Last updated: October 12, 2026
The Card Shop Finder ("we," "us") operates this website. This policy explains what we collect and how we use it — and we aim to collect as little as possible.
Information you provide
- Contact form: your name, email, optional phone number, and message, so we can respond.
- Email signups: your email address, if you subscribe to updates.
- Sell-your-cards waitlist: if you join it, your email, city and state and the answers you give, so we can judge where people want the feature and email you about it. It does not sign you up for anything else.
- Shop owner accounts: if you claim a listing, your name and email, and a securely hashed password. We never store passwords in plain text.
- Listing claims: the contact details you submit when claiming or correcting a shop.
Information collected automatically
- Approximate location: we derive a general location (state/city) from your IP address to show nearby shops. This is not precise geolocation.
- Anonymous engagement data: when someone taps a shop's phone, website, or directions link, we log the action to measure interest. IP addresses used for this are one-way hashed together with the day's date, so they are never stored in readable form and one day's records can't be matched to the next.
- Standard server logs. Cookies and browser storage are covered in the next section.
Cookies and similar storage
The site doesn't ask you to accept cookies before it loads; the notice at the bottom of the page is there to tell you about them. This is everything the site keeps in your browser, and the other companies involved.
Our own cookies
- PHPSESSID keeps shop owners and site admins logged in. The sell-your-cards waitlist form also sets it, once you start filling the form in, to check the form came from our page. It is deleted when you close your browser.
- csf_owner tells the site menu that a shop owner is logged in. It is deleted when you close your browser or log out.
- csf_signup remembers your progress in the shop sign-up form. It is only sent to the sign-up pages and expires after 72 hours.
- tcf_state remembers the last state you browsed, for 90 days.
- csf_cookie_notice records that you dismissed the cookie notice, for a year. We normally keep this in local storage and use the cookie only if local storage isn't available.
Browser storage
Local and session storage stay on your device. We use them to remember:
- the shops you viewed recently;
- when our pop-ups last appeared, so they don't repeat: the newsletter pop-up shows once per browser, the Whatnot pop-up at most once a night, each ad pop-up once a day and the giveaway pop-up once per visit;
- whether you have entered the current giveaway;
- that you dismissed the "coming soon" sell-your-cards strip on shop and event pages, so it stays hidden for 30 days (csf_sell_strip);
- that you dismissed the cookie notice.
Other companies
- Google Analytics runs on every page so we can see how the site is used. It sets the _ga cookies, which last about 13 months.
- Klaviyo, our email provider, runs a script on every page and sets a __kla_id cookie, which lasts about 13 months, along with some local storage. When you sign up for the newsletter or enter a giveaway, the form sends your email address to Klaviyo. If you join the sell-your-cards waitlist, we may add your email to a separate Klaviyo list used only for that.
- Cloudflare delivers the site and screens out bots, and sets a cf_clearance security cookie for that.
- Stripe takes payments for paid listings and featured events, on Stripe's own checkout pages or in a Stripe payment form on our featured-event page. Stripe may set its own cookies there to prevent fraud.
- Google Fonts serves the site's fonts.
- Our map pages load the Leaflet map library from unpkg.com and map tiles from OpenStreetMap, and the events map loads a state-outline file from jsDelivr. These services see your IP address when your browser asks them for the files, but set no cookies.
- To estimate which state you're in, our server may send your IP address to ip-api.com. We keep the answer for a while, filed under a hash of the address rather than the address itself.
Our own counting
We count page views, taps on a shop's phone, website and directions links, ad views and clicks, views of our pop-ups and the sell-your-cards strip, and clicks through to eBay by sending small requests to our own server. These set no cookies, and the IP address they carry is stored only as the one-way, date-combined hash described above.
Affiliate links
Links to eBay and Whatnot are affiliate links: we may earn a commission if you buy, and those sites may set their own cookies once you arrive there.
Opting out
You can block or delete cookies in your browser's settings. The site still works without them, apart from shop owner log-in and sign-up. Google offers a browser add-on that stops Google Analytics on every site. Dismissing our notice only hides it; it doesn't change what is stored.
How we use information
- To operate, maintain, and improve the directory.
- To respond to your messages and listing claims.
- To send emails you've asked to receive (you can unsubscribe anytime).
- To process payments for optional paid listing plans.
Service providers
We rely on a few trusted third parties to run the site. They process data only as needed to provide their service:
- Mailgun — transactional email delivery (e.g. contact replies, owner invites).
- Klaviyo — email newsletter management, if you subscribe.
- Stripe — payment processing for paid plans. Card details go directly to Stripe; we never see or store them.
- Google — web fonts and Google Analytics (see the cookies section above).
- Cloudflare — delivers the site and screens out bots.
- ip-api.com — estimates your state from your IP address so the site can show nearby shops first.
- Our hosting provider — to serve the website.
What we don't do
We do not sell your personal information, and we do not run ad-network trackers. The only third-party scripts on the site are Google Analytics and Klaviyo, described in the cookies section above.
Your choices
- Unsubscribe from emails using the link in any message.
- Request access to, or deletion of, the personal information we hold about you by contacting us.
- Control cookies and local storage through your browser settings.
Children
This site is intended for a general audience and is not directed to children under 13, and we do not knowingly collect their personal information.
Changes
We may update this policy from time to time; we'll revise the "last updated" date above when we do.
Questions about your privacy or a data request? Reach us through our contact page.