Privacy Policy
Last updated: August 13, 2026
1. What we collect
To run WaxEngine we collect: your account email and password hash; the card photos you upload; listing, order, and sales data pulled from your connected eBay account; the authorization tokens eBay issues when you connect (never your eBay password); your app settings; and basic usage data such as scan counts for quota metering. Order data from eBay includes your buyers' names, usernames, and shipping addresses, which we hold so you can print envelopes and manage fulfillment; buyer contact details are automatically redacted 120 days after the order, and sooner if eBay tells us the buyer closed their account. If you join the waitlist or use the contact form, we store the message and email you provide. If you answer the short feedback question on this site, we store your selected reason and any free-text comment you choose to add; the survey does not ask for or store your name or email.
2. How it's used
Your data is used to provide the product you signed up for: photos are processed by automated identification systems (AI) to recognize cards; your sales history powers your own pricing and profit reports; your eBay tokens let the app perform the actions you trigger. Some features also send listing titles and prices to an AI provider to generate market commentary and selling advice for you (Market Intel and Pulse); the context we assemble for these features never includes buyer names, addresses, or messages. (What you type into the Pulse chat yourself is sent to the AI provider as typed, so don't paste information you wouldn't share.) One thing is shared in de-identified form: when your cards sell, the card title, sale price, and date (never your name, store name, buyer, or any account link) join a pooled comparable-sales database that powers pricing suggestions for all WaxEngine subscribers, the same way your pricing suggestions draw on other subscribers' anonymous sales. We do not sell your data and we do not share it with advertisers or data brokers.
3. Who processes it
WaxEngine runs on established providers, each receiving only what it needs: Supabase (database and file storage), Railway (application hosting), Cloudflare (site hosting and traffic routing), Stripe (payments; we never see full card numbers), eBay's APIs (your marketplace data), Google and Anthropic (AI processing: card-photo identification, and the listing/sales context described in section 2), Resend (the emails we send you), and PostHog (product analytics keyed to an internal account ID, with no names, emails, or card data in the events). This marketing site also uses PostHog to measure page views and button clicks in aggregate.
4. Cookies and tracking
The app uses cookies to keep you signed in. The app and this site also load a Google Ads conversion tag so we can tell Google when an ad click led to a signup; it reports the signup event to Google and may set Google cookies, but we send it no names, emails, card data, or eBay data. Beyond that there is no third-party ad tracking. This site uses first-party analytics to understand which pages people visit and which buttons they use, stored in your browser's local storage rather than cookies, along with a small record of how you first arrived (the landing page, referring site, and any campaign tags on the link). When you follow a signup link, that arrival record travels with the link so we know which page earned the signup. We never sell this data, it contains no name or email, and automated visitors are excluded rather than counted. If we ever enable session replay on this site to understand usability problems, everything you type is masked before it reaches us. If you want to be excluded from analytics on this site, email us and we will tell you how, or simply use your browser's tracking protections.
5. Retention and deletion
Your data is kept while your account is active, with two automatic exceptions: buyer names and shipping addresses are redacted 120 days after each order, and cached eBay active-listing data expires after 30 days. Deleting your account from Settings removes your photos, scans, listings data, orders, eBay connection, and settings from our systems; billing records are kept as long as tax and accounting law requires. Anonymized pooled sale records (card title, price, date; see section 2) contain no link back to your account and remain in the pool. If eBay notifies us that a buyer closed their eBay account, we erase that buyer's personal data right away. You can also request deletion or a copy of your data by email.
6. Your rights and contact
WaxEngine is operated from Ontario, Canada and handles personal information in line with Canadian privacy law (PIPEDA). You can access, correct, export, or delete your personal information at any time. Questions or requests: hello@waxengine.com. If we ever change this policy in a meaningful way, we'll tell you by email or in the app first.