Kashudo Privacy Policy

Last updated: April 28, 2026

This Privacy Policy explains how Nine Lives LLC, a Texas limited liability company doing business as Kashudo ("Kashudo," "Nine Lives," "we," "us," or "our"), collects, uses, shares, and protects information when you use Kashudo, including our mobile application, websites, pack-opening features, portfolio tools, marketplace browsing, account balance features, shipping flows, and related services (collectively, the "Services").

If you have questions, contact us at support@ninelives.cc.

1. Information We Collect

We collect information you provide, information generated by your use of the Services, and information received from service providers.

Account Information

We may collect and store:

• account identifiers, such as your user ID;
• email address;
• username;
• authentication status and session information;
• avatar URL, if supported; and
• support messages or other communications you send us.

Authentication is handled through Supabase and related authentication services.

Phone, Eligibility, and Compliance Information

For pack access, shipping, withdrawals, fraud prevention, and compliance, we may collect and store:

• U.S. phone number;
• phone verification status and timestamp;
• pack-location country and verification timestamp;
• approximate device location information used to verify U.S. pack eligibility, including latitude and longitude submitted during the pack-opening flow;
• identity verification status, provider, session or verification IDs, verification URL, start time, and completion time;
• compliance flags, risk signals, provider status updates, and audit information; and
• information needed to enforce age, location, fraud, payment, and shipping rules.

Identity verification for shipments is handled by Stripe Identity. We do not intend to store full government ID images or full identity documents ourselves. However, Kashudo may store Stripe Identity verification status, IDs, timestamps, and webhook or status payloads needed to confirm and audit verification.

Payment, Balance, and Withdrawal Information

Deposits and payment processing are handled by Stripe. Withdrawals and payout setup are handled through Stripe Connect and related Stripe services.

We may collect and store:

• deposit, balance, credit, transaction, refund, sell-back, shipping-charge, and withdrawal records;
• Stripe payment intent IDs;
• Stripe connected account IDs;
• Stripe transfer IDs;
• payout status and account readiness information;
• bank name and last four digits where returned by Stripe during payout setup;
• daily withdrawal-limit and idempotency information; and
• Stripe webhook status updates.

We do not intend to store full card numbers, full bank account numbers, or full payment credentials. Those are handled by Stripe and/or your device's payment interfaces.

Shipping Information

Shipping details are optional unless you request shipment or use a feature that requires shipment.

The app may store shipping details locally on your device so you can reuse them. When you request a quote, shipment, or marketplace purchase that requires fulfillment, Kashudo sends the shipping details to our server and to CardTrader/CardTrader Zero or other applicable fulfillment providers.

Kashudo may store a verified shipping address after a shipment request, including name, street address, city, state, ZIP code, country, and phone number. We may also store shipment-related records such as CardTrader order IDs, order codes, order status, shipping charges, and fulfillment metadata.

Pack, Card, Portfolio, and Marketplace Information

We may collect and store:

• pack purchases, pack tiers, pull history, reveal results, decision deadlines, sell-back decisions, auto sell-back status, shipment choices, and refund/credit records;
• cards in your Kashudo binder or portfolio;
• uploaded, scanned, or manually entered card details;
• card metadata, grade, grading company, card images or image URLs, set information, rarity, language, card number, and source;
• collection progress, reward claims, display order, filters, and other portfolio interactions;
• marketplace search queries, browsed listings, listing IDs, prices, images, and purchase records; and
• recent searches or preferences stored locally on your device.

If you use card scanning, your selected image may be processed by our server and OpenAI to identify the card. The app currently sends the image data to our backend for identification and does not need to permanently store the photo unless a specific upload or storage feature is used. The resulting card information may be stored in your portfolio if you save it.

Device, Usage, and Technical Information

We may collect:

• device and app information;
• IP address and approximate network information;
• logs, request metadata, API responses, error messages, crash or diagnostic information;
• timestamps and feature usage events;
• fraud, abuse, security, and performance signals; and
• information from cookies, SDKs, local storage, secure storage, or similar technologies, where applicable.

2. How We Use Information

We use information to:

• provide, operate, and improve the Services;
• create and manage accounts;
• authenticate users and maintain sessions;
• verify eligibility for pack access, shipping, and withdrawals;
• process deposits, balances, pack purchases, sell-backs, credits, refunds, shipping charges, and withdrawals;
• identify cards from scans and help users manage portfolios;
• show card, pack, collection, marketplace, and price information;
• request quotes and process shipments through CardTrader/CardTrader Zero;
• prevent fraud, chargeback abuse, bot activity, unauthorized access, and violations of our Terms;
• comply with law, payment-network rules, sanctions, tax, accounting, and recordkeeping obligations;
• provide support and respond to requests;
• debug, secure, monitor, and improve the Services; and
• enforce our Terms and other policies.

3. How We Share Information

We share information with service providers and third parties as needed to operate the Services.

