Privacy policy

Last updated: November 3, 2026

GrailCrest is an app for grading trading cards from scans and photos. This page explains what the app and this website do with information about you. In short: your scans and photos stay on your device, your GrailCrest account holds only your email, your license and (with cloud sync) your saved cards and their saved pages, and nothing tracks you.

What stays on your computer

Your scans and photos, your scanner calibration, your settings and any price-service key you add stay on your computer. So do your grades, measurements and collection, except that cloud sync copies your saved cards and their saved pages to your other signed-in devices (see below). The app's backups are saved to your own Documents folder. We never receive any of it, except the cards and saved pages cloud sync carries and the real grades you choose to share (see below).

What the app sends over the internet

Grading works offline. The app goes online only for the things below, and you can turn online lookups off in Settings.

• Recognising a card and looking up its price: the card's name, set and number are sent to TCGdex (api.tcgdex.net), which lists cards and their TCGplayer and Cardmarket prices. For PSA and other graded prices, a copy with a license key asks the GrailCrest server (api.grailcrest.app), which gets them from PokemonPriceTracker: it sends the card's TCGplayer product number, or its name, set and number. If you add your own key for PokemonPriceTracker or PriceCharting, the same details and your key go to that service. Your scans are never sent.
• Official card pictures: to recognise a card and to measure the centering of full-art cards, the app downloads the card's official picture from TCGdex (assets.tcgdex.net) or pokemontcg.io (images.pokemontcg.io).
• Exchange rates: to show euro prices in dollars, the app asks Frankfurter (api.frankfurter.dev) for the current rate.
• Updates: the app checks a small file on GitHub (raw.githubusercontent.com) for a new version, and downloads it from there.
• Your license key: when you unlock GrailCrest, and about every two weeks after that (every few days for a subscription), the app sends your license key and our product ID to the store it was bought from (Lemon Squeezy, or Gumroad for older keys) to check the key.
• The GrailCrest server (api.grailcrest.app): a copy with a license key checks in about once a week. It sends the key (or, when you're signed in, a sign-in code for your account instead), a random ID the app made for this computer or phone (not your name or anything about the device itself) and the app's version, so the server can confirm the key with the store and let it work on up to two computers and two phones. Price lookups (above) carry a pass from that check-in. The server keeps only a scrambled (hashed) form of the key and the computer ID, the first letter and domain of the purchase email, which version of GrailCrest and when each computer last checked in, and which cards each license priced that day (to count Standard's daily cards, deleted after a few days). Signing a computer or phone out in Settings frees its place on the server.

Like any website, these services see your computer's IP address when the app connects to them, under their own privacy policies.

Your GrailCrest account

With a license you make a GrailCrest account: an email address and a password. The account holds your license key, so signing in on another computer or phone brings the key with it. The GrailCrest server keeps your email address, your password only in a form that can't be turned back into it (a PBKDF2 hash), your license key locked with a key only the server has, and, for each computer and phone signed in, a random ID the app made for it, whether it's a computer or a phone, the name the app gives it (like "Windows PC" or "iPhone"), the app's version and when it was last used, so a license can work on two computers and two phones and you can see and sign out each one in Settings. If you ask for a password reset, the server emails a link to your address; the link works for an hour and once. We use your email only for your account, password resets and messages about your license, never for marketing unless you sign up for it. To delete your account, email support@grailcrest.app from its address.

Cloud sync

When you're signed in to your GrailCrest account, cloud sync keeps your saved cards the same on your computers and phones. It starts by itself once you're signed in, and you can turn it off at any time in Settings. When it's on, your saved cards go to the GrailCrest server (api.grailcrest.app): each card's name, set and card ID, its grade estimates and what the app measured, your light check answers, its prices and price history, what you paid and sold it for, the real grade if you typed one, your notes, and the card's two small pictures (about 260 pixels wide, made from your scan or photo). It never sends your scans or photos themselves, or where they are on your computer.

With cloud sync on, each card's saved page (its grading results and pictures of the card) is also stored on GrailCrest's server, so the card's full result page shows on your other devices. The saved page holds what the app measured and found, the grade estimates and odds, your light check answers and, with GrailCrest Pro or Commercial, a picture of each side of the card (a JPEG made from your scan, at most about 600 dpi); with Standard it holds the results without those pictures, and your other devices show the card's two small pictures instead. It never holds the scan files themselves or where they are on your computer. A card's saved page is deleted from the server when the card is deleted, and all of them when your account is deleted or you use Delete my synced cards. The switch Keep full pages in the cloud in Settings, Cloud sync turns it off: the saved pages are then deleted from the server and no longer sent, and your cards keep syncing without them. Saved pages are kept in private Cloudflare R2 storage that only the GrailCrest server can read, and are only sent to devices signed in to your account.

Your cards are stored with your account, are only ever sent to devices signed in to it, and are never shared with anyone or used for anything else. If you delete a card, it's deleted on the server and on your other devices. Delete my synced cards in Settings removes everything your account synced from the server (the cards stay on the device you're using). If your license ends, sync stops, and what it stored is deleted after 90 days unless you renew. The server runs on Cloudflare (Workers, D1 and R2).

Sharing your real grades (only if you choose to)

Sharing is off until you turn it on (the app asks once, in History, after you type in a real grade, and it's in Settings, Learning from your real grades). When it's on and you type in the grade a card got from PSA, Beckett, CGC or another grader, the app sends the GrailCrest server: the card's name, set and card ID; what the app measured on your scan of the raw card (centering, the corner, edge and surface grades, your light check answers and its estimate); the grade, the grading company and the slab's cert number if you typed it; and the dates. It never sends your scans or photos, what you paid or sold cards for, your notes, or anything about you. Each result is linked to your license only in scrambled form. We use the results to make GrailCrest's grading more accurate, and may publish overall accuracy figures that no one can be identified from. For shared learning, other licensed copies of GrailCrest receive shared results as plain numbers only (the app's estimate, the measurements behind it and the grade), without the card's name, the cert number, the dates or anything that links them to you or your license; this starts only once enough people have shared. You can turn sharing off at any time, and Take back what I shared in Settings deletes everything your license shared from the server, so it is no longer part of what other copies receive.

Show mode (GrailCrest Commercial)

When you grade cards for customers in Show mode, the customer's name, email address and card grades are kept on your computer only. When you email a report, the app sends it through your own email account (for example Gmail), from the computer you're using, straight to your customer. We never receive your customers' details or their reports. The app asks you to confirm each customer agreed to get the report by email, and customers are let go from the app a month after you finish with them. If you run Show mode as a business, you're responsible for how you use your customers' details.

The password for your email account is kept on your computer, apart from your settings, and is never in a backup.

Buying GrailCrest

Purchases are made through Lemon Squeezy, which acts as the seller of record and handles payment, sales tax and receipts (older purchases were made through Gumroad, which does the same). The store collects your email address and payment details under its own privacy policy; we see your email address and the order, and use them only to send your license key, answer you and handle refunds. We don't sell or share them.

This website

This website has no analytics, no advertising and no cookies. It's hosted on Cloudflare Pages, which keeps standard server logs, such as IP addresses, to run and protect its service.

Emailing us

If you email support@grailcrest.app, we use your message and address only to answer you, and delete them when they're no longer needed.

Children

GrailCrest isn't directed at children under 13, and we don't knowingly collect information from them.

Changes

If this policy changes, the new version is posted here with a new date.

Contact

Questions about privacy: support@grailcrest.app.