Privacy Policy
This policy explains what data Gralyx collects when you create an account and track a collection, how that data is used, where it is stored, and the choices you have. It applies to the gralyx.com website and the account and collection features within it.
We collect
- Your registration email address — used to identify your account and let you sign in.
- A password hash — your password is never stored in plain text. We store only a salted hash produced with the PBKDF2 algorithm.
- A session cookie — a single cookie that keeps you signed in during your visit.
- Collection entries you add — the cards you choose to track in your collection, so we can display your collection value.
We do NOT collect
- No advertising trackers or advertising identifiers.
- No third-party analytics or tracking scripts.
- No official card artwork or images — Gralyx is a text-and-data-only site and displays no copyrighted card imagery.
How we use your data
Your data is used solely to operate the service you signed up for: to authenticate your sign-in, to store the cards you track, and to calculate and display your collection’s market value. We do not use your data for advertising, profiling, or any purpose unrelated to these core features.
Where your data is stored
Account and collection data is stored in a SQLite database on our server located in Hong Kong. Access is restricted to the operation of the service.
Sharing
We do not sell your data and we do not share it with third parties for their own marketing. Subscription payments are processed by Creem, our merchant of record; when you subscribe, your payment and card details are handled by Creem and do not pass through our servers. We may disclose data only where required by applicable law.
Retention & deletion
Your account and collection data is retained for as long as your account is active. You may request deletion of your account at any time by emailing support@gralyx.com. Upon a verified deletion request, we will remove your account and associated collection data within 30 days.
Cookies
Gralyx uses only a single session cookie required to keep you signed in. We do not set advertising, tracking, or third-party cookies.
Children
Gralyx is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will remove it.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date below and post the changes on this page. Continued use of the service after an update constitutes acceptance of the revised policy.
Contact
For any privacy question, or to request access to or deletion of your data, contact us at support@gralyx.com.
Last updated: 2026-10-14