This Privacy Policy explains how The North Cop Inc. (“we”, “us”) collects, uses, stores, and shares information when you use TheNorthCop — the website, companion iOS and Android apps, Vault, the marketplace, Cart Catcher, and related features (together, the “Services”).
We do not sell your personal information, and we do not use it for third-party advertising.
1. Information we collect
- Account information. Email address, username, display name, a password stored only as a hash, profile avatar, and settings such as notification preferences and Vault display currency.
- Discord information. If you sign in with Discord or link it, we receive your Discord user ID, username, handle, and avatar. We check whether you are a member of our Discord server to grant or remove access. On marketplace listings we may also show the date you joined that server, when Discord provides it.
- Content you submit. Messages and images, stock reports (store, notes, and optional photos), vault entries (including purchase prices, private notes, and pregrade photos), bug reports, marketplace listings, reviews, and reports, plus the time you accepted the marketplace terms.
- Location. If you allow it, the app uses your device location while you are using nearby stock reports. Stock watches you create can store a latitude and longitude so we can alert you. We do not track your location in the background for advertising. Store addresses on stock reports may be converted to map coordinates.
- Device and push data. An Apple Push Notification service token or a Firebase Cloud Messaging token, so we can deliver alerts you turn on, and basic app or browser details needed to send them.
- Security and technical data. IP address, and similar request data, used to operate, secure, and rate-limit the Services. When you accept the marketplace terms we store the IP address with that acceptance. Sign-in sessions are kept in a cookie on your browser.
2. How we use information
- Create and secure your account, including email verification and password reset
- Confirm Discord membership and decide what you can open
- Run community features, channel mirrors, drops, the stock map, Vault, the marketplace, and Cart Catcher
- Send the alerts and account emails you trigger
- Prevent abuse, enforce these rules, and keep the Services reliable
- Respond to support requests and fix bugs you report
3. How we store it
Account records, messages, images, vault entries, marketplace activity, and similar content are stored in our application database, hosted with our infrastructure provider. Live updates between the Discord relay and the website pass through a short-lived cache. That cache is not a separate profile of you.
- Passwords, email verification codes, password-reset codes, and mobile refresh tokens are stored as hashes. We cannot read your password back.
- The website sign-in cookie is HTTP-only. On the public site it is only sent over HTTPS. It can last up to 400 days and is refreshed while you keep using the site. Leaving the Discord server is what ends Discord-gated access, not that timer by itself.
- Photos you upload (avatars, message images, stock photos, pregrade scans) are stored with your account so the feature can show them.
- Marketplace terms acceptance records keep the version you agreed to, the time, and the IP address.
We keep this information while your account is active and as needed to operate the Services, resolve disputes, and meet legal obligations. Standard member accounts can be deleted from the companion app. Owner and admin accounts cannot be deleted from the app; contact us instead. Some records, including backups and marketplace moderation logs, may remain for a limited time after deletion.
4. Third parties
We share information with service providers only so they can perform a function for us. They are not allowed to use it for their own advertising.
- Discord. Sign-in, membership checks, avatars, and the channel content our bot mirrors from the server. Activity such as a new stock report or marketplace post may also be sent to a Discord channel we operate.
- SendGrid. Your email address and the message itself, for verification codes, password resets, and similar account email.
- Cloudflare Turnstile. A bot check on sign-in, registration, and some recovery forms. Turnstile may receive your IP address and browser signals. We do not use it for advertising.
- Apple Push Notification service and Google Firebase Cloud Messaging. Device tokens and the alert payload, so a notification you enabled can reach your phone.
- Scrydex. Card catalog and price lookups. If you use Vault Vision, the photo you submit is sent to Scrydex to identify the card. We do not send your account email with that photo.
- OpenStreetMap Nominatim. Store addresses from stock reports are sent so we can place them on the map. We cache the coordinates. Your device GPS is not sent to Nominatim.
- Frankfurter. Published USD exchange rates for Vault display. No personal information is sent.
- Hosting. The Services run on Heroku, including the database and the live-update cache. Those systems process the data described above in order to serve the site.
Other members can see what you post in shared spaces. A public vault page, which is off until you turn it on, can show your username or display name and the cards in that vault, including estimated market values. Purchase prices, private notes, and pregrade photos are not meant for that public page.
We may also disclose information if the law requires it, or to protect the rights, safety, and integrity of TheNorthCop, our members, or the public.
5. Cookies
We use a session cookie and a remember-me cookie to keep you signed in, and a token to protect forms against cross-site requests. Cloudflare Turnstile may set its own cookie while it checks that a visitor is a person. We do not set advertising or analytics cookies for tracking you across other websites.
6. Device permissions
- Location — nearby stock reports, and coordinates you save on a stock watch
- Camera and photos — vault photos, pregrade scans, and stock-report photos
- Notifications — channel, keyword, drop, and related alerts
You can deny or later revoke these in your device settings. Some features will not work without them.
7. Security
We use measures appropriate to the data: encrypted transport (HTTPS) on the public site, hashed passwords and reset codes, access controls, and hashed mobile refresh tokens. No method of transmission or storage is completely secure.
8. Children’s privacy
The Services are for community members who meet our access requirements. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take steps to remove it.
9. Your choices
- Update your profile, password, and notification settings on the website or in the app
- Turn off public vault sharing at any time
- Revoke device permissions in system settings, and remove a push device by signing out
- Refuse a connected-app request
- Delete a standard member account from the companion app, or email us to ask for deletion or a copy of your account information
10. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the Services after an update means you accept the revised policy.
11. Contact
Questions about this policy or your data:
feedback@thenorthcop.dev
help@thenorthcop.com