This policy covers the Strata connector website and API at stratatcg.com/connector. The Strata app privacy policy covers the mobile app separately.
Account and key information
We use your email and verified sign-in identity to maintain the connector account. Supabase processes authentication and authentication email. Apple or Google processes the corresponding sign-in. Connector keys are shown once and stored as hashes; we keep their labels, account association, creation and expiry time, and revocation state. Keys expire after 90 days or when revoked. Essential secure cookies maintain browser sessions.
Registered agents can connect with OAuth. We retain the permitted scopes, account and client association, environment, creation/expiry times, and revocation state. Access tokens expire after 15 minutes; rotating refresh-token families expire after 90 days. Tokens are stored as hashes. Authorization codes work once and expire after two minutes. You can revoke each agent connection independently in your dashboard. Account information remains while your account is open, which may be longer than 12 months; deletion requests follow the process below.
Lookups and providers
The API receives the card text, identifiers, selected markets, and request metadata you send. It does not accept photos for recognition. An agent may read a photo and send identifying text. Lookups may be sent to catalog, search, and pricing providers to answer your request. Typesafe’s AI model may receive the submitted card description, candidate catalog records, and search evidence to help identify the card. That identification payload does not include your account email, billing records, passwords or API credentials; personal details included in your submitted description could nevertheless be forwarded. Do not include private messages, personal details, photos, or credentials in lookup text.
Usage, diagnostics and registry evidence
We record account usage for billing and abuse protection. Structured lookup records are retained for 30 days and may include an account reference, query, result, resolution method, request ID, and timing. Recognizable credentials are redacted; passwords, API keys, authorization headers and card photos are not included. Private operations summaries may be sent to our Strata Discord channel for service support. Discord applies its own retention practices.
When a lookup or correction helps resolve a shared card identity, we may retain the relevant phrase or provider references, catalog identifiers, printing/language selectors, and the evidence and decision needed to operate, explain, and correct the shorthand or raw-to-graded registry. The daily review agent can inspect bounded, relevant evidence to propose decisions. It does not receive card photos, account passwords, payment-card details, or private collection records. Decisions are audited and can be corrected. Customer identity is kept separate from public catalog mappings.
A private operations dashboard retains limited request metadata and estimated service costs for up to 31 days. Business analytics retain account-linked daily usage aggregates and financial/registry snapshots for up to 24 months, plus minimal connection and activation dates while the account is open. These contain counts and outcomes, not lookup text, card identities, emails, IP addresses, API credentials, or payment-card details. Aggregate business reports exclude account identifiers. Our website records page-load and successful setup-copy counts without analytics cookies or persistent visitor identifiers; these optional browser events respect Do Not Track and Global Privacy Control. Lookup text is not visible to other customers. Hosting, database, authentication, cache, payment and upstream providers process data as needed to operate the service.
Billing
Stripe processes hosted subscription checkout and billing-portal actions when paid plans are active. Strata stores the account's Stripe customer and subscription references, plan, credit periods, usage ledger, and webhook event identifiers needed to grant credits and support billing. Payment card details are entered in Stripe's hosted flow; they are not stored in Strata's lookup database.
Agent billing review records contain the requested action, quote, environment, account association, status and an optional short job reference. These review records expire after seven days. Financial ledger and plan-change records have separate retention for payment reconciliation, disputes, security and applicable obligations; they do not contain payment card numbers or CVC. Sandbox billing uses test subscriptions and separate credits with the same account identity.
Your choices and contact
You can revoke API keys or agent connections and sign out in the dashboard. Revoking credentials stops their future access; it does not cancel billing or erase historical records. To request access to or deletion of account data, contact tony@stratatcg.com. We verify ownership before handling account changes. We may retain minimum financial, security, and non-personal registry records as needed to keep the service correct, prevent abuse, resolve disputes, or comply with law. Provider backups and operational logs may expire on their own schedules. Shared registry card facts are maintained separately from customer identity.
Strata TCG is operated by Tony Sheng. This page will be updated when connector data practices change.