Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how honestlogic.app (“we,” “us,” “the Operator”) handles information across Card Vault, Spelling Bee, Math Flash, and Vehicle Log (together, “the Apps”). The Apps share one account system and one backend, so signing in to any one of them signs you in to all four, and this single policy covers all of them.

Information We Collect

Account information. When you sign in, we collect the email address you provide. We use passwordless “magic link” sign-in — we never see or store a password. Signing in sets a session cookie that is shared across all four Apps' subdomains (*.honestlogic.app) so you don't have to sign in separately to each one.

Content you provide.

• Card Vault: photos of cards you scan, the card details, condition notes, and value/inventory information you enter.
• Spelling Bee and Math Flash: word lists, math decks, and practice results; and, if you use these apps to track a family member's or student's practice, that person's name and grade level. This information is entered and controlled by the account holder — students do not create their own accounts or provide information directly to us. Students access practice sessions on a shared household or classroom device using a login code or QR code the account holder generates; we recognize that device afterward rather than asking the student to sign in themselves.
• Vehicle Log: details about vehicles you add (nickname, make, model, year, and VIN); photos of fuel pump receipts or displays you scan, and the purchase details we read from them (date, total, gallons, and odometer); the gas station's business name and address, which we suggest from your device's location at the moment you log a purchase — you review and can edit that suggestion before saving, and only the approximate coordinates used to generate it are stored with the purchase record, not continuous or background location tracking; and maintenance records (service type, date, odometer, cost, and shop) you enter.

Automatically collected information. We use a small number of functional cookies (your session cookie and a CSRF-protection cookie) required for the Apps to work. We use Vercel Speed Insights to measure page-load performance; it reports aggregate timing data and does not track you across sites or build an advertising profile.

How We Use Information

We use the information above to operate the Apps: to sign you in, to display and organize the content you've entered, to generate images/audio for practice words, to identify and estimate the value of scanned cards, to read pump/receipt photos and suggest a station address when you log a fuel purchase in Vehicle Log, and to send you the emails described below. We do not sell your information or use it for advertising.

Third Parties We Share Information With

We use a small number of service providers to operate the Apps. Each acts on our behalf under its own terms and only receives what it needs to do its job:

• Supabase — hosts our database, file storage, and authentication (magic-link email delivery). All content described above is stored here.
• Vercel — hosts the Apps and provides the performance-monitoring feature described above.
• Anthropic (Claude) — Card Vault sends a photo of a scanned card to Anthropic's API to identify the card and estimate condition/value; Vehicle Log sends a photo of a fuel pump receipt or display to read the total, gallons, and other purchase details. Anthropic processes this per its own API terms and does not use it to train models by default.
• TheCardAPI and CardHedger — Card Vault queries these market-data providers with a card's name/description (not your photo) to look up comparable sold prices, when their API keys are configured.
• OpenAI — Spelling Bee sends the text of a practice word (not any personal information) to OpenAI to generate a picture and a spoken pronunciation for that word, cached and reused afterward.
• Google Maps Platform — Vehicle Log sends your device's approximate coordinates (never a photo or other personal information) to Google's Geocoding API to suggest the gas station's address when you log a fuel purchase; you review and can edit the suggestion before it's saved.
• Resend — Spelling Bee and Math Flash use Resend to deliver sign-in emails and, if enabled, the “your student finished practicing” summary email to the account holder's own email address.

We do not share your information with anyone else, and we do not sell it.

Children's Privacy

All four Apps are intended to be used by an adult account holder — a parent, guardian, or teacher. We do not knowingly collect personal information directly from children; any student name or grade level in Spelling Bee or Math Flash is entered and managed by the account holder for their own household or classroom use, and students access those apps only through a device the account holder has already set up, not by creating an account or providing information to us themselves. If you are an account holder, you are responsible for determining whether entering a student's information is appropriate and for any consent that requires. You can remove a student's profile, and the data associated with it, from within the Apps at any time.

Your Choices and Rights

You can review, edit, or delete your cards, word lists, math decks, student profiles, vehicles, fuel purchases, and maintenance records directly within the Apps. Deleting your account removes your profile and the content tied to it from our database. To request a copy of your data, ask us to delete your account entirely, or ask any other question about this policy, contact us at the address below.

Data Retention

We keep your information for as long as your account is active. If you delete a student profile, a word list, a card, a vehicle, a fuel purchase, a maintenance record, or your entire account, the associated data is removed from our active database (backups may persist for a limited period before they are cycled out).

Security

We rely on our providers' security controls (Supabase, Vercel) and standard practices — encrypted connections (HTTPS), row-level database security scoping data to its owner, and CSRF protection on requests that change data. No method of storing or transmitting data is completely secure, and we can't guarantee absolute security.

Changes to This Policy

If we make a material change to this policy, we'll update the “Last updated” date above. Continued use of the Apps after a change means you accept the updated policy.

Contact Us

Questions about this policy or your information? Email hello@honestlogic.app.