Privacy Policy

Last updated: April 2026

1. What Data We Collect

• Account information: email address, username, and hashed password
• PSA certificate numbers you add to your watchlist
• Payment information processed securely by Stripe (we never store card numbers)
• IP addresses and browser metadata from server access logs
• Session cookies required for authentication
• Notification channel identifiers: Discord webhook URLs, Telegram chat IDs

2. How We Use Your Data

• Certificate tracking: monitoring PSA population reports for certs on your watchlist
• Alert delivery: sending notifications via your configured channels (email, Discord, Telegram)
• Billing: processing subscription payments through Stripe
• Service improvement: aggregate, anonymized analytics to improve reliability

3. Third-Party Services

We share data with the following third parties only as necessary to operate the service:

• Stripe — payment processing (PCI-compliant)
• PSA (psacard.com) — certificate population data lookups
• Cloudflare Turnstile — bot protection on public forms
• Google OAuth — optional social login (only if you choose to sign in with Google)
• Discord / Telegram — alert delivery to your configured channels

4. Data Retention

• Account data is retained until you request deletion
• Population snapshots are retained indefinitely for historical analysis (they contain no personal data)
• Server logs are rotated and purged after 90 days

5. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your account and associated personal data
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format

To exercise any of these rights, email us at alerts@slabalert.app.

6. Cookies

• Session cookie: required for login (httponly, secure)
• CSRF cookie: required for form security
• Cloudflare Turnstile: bot-detection cookie on public forms
• Theme preference: stored in localStorage (not a cookie)

We do not use advertising or third-party tracking cookies.

7. Contact

For privacy-related inquiries: alerts@slabalert.app

8. Disclaimer

slabalert.app is not affiliated with, endorsed by, or connected to Professional Sports Authenticator (PSA), Collectors Universe, or any grading company. PSA is a registered trademark of Collectors Universe Holdings, Inc.