Clody is operated by Magna Arc Financial Ltd. ("Clody," "we," "us," or "our"), registered at 700-838 W Hastings Street, Vancouver, BC, Canada, V6C 0A6. This policy explains what personal information we collect through the Clody app, why we collect it, who we share it with, and the choices you have. It's written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, BC's Personal Information Protection Act (PIPA).
Account information: your email address and password (password is never visible to us — Supabase, our authentication provider, stores it in hashed form).
Business and transaction data you enter: team/event names, event locations (as free text you type — we do not collect device GPS location), inventory records (card names, sets, prices, condition, quantities), sale/purchase transactions, and expenses. This is the core data you use Clody to manage, and it's yours — see "Your content and data" in our Terms of Service.
Photos you upload: card and cash photos you take or choose within the app, used to populate your ledger via our AI-assisted recognition features (see below), and reference photos you submit for card verification.
Storefront and buyer messages: if you're a dealer, the storefront settings you choose (store name, page URL, which portfolio is shown) and the cards in that portfolio are shown publicly. If you're a buyer, we collect the questions you send to a storefront's AI concierge and any direct messages exchanged with a dealer once a conversation is handed off, along with which card the conversation is about — see "Storefront and buyer messaging" below.
Payment information: if you subscribe to Clody Pro, your payment is handled entirely by Stripe, Inc. on their own hosted checkout page. We never receive or store your card number — we only receive a Stripe customer/subscription reference and your subscription status.
Technical information: standard web request logs (IP address, browser type, timestamps) collected by our hosting provider for security and reliability purposes, and a locally-stored session token that keeps you signed in.
Clody uses OpenAI's API for several features: recognizing cards and cash amounts from photos you capture, mapping columns when you import an Excel/CSV file, generating optional AI daily summaries, assisting with card authenticity checks, and answering buyer questions on a dealer's public storefront. Using these features sends the relevant photo or data to OpenAI for processing. We do not use your business data to train our own models, and we only send what's needed for the specific feature you're using (e.g. a card photo, not your full transaction history; for the storefront concierge, the dealer's listed inventory and the buyer's question, not either party's account details).
These features are assistive tools, not guarantees — see the AI disclaimer in our Terms of Service.
A dealer's storefront page — its store name, page URL, and the cards in the portfolio they've chosen to show — is public. Anyone with the link can view it without a Clody account. A card's cost price is never shown publicly; only the optional price the dealer set for buyers to see.
Signing in is required to ask the storefront's AI concierge a question or to message a dealer directly. A buyer's questions, the AI's answers, and any direct reply between a buyer and dealer are stored and are visible to that dealer's team — they are not private or confidential messages, and Clody's AI provider processes them to generate responses as described above. If a conversation is handed off from the AI to the dealer, we send the dealer (and, once they reply, the buyer) an email notification through Resend, our email delivery provider — the notification itself doesn't include the message content, just a prompt to sign in and read it in the app.
You can create an API key in your Dashboard and give it to an AI assistant outside Clody — Meta's Muse, for example, or any other client that speaks the Model Context Protocol — so it can work with your books on your behalf. This is off unless you turn it on: nothing leaves Clody until you create a key and hand it to an assistant, and no key exists on your account until you make one.
What an assistant holding your key can reach: your own team's books — the cards you hold and what you paid for them, your shows and their takings, your recorded trades and expenses, the people you sell for and what you owe them, your portfolios and your storefront settings. It can also write to them: log a sale, record a purchase, publish a storefront. It can never reach another team's data, your password, or your payment card details.
What happens to that data once it leaves us is not something we control. When an assistant reads your books, what it does with what it reads — how long it keeps it, whether it is used to train a model, who at that company can see it — is governed by that assistant's own privacy policy and its provider's, not by this one. We have no visibility into it. Read the policy of whichever assistant you connect before you connect it, and don't connect one you wouldn't want holding your cost prices.
Photos you send through an assistant reach the same AI provider as photos you take in the app, and are handled as described in "AI-assisted features" above.
