Privacy Policy · Hoshino

Hoshino ("Hoshino," "we," "us," or "our") provides a cross-border trading-card price and portfolio platform — a web app, an installable app, and a public API (together, the "Service"). This Privacy Policy explains what personal data we collect when you use the Service, how we use it, who we share it with, and the choices and rights you have. We handle personal data in line with the data-protection and privacy laws that apply to you based on where you live.

1. Introduction and scope

This policy covers personal data we process when you visit our site, create an account, use the app, or call our API. It does not cover third-party marketplaces, graders or services we link to or draw data from — those have their own privacy practices, and we encourage you to read them.

2. Information we collect

We collect only what the Service needs to work:

Account information — the email address you sign up with and the credentials used to authenticate you. If you subscribe to a paid plan, our payment processor collects your payment details on our behalf (see Third-party services); we do not store full card numbers.
Card and portfolio data you enter — the cards you add, cost basis, quantities, purchase and sale records, listings, showcases, notes and alert rules. This is your content, and you control it.
Usage data — how you interact with the Service: features used, searches and scans run, spread and grade-EV checks requested, and alerts triggered.
Device and app data — device type, operating system, browser, app version, whether you installed the app to your home screen, language and region settings, and your IP address (which we also use to suggest a default market and currency).
Cookies and local storage — small identifiers and preferences stored in your browser to keep you signed in and remember your settings (see Cookies and local storage).

3. How we use your information

We use personal data to:

Provide and operate the Service — identify scanned cards, return real sold prices by region, calculate cross-border spreads net of fees, shipping and FX, run grade-EV estimates, and track your portfolio's profit and loss.
Send prices, alerts and notifications — including the price, spread and population alerts you set up, and important service messages.
Process billing — manage subscriptions, renewals and receipts through our payment processor.
Provide support — respond to your questions and troubleshoot issues.
Improve the product — understand which features are used and where the Service can be faster or more accurate, generally using aggregated or de-identified data.
Keep the Service secure — detect and prevent fraud, abuse, scraping and rate-limit violations, and protect our users and infrastructure.
Meet legal obligations — comply with applicable law and tax and accounting requirements, and respond to lawful requests.

4. Cookies and local storage

Essential cookies only. Hoshino sets one cookie — the session cookie that keeps you signed in — and uses browser local storage for your own preferences: language (Hoshino's interface is available in eight languages), display currency, default region, and cached data so the installable app loads quickly. That is the complete list. There are no advertising cookies, no third-party trackers and no cross-site pixels, so there is nothing optional to switch off — which is why our cookie notice explains what we use rather than offering a consent menu that would have nothing in it. You can clear cookies and local storage in your browser at any time; doing so may sign you out and reset your preferences.

5. Third-party services

We rely on a limited set of vetted providers to run the Service. We share only the data each provider needs, and they are bound to use it solely to provide their service to us:

Payment processing — a third-party payment processor handles subscription billing and stores your payment-method details securely; we receive confirmation and limited transaction data, not full card numbers.
Analytics — there is no analytics provider. Product usage is measured by our own software on our own servers: anonymous counts of events such as page views, searches and upgrade clicks, with no IP address, no account identifier, no cookie and no query strings attached. Nothing about how you use Hoshino is sent to a third party, and the measurement only runs after you have acknowledged our cookie notice and never when your browser sends a Do Not Track signal.
Infrastructure and hosting — cloud infrastructure, database and content-delivery providers host the Service and store your data.
Email and notifications — a delivery provider sends transactional email and alerts.
Marketplace and price-data sources — Hoshino draws real completed-sale data from public marketplaces and partner data feeds to produce prices, spreads and grade-EV. This market data is about cards, not about you; we do not send your personal data to these sources.

We describe these providers by category rather than exposing internal integration details or keys.

6. How we share data

We do not sell your personal data. We share personal data only:

with the service providers described above, acting as our processors under contract;
when you choose to make content public — for example, if you publish a seller listing, a public showcase, or a "make an offer" page, the information in it becomes visible to others;
for legal reasons — to comply with law, enforce our Terms, or protect the rights, safety and property of Hoshino, our users or the public; and
in a business transfer — if Hoshino is involved in a merger, acquisition or sale of assets, in which case we will notify you of any change in how your data is handled.

7. Data retention

We keep your account and portfolio data for as long as your account is active. If you close your account or ask us to delete your data, we delete or anonymize it within a reasonable period, except where we are required to retain certain records — for example, billing and tax records — for the period the law requires. Aggregated or de-identified data that can no longer identify you may be kept.

8. Security

We protect personal data with encryption in transit (TLS), access controls and least-privilege practices, and we limit who on our team can access it. No method of transmission or storage is completely secure, so while we work hard to protect your data we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

9. Your rights and choices

Subject to applicable law, you can:

Access the personal data we hold about you;
Correct data that is inaccurate or incomplete;
Delete your account and associated data;
Export your portfolio and account data in a portable format; and
Withdraw consent or object to certain processing.

Export and deletion are self-serve, not a support queue. Sign in and open Settings & language → Your data: "Export my data" downloads a single JSON file containing everything we hold for your account — profile, holdings and cost basis, sale history, watchlist, alert rules and their history, saved views, seller listings, offers received and preferences. "Delete my account" removes your account and every record attached to it immediately and permanently; it asks for your password and a typed confirmation first, because it cannot be undone. If you have forgotten your password, use "Forgot password?" on the sign-in screen. For corrections, objections, or anything else, contact us via our contact page and we will respond within a reasonable time and in line with the data-protection laws that apply to you (such as the GDPR for users in the EEA and UK). You also have the right to complain to your local data-protection authority.

10. International data transfers

Hoshino and our service providers may process data in more than one country. Where we transfer personal data across borders, we take steps to ensure it receives a level of protection consistent with this policy and applicable law.

11. Children's privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16 (or the age of majority where you live). If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service and the law evolve. When we do, we will change the "Last updated" date above, and for material changes we will provide a more prominent notice — for example, in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

Questions, requests or complaints about privacy? Reach us through our contact page and we will get back to you.

This policy is provided for transparency and is not legal advice.