Who we are
Cobra Cards Scan & Vault is operated by Wintana Tyre Wholesale Ltd, 7 Convent Road, Ashford, Surrey, TW15 2HJ, United Kingdom. Privacy questions can be sent to support@cobrascanandvault.com.
Account and authentication data
To create an account we store your email address and an authentication identity. Sign-in is handled by our managed authentication provider; we never see or store your password. If you sign in with a provider such as Google, we receive the email address that provider releases to us. Where a provider issues a private relay email address, that relay address is what we store — we do not attempt to resolve your real address.
Card photographs
When you scan a card we store the photographs you upload, together with any enhanced or vaulted variants you choose to create. Originals are never overwritten. Images are held in a private storage bucket and are only accessible through short-lived signed links generated for your signed-in session.
AI identification and pre-grading
Your card photographs are sent to our AI provider (the Lovable AI gateway) to return a card identification and a photographic pre-grade estimate. The AI response — identified attributes, confidence, sub-grades, probabilities and suspected defects — is stored against your card. Identification is AI-assisted and editable by you; the pre-grade is an estimate, not an official professional grade.
Collection, financial and valuation data you enter
We store the card details you confirm, plus the figures you enter: purchase price, shipping, buyer fees, grading cost, other costs, sale price and sale costs, your own valuations, tags and notes. These are used to calculate your cost basis, unrealised and realised profit and portfolio analytics.
Personalisation data
My Players watchlists, My Models definitions, model run history, alerts, watchlists and portfolio snapshots are stored against your account so your Discover results and analytics are personalised. Personal interest only labels results; it does not alter the objective Cobra intelligence scores.
Technical and usage data
Our infrastructure providers process standard request information such as IP address and timestamps in order to serve and secure the application, and we record scan usage counts against your profile. Cobra does not include advertising SDKs, analytics SDKs or cross-app tracking, and does not send push notifications.
Service providers
We use Supabase (managed through Lovable Cloud) for database, authentication and private file storage; Lovable for application hosting and its AI gateway for card identification and pre-grading. Data is shared with these providers only to deliver the features you request. We do not sell your data, and we do not share it with advertisers or data brokers.
Security
Every user-owned table is protected with row-level security so only your signed-in account can read or write your rows. Card images are stored in a private bucket rather than public URLs. Privileged operations run server-side only; service credentials are never exposed to the browser. We make no claim to any formal security certification.
Retention
We keep your account data for as long as your account exists, because the product is a long-term collection record. We do not retain user data beyond that except where we are legally required to. Deleting your account removes the data described below.
Deleting your data
You can delete your account in the app at Settings → Delete Account. This permanently removes your collection items, card photographs and variants, AI grading assessments, valuations, notes, My Players, My Models and model runs, alerts and watchlists, portfolio snapshots, your profile and your authentication account. Global Cobra reference and intelligence data, which is not personal to you, is retained.
Your rights
Depending on where you live, you may have rights to access, correct, export or erase your personal data, and to object to processing. Most data can be viewed and edited directly in the app, and deletion is self-service. For anything else, contact support@cobrascanandvault.com.
Children
Cobra is not directed at children and accounts are intended for adult collectors.
Changes
If this policy changes materially we will update this page and the date shown below.