernet/AES).
- Law enforcement or legal process, when required by valid legal request and to the extent legally compelled.
4. eBay-specific disclosures
This section is provided to comply with eBay Developers Program requirements:
- We use the eBay Browse, Inventory, Account, and Fulfillment APIs.
- We request only the OAuth scopes necessary to fulfill features you explicitly enable
(e.g.
sell.inventory,sell.account,sell.fulfillment). - OAuth access and refresh tokens are encrypted at rest. Tokens are used only in response to actions you initiate or to refresh expired access tokens.
- You can disconnect eBay at any time from your Account page; this revokes our refresh token and deletes the connection record.
- Marketplace Account Deletion / Closure compliance. If we receive a notification from eBay that an eBay user account has been closed or that personal data must be deleted, we will delete or anonymize the corresponding tokens, eBay identifiers, and listing metadata in our database within the timeframe required by eBay's developer policies.
- We do not share your eBay data with any third party for advertising or resale.
5. Security
- HTTPS in transit; HSTS where supported.
- Passwords hashed with scrypt; CSRF protection on all state-changing requests.
- Sensitive third-party credentials (mailbox passwords, eBay tokens) encrypted at the application layer using authenticated symmetric encryption (Fernet/AES-128 with HMAC-SHA256).
- Rate limiting on authentication and reset endpoints.
No system is perfectly secure; we cannot guarantee absolute security but we work hard to protect your data.
6. Data retention
- Account, portfolio, and connection data: kept while your account is active.
- Server logs: up to 30 days.
- Single-use tokens (verification, password reset): expire automatically (1–48 hours) and are deleted after use.
- On account deletion, your portfolio, mailbox connections, eBay connection, and personal identifiers are deleted within 30 days. Aggregated, non-identifiable analytics may be retained.
7. Your choices and rights
- Access & export. Email us to request a copy of the personal data we hold about you.
- Correction. You can edit account, portfolio, and connection data from within the app.
- Deletion. You can disconnect eBay/Discord/mailboxes at any time from your Account page. To delete your entire account, email us; we'll process the request within 30 days.
- Withdrawal of consent. Disconnecting a third-party service revokes our access to it.
- If you are in the EU/UK, you have additional rights under GDPR (object, restrict, portability, lodge a complaint with a supervisory authority). California residents have rights under the CCPA/CPRA.
8. Cookies
We use a single, signed first-party session cookie to keep you logged in, and a per-session CSRF token. We do not use third-party advertising or cross-site tracking cookies.
9. Children
Mint Predict is not directed to children under 13 (or under 16 in jurisdictions where that is the applicable age). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
10. International users
Mint Predict is operated from the United States. If you access the service from elsewhere, you consent to the transfer and processing of your information in the United States.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via the app or email. The "Last updated" date at the top reflects the most recent revision.
12. Contact
Questions, requests, or complaints: [email protected].