Service Providers

We may share information with:

• Supabase, for authentication, database, storage, and backend infrastructure;
• Stripe and Stripe Connect, for deposits, payment processing, payout setup, withdrawals, financial connections, fraud controls, and payment compliance;
• Stripe Identity, for shipment identity verification;
• CardTrader/CardTrader Zero, for card pricing, availability, purchase, fulfillment, quality-check, shipping, and order-status functions;
• OpenAI, for card-image identification and related AI processing;
• Pokemon TCG API and similar data providers, for card identification and card metadata;
• hosting, logging, analytics, monitoring, security, customer-support, and communications providers; and
• professional advisors, auditors, insurers, lawyers, and accountants.

These providers process information according to their own terms and privacy policies as well as our instructions where applicable. Where Apple App Review rules require it, we require third-party service providers to provide the same or equal protection for user data as described in this Privacy Policy and in the App Store Review Guidelines.

Legal, Safety, and Business Reasons

We may share information if we believe it is necessary to:

• comply with law, subpoenas, court orders, legal process, or government requests;
• enforce our Terms or protect our rights, users, systems, or property;
• investigate fraud, abuse, security incidents, chargebacks, or illegal activity;
• complete a merger, financing, acquisition, reorganization, sale of assets, bankruptcy, or similar business transaction; or
• protect the safety of users, Kashudo, service providers, or the public.

Public or User-Directed Sharing

Some information may be visible to other users if we add social, leaderboard, recent-pull, collection, marketplace, or sharing features. We will use the display settings and feature behavior in the app to determine what is shared. Do not add information to your profile or portfolio that you do not want processed by Kashudo.

4. Third-Party Services

Kashudo relies on third-party services. Your use of certain features may also be governed by those providers' terms and privacy policies.

Important third-party services include:

• CardTrader: https://www.cardtrader.com
• Stripe: https://stripe.com/privacy
• Supabase: https://supabase.com/privacy
• Stripe Identity: https://stripe.com/identity
• OpenAI: https://openai.com/policies/privacy-policy

We do not control these third parties' privacy practices. You should review their policies.

5. Location Information

Pack features are currently limited to eligible U.S. users. When you attempt to open a pack, the app may request foreground location permission and send location data, including latitude, longitude, accuracy, country, and capture time, to verify U.S. eligibility.

We use this information for eligibility, compliance, fraud prevention, and audit purposes. If you do not grant location permission, you may not be able to use pack features.

6. Card Scans and Photos

If you use the card-scanning feature, the app may access your camera or photo library with your permission. The selected image may be converted to image data and sent to our backend and to OpenAI for identification. We may also query card-data providers to match the card.

Kashudo stores the resulting card record only if you save it to your portfolio. The app may use third-party card images or metadata for portfolio display. If a future feature stores uploaded photos, those photos may be stored with Supabase or another storage provider.

7. Data Retention

We keep information for as long as reasonably necessary to provide the Services, comply with legal and accounting obligations, resolve disputes, prevent fraud, enforce agreements, support audits, and maintain business records.

Retention periods may vary by data type. For example, transaction, payment, withdrawal, tax, compliance, identity-verification status, pack, sell-back, shipment, and support records may be kept longer than ordinary portfolio preferences.

You may request deletion of your account or certain information through any in-app account deletion flow we make available or by contacting support@ninelives.cc. Account deletion is intended to delete your account record and associated personal information that we are not legally or operationally required to retain. We may retain information where required or permitted by law, including records needed for fraud prevention, compliance, dispute resolution, payments, withdrawals, accounting, taxes, shipments, chargebacks, audits, or legal claims.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. For example, authentication sessions may be stored in secure device storage where available, and sensitive payment and payout details are handled by Stripe.

No system is perfectly secure. We cannot guarantee that information will never be accessed, disclosed, altered, or destroyed.

9. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict certain personal information. You may also have the right to appeal a denied request or lodge a complaint with a regulator.

You can make a privacy request by contacting support@ninelives.cc. We may need to verify your identity before fulfilling a request.

You can also:

• decline optional camera, photo library, or location permissions, though some features may not work;
• revoke app permissions through your device settings;
• edit or remove local shipping details on your device where the app supports it;
• update account information where available;
• choose not to save scanned cards to your portfolio; and
• stop using pack, shipping, withdrawal, or portfolio features.

10. Children and Minors

The Services are not intended for children under 16. Users must be at least 16 to use non-pack features and at least 18 to use pack features. We do not knowingly collect personal information from children under 16. If you believe a child under 16 provided information to us, contact support@ninelives.cc.

11. International Users

Kashudo may be accessed from outside the United States, but certain features, including packs and shipments, may be U.S.-only. If you use the Services from outside the United States, your information may be processed in the United States and other countries where we or our service providers operate. These countries may have privacy laws different from those in your location.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective when posted, made available in the app, or otherwise communicated, unless a later date is stated. Your continued use of the Services after an update means you acknowledge the updated policy.

13. Contact

Nine Lives LLC

Email: support@ninelives.cc