What we record: for each call, which tool was asked for, whether it succeeded, the error message if it didn't, and when. We do not record the contents — not amounts, card names, prices, or anything about a buyer; where our database reports an error by quoting the row that caused it, we strip the row out before writing the log. This exists so that when you tell us your assistant isn't working we can tell whether it ever actually asked us. A scheduled job deletes them once they pass 30 days old, and we don't use them for anything else.
Revoking: you can revoke a key in your Dashboard at any time and it stops working on the assistant's next call — there is nothing to wait out. We store only a one-way hash of each key, which means we cannot show it to you again after you create it, and cannot recover it if you lose it; create a new one instead. Revoking a key does not reach back and delete anything the assistant already read and kept — for that, ask its provider.
To provide and operate the Clody service (storing and syncing your ledger, running the AI features you choose to use, processing your subscription), to communicate with you about your account or the service, to maintain security and prevent abuse, and to improve the product. We do not sell your personal information, and we do not use it for third-party advertising.
We share personal information only with the service providers that help us run Clody:
We don't share your information with anyone else, with two exceptions: where you direct us to — if you create an API key and give it to an outside AI assistant, as described in "Connecting an outside AI assistant" above — and where required by law (for example, a valid court order) or to protect the rights, safety, or property of Clody, our users, or the public.
Our primary database and file storage are hosted in Canada. However, some of our service providers — notably OpenAI, and Vercel's edge network — operate infrastructure outside Canada, including in the United States. Personal information processed by these features may therefore be transferred to and processed in other countries, where it may be accessible to that country's courts, law enforcement, and national security authorities under local law. By using Clody, you consent to this transfer.
We use industry-standard safeguards appropriate to the sensitivity of the data: encrypted connections (HTTPS/TLS) between your device and our servers, encryption at rest for data in our database, database access rules that restrict each team's data to that team's members, and access controls on our administrative tools. This includes storefront and buyer messages — they're encrypted in transit and at rest the same way the rest of your data is, but (as explained in "Storefront and buyer messaging" above) they are readable by Clody's systems, since our AI concierge and the dealer's team both need to read them to function; this is not end-to-end encryption. No system is perfectly secure, and we can't guarantee absolute security — if we become aware of a breach affecting your personal information, we'll notify you and the relevant authorities as required by law.
We keep your account and business data for as long as your account is active, so the service keeps working the way you expect. If you close your account, we'll delete your personal information within a reasonable period, except where we're required to retain it for legal, accounting, or fraud-prevention purposes (for example, payment records).
Photos of trades are the one exception. The photo you take at the table when logging a sale or purchase — the one the amount is read from — is deleted a year after that trade took place, once you have confirmed it. The trade itself stays: the item, the amount, the date and which show it belonged to are all part of your books and are kept for as long as your account is. It is only the picture that goes.
Photos of the cards in your inventory are not affected and are kept while the card is, whatever its age — they are what a buyer sees on your storefront. Photos submitted for an authenticity check are kept with that check, since a verdict with no evidence behind it is not a record of anything.
If you want to keep a trade's photo beyond a year, save it from the app before then. We'd rather say so plainly than have you discover it.
You can access, correct, export, or delete your data directly within the app, including closing your account: Dashboard → Delete my account removes your books, inventory, shop and photos immediately, and you do not need to ask us first. For anything else — a copy of your personal information, or a question about how we handle it — email us at bw79814513@gmail.com. We'll respond within a reasonable time and in any case within the timelines required by PIPEDA/PIPA.
If you're not satisfied with how we've handled your personal information, you have the right to complain to the Office of the Privacy Commissioner of Canada or, for BC residents, the Office of the Information and Privacy Commissioner for BC.
Clody is a business tool for card show dealers and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, contact us and we'll delete it.
Clody uses local browser storage (not third-party tracking cookies) to keep you signed in and to mirror your data for offline use. This storage stays on your device and is used only to make the app work.
Our traffic measurement, described above, sets no cookies either. It counts visits to a page; it does not build a profile of you and it cannot see you on anyone else's site.
We may update this policy as the service changes. If we make a material change, we'll let you know in-app before it takes effect. Continued use of Clody after a change takes effect means you accept the updated policy.
Magna Arc Financial Ltd. — 700-838 W Hastings Street, Vancouver, BC, Canada, V6C 0A6
Email: bw79814513@gmail.com