Privacy Policy

Effective October 10, 2026 · Last updated October 10, 2026

1. Who we are

Grail is made by Grail Cards LLC, an Arizona limited liability company ("Grail," "we," "us," or "our"). This policy covers the Grail app for iPhone, the website at grail.cards, and the emails we send (together, the "Service"). It explains what information we collect, why we collect it, who we share it with, and the choices you have.

2. Information we collect

Information you give us

• Account details. You can create a Grail account three ways: with your email address and a password, with Sign in with Apple, or with Google. If you use email, we collect your email address and a password. We store passwords only in hashed form, so we never see the password itself. You can also add a display name and a profile photo.
• Sign in with Apple. If you sign in with Apple, Apple sends us a unique account identifier and, if you choose to share them, your name and email address. If you choose Hide My Email, we receive a private relay address instead of your real one.
• Google sign-in. If you continue with Google, Google sends us your name, email address, and profile picture, along with an account identifier. We do not receive your Google password, and we do not get access to anything else in your Google account, such as your contacts, files, or Gmail.
• Your collection. We store the cards you add, including details such as player, team, sport, year, set, parallel, card number, serial number, grading company, grade, and certification number. We also store what you paid, any notes you write, and the price and date when you mark a card as sold.
• Card photos. When you scan a card or pick photos of it, we store the front and back images with that card so you can see them in your collection.
• Spreadsheets you import. When you import a CSV file, the rows in it are sent to our servers so we can turn them into cards. We keep the cards you choose to add, not the file itself.
• Email signups. If you join the launch list or the Grail Report newsletter on our website, we collect the email address you enter.
• Messages to us. If you email us, we keep the message and your contact details so we can respond.

Camera and photo access

Grail asks for camera access only so you can photograph your cards, and it uses the camera only when you start a scan. When you pick photos from your library, the app receives only the photos you select. Before uploading, the app resizes each card photo and saves it as a new image, so location and other photo metadata are not uploaded. If you choose to save a cropped card photo, the app asks for permission to add it to your photo library. You can change these permissions at any time in your iPhone's Settings.

Information collected automatically

Like most online services, our servers and hosting providers automatically record basic technical information when the app or website connects to them. This includes your IP address, your device or browser type, and the time of the request. We use it to keep the Service running, fix problems, and prevent abuse. The Grail app does not include any third-party analytics, advertising, or tracking software, and it does not access your device's advertising identifier.

If you have chosen to share analytics with app developers in your iPhone settings, Apple may send us crash reports and anonymous usage statistics. Apple controls that setting, and you can turn it off at any time.

3. How we use your information

We use your information to:

• create and secure your account, including sending sign-in and verification codes;
• store your collection and keep it in sync, and show you totals such as what you paid and what you have gained or lost on cards you sold;
• read the details off card photos and spreadsheets so you do not have to type them;
• send you the emails you asked for, such as launch news or the Grail Report newsletter;
• answer your questions and support requests;
• find and fix bugs, and improve how the Service works;
• protect the Service and its users from fraud, spam, and abuse; and
• comply with the law.

We may also use information that has been aggregated or stripped of anything that identifies you, for example to understand which sets are tracked most often. That information cannot reasonably be used to identify you.

4. Card scanning

When you scan or upload a card photo, the image is sent to our servers and processed by OpenAI, which reads the visible details, such as the player, set, and card number, and sends them back to fill in the card for you. We use OpenAI the same way to read the rows of a spreadsheet you import. Under OpenAI's API terms, it does not use this data to train its models. For graded cards, we may send the certification number, and only that number, to PSA to look up the card's details.

The details these tools produce can be wrong, so the app shows you the result to review before the card is saved.

5. Who we share it with

We do not sell your personal information, and we do not share it for advertising. We share it with the service providers that help us run Grail, and in the few situations listed below the table. Each provider may use your information only to provide its service to us.

We may also share information in the following situations:

• Legal reasons. We may share information if we believe in good faith that the law, a court order, or a valid legal request requires it, or if it is needed to protect the rights, property, or safety of Grail, our users, or others.
• Business transfers. If Grail is part of a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that deal. The new owner will have to honor this policy, and we will tell you before your information becomes subject to a different one.
• With your permission. We will share information in any other way only if you ask us to or agree to it.

6. No ads, no tracking

Grail does not show ads and does not track you. That means we do not link information from the app with information from other companies' apps, websites, or data brokers for advertising or measurement, and we do not share your information with data brokers. Because of this, the app never asks for permission to track you.

The grail.cards website does not use advertising or analytics cookies. If you join our email list, Loops may record whether our emails are opened or links are clicked so we can tell whether they are useful. You can unsubscribe from those emails at any time.

7. Keeping and deleting your data

We keep your account and collection for as long as your account is open, so your cards are there when you come back.

• Delete a card. When you delete a card, we delete its details and its photos.
• Delete your account. In the app, go to Profile and tap Delete account. This permanently deletes your account, every card in your collection, your card photos, and your profile photo from our database right away. Any copies left in routine backups or service logs are deleted when those backups and logs expire on their normal schedule. If you cannot open the app, email support@grail.cards from the address on your account and we will delete it for you.
• Email lists. We keep your email on the launch list or newsletter until you unsubscribe. Every email includes an unsubscribe link.
• What we keep. We may keep a limited record when the law requires it, to resolve a dispute, or to prevent fraud and abuse.

If you signed in with Apple or Google, you can also remove Grail from the connected apps in your Apple Account or Google Account settings. That stops future sign-ins, but it does not delete your Grail data, so please use Delete account for that.

8. Your choices and rights

Wherever you live, you can:

• See and correct your information. You can view and edit your cards, name, and profile photo in the app.
• Get a copy. In the app, go to Profile and choose Export collection to download your cards as a CSV file. You can also email us for a copy of the other information we hold about you.
• Delete your information. Use Delete account in the app, or email us.
• Change permissions. You can turn camera and photo access on or off in your iPhone's Settings.
• Stop marketing emails. Use the unsubscribe link in any email.

Depending on where you live, including California and other U.S. states with privacy laws, and the European Union and the United Kingdom, you may have additional legal rights. These can include the right to know what personal information we collect and how we use it, the right to access, correct, delete, or port it, the right to object to or restrict certain uses, and the right to opt out of the sale of personal information or its use for targeted advertising. We do not sell personal information or use it for targeted advertising. We will not treat you differently for using any of these rights.

To make a request, email support@grail.cards. We may need to confirm that the account is yours before we act on it, and we will respond within the time the law requires. You can use an authorized agent to make a request for you, and if we turn down a request, you can ask us to reconsider by replying to our answer. If you are in the EU or UK, you can also complain to your local data protection authority.

9. Security

We protect your information with encryption in transit (HTTPS), hashed passwords, and access controls that limit who can reach our systems. No system is perfectly secure, so we cannot promise that your information will never be accessed without permission. If we learn of a breach that affects your personal information, we will notify you as the law requires.

10. Children

Grail is not meant for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email us and we will delete it.

11. Users outside the United States

Grail is run from the United States, and our service providers store and process information in the United States and other countries. If you use Grail from somewhere else, your information will be transferred to the United States. If you are in the EU or UK, we process your information to provide the Service you asked for, to pursue our legitimate interest in keeping it secure and working well, with your consent where we ask for it, and to meet our legal obligations.

12. Changes to this policy

We may update this policy as Grail changes. When we do, we will update the date at the top of this page. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect.

13. Contact us

For questions about this policy or your information, contact us at: