Supplied-record card analysis
Card Margin privacy notice
Information you provide
Card Margin receives the card identities, raw condition or grading labels, quantities, listing prices, comparable sale records, source references/URLs, rights attestations, cost assumptions and optional FX details submitted with tool calls. Provide only fields needed for evaluation; omit personal buyer/seller information and credentials.
How the application processes records
The application uses those inputs to match supplied records, calculate scenarios and prepare a CSV response. It does not retrieve provenance URLs, contact marketplaces, buy/sell cards, maintain accounts, save inventories or log request bodies. It processes inputs in memory for the request and returns results to the calling ChatGPT/MCP client. Exported CSV/JSON belongs in the user's chosen storage.
Temporary request limits
In public mode, the application's in-memory rate limiter temporarily holds direct socket-peer IP addresses with request counts and expiry times, for at most 1,024 peer entries. A peer may be Railway's proxy rather than the user's address; forwarded IP headers do not change this key. The rate window is 60 seconds. Expired entries are removed lazily on subsequent guarded requests, and all entries disappear when the process ends; this is not a promise of deletion exactly after 60 seconds. Submitted card records are not stored in this limiter.
Hosting and infrastructure
The public deployment uses Railway in the Card Margin Hobby workspace, configured for Virginia, United States. Requests to that deployment involve processing in the United States. Cloudflare is used for DNS only. Railway infrastructure may process IP addresses, user-agent information, request paths and other request metadata independently of the application's request-body behavior. The Hobby workspace provides seven days of accessible log history. That access window is not a verified deletion deadline for all infrastructure records, backups or provider-held data. This notice does not promise zero infrastructure retention or an exact infrastructure-deletion period.
Calling clients and saved exports
ChatGPT/the calling client processes prompts, submitted records and tool responses under its own privacy terms and retention settings. The operator does not control those client records. Saving a report or CSV also places a copy in the storage you choose. Review the calling client's privacy terms and your storage settings separately.
The current application has no analytics, advertising, account database, cookies or network price adapters.
Your choices and privacy requests
You can withhold records, inspect included/excluded sources, and choose whether to save an export. Correct inputs and rerun the evaluation if the records or assumptions are wrong. The application has no persisted inventory to retrieve, correct or delete.
For access, correction, deletion or another privacy concern, email the contact with a description and enough non-sensitive context to identify the issue. Avoid sending full records, personal transaction details or credentials. The process is to review the request, clarify what can be identified, and explain what action is available for information the operator controls, subject to applicable law and provider controls. Infrastructure requests may require provider assistance; client records and saved exports must be handled with the calling client or chosen storage service. Responses are best effort, without a promised deadline or guaranteed deletion outcome. Support correspondence itself contains what you choose to send and is handled separately from stateless tool calls; this notice establishes no automatic email-deletion schedule.
Use Card Margin only where your access and use of supplied records are lawful and permitted by the calling client. See Support and Terms.