Privacy Policy
Last updated: June 3, 2026
1. Who we are
This is the privacy policy for Card Bullpen (“Card Bullpen,” “we,” “us,” or “our”) and the website at https://www.cardbullpen.com (the “Site”). Card Bullpen is operated by Card Bullpen, based in the United States.
Card Bullpen is a sports-card collection app — “the front office for your card collection” — that is in active development and has not yet launched (we’re aiming for 2026). Right now this Site is purely informational, plus a launch waitlist. There are no accounts, no logins, no purchases, and no app to use yet.
We keep this simple and honest, because that’s how we’re building the product. We collect very little, and we’ll tell you exactly what and why. Questions about this policy or your data? Email [email protected].
2. What we collect, and why
Here is everything we collect through this Site. There is nothing else.
a) Your email address — if you join the waitlist
If you enter your email into the waitlist form, we collect that email address for one reason: to let you know when Card Bullpen launches.
- What we collect: the email address you type in, plus a note of which page you submitted it from.
- Why: to notify you at launch.
- Legal basis: your consent — you choose to give us your email by submitting the form.
- What we don’t do: we don’t sell it, rent it, add you to unrelated marketing lists, or share it beyond the form provider below.
The waitlist form is handled by Formspree (formspree.io), a third-party form service that receives your submission, stores it, and forwards it to us by email. See their privacy terms (§4).
b) Analytics — only if you say yes
We’d like to understand how people use the Site so we can make it better. We use two analytics tools that work differently on purpose:
- Google Analytics 4 (GA4). We don’t load GA4 at all unless you turn it on. Only after you accept analytics in our cookie banner does GA4 load and begin collecting usage data (pages viewed, referrer, device/browser type, and a coarse, approximate location from your IP) and set its cookies. If you decline or ignore the banner, GA4 never loads — no cookies are set, and nothing is sent to Google. (We use Google Consent Mode v2, which keeps analytics denied by default.)
- Cloudflare Web Analytics. Privacy-first and cookieless — aggregate counts (page views, referrers, basic performance) with no cookies, no cross-site tracking, no fingerprinting, and no profile of you. Because it stores nothing on your device, it runs without a consent prompt.
c) Server logs and security
The Site is hosted on Cloudflare Pages. As part of hosting, security, and content delivery, Cloudflare processes standard request information — your IP address, browser/user-agent, and timestamps — to serve pages, protect against attacks, and keep the Site available.
3. Cookies & analytics
The only cookies this Site sets are Google Analytics cookies — and only if you accept them. We have no advertising or marketing cookies. Cloudflare Web Analytics sets no cookies at all.
- On your first visit you’ll see a cookie banner. Until you choose, analytics cookies are blocked — we use Google Consent Mode v2 with analytics storage denied by default (ad-related storage stays denied too; we run no ads).
- Click Accept analytics and GA4 loads and may set its cookies.
- Click No thanks, or ignore the banner, and GA4 never loads — no cookies, and nothing is sent to Google.
- Your choice is remembered so we don’t ask again on every page.
Changing your mind. Use the “Cookie settings” link in the footer to re-open the banner, or clear the Google Analytics cookies and use your browser’s privacy controls. Withdrawing consent stops GA4 going forward.
4. Third parties we rely on
| Provider | What it does for us |
|---|---|
| Google (Analytics 4) | Usage analytics — only after you consent |
| Cloudflare | Hosting (Pages) + cookieless Web Analytics + security |
| Formspree | Receives, stores, and forwards the waitlist form |
Each provider has its own privacy terms governing how it handles data. We do not sell your personal information to anyone (see §6).
These providers are based in the United States, so joining the waitlist or consenting to analytics may involve transferring your data to, and storing it in, the US. If you’re in the EEA or UK, those transfers rely on the providers’ own safeguards (such as Standard Contractual Clauses). You can avoid analytics transfers entirely by declining cookies (§3), and you can ask us to delete your waitlist email at any time (§6).
5. How long we keep things
- Waitlist emails: kept until launch and for a reasonable period afterward to manage the announcement — or until you ask us to remove it, whichever comes first.
- Analytics data: retained per Google’s and Cloudflare’s default settings for their services.
- Server logs: retained by Cloudflare per its standard practices.
6. Your privacy rights
If you’re on the waitlist and want off, email [email protected] and we’ll delete your email address. You can also withdraw analytics consent at any time (§3).
If you’re in the EU/EEA or UK, you generally have the right to access, rectify, erase, restrict, or object to processing, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority.
If you’re in California, you generally have the right to know, delete, and correct your personal information, and to opt out of its “sale” or “sharing” — though Card Bullpen does not sell or share your personal information as those terms are defined under California law — without being discriminated against for exercising your rights.
To exercise any right, email [email protected]. We may need to confirm your identity (for example, that you control the email in question) before acting on a request.
7. Children
Card Bullpen is not directed at children, and we don’t knowingly collect personal data from children under 13 (or under 16 where a higher age applies, such as in parts of the EU). If you believe a child has given us their information, email [email protected] and we’ll delete it.
8. Contact us
Questions, requests, or concerns about your privacy or this policy: [email protected] — Card Bullpen, United States.
9. Changes to this policy
We may update this policy as the Site changes or as we get closer to launch. When we make changes we’ll update the “Last updated” date above, and for anything significant we’ll do our best to flag it clearly. This policy covers the pre-launch marketing site only — the Card Bullpen app, user accounts, and in-app data don’t exist yet and will get their own, fuller privacy terms when they launch.