Privacy Policy

This Privacy Policy explains what information Hawaii Supply Co. collects, how we use it, who we share it with, and the choices you have. It applies to the Hawaii Supply Co. iPhone app, the Hawaii Supply Co. web app, our website at app.hawaiisupplyco.com, and the related services we provide (together, the “Service”).

1. Who we are

Hawaii Supply Co. is a trade name of Cabinkrue LLC, a limited liability company organized in the State of Hawaii, USA (“Hawaii Supply Co.,” “we,” “us” or “our”). We are responsible for the personal information described in this policy. The Service is built for trading-card vendors who run a business (“you”). You can reach us using the details in the Contact us section.

2. Information we collect

Information you give us

Account details. Your email address and password. We store your password only as a salted, one-way hash (PBKDF2), so we cannot read it.
Sign in with Apple. If you sign in with Apple, we receive a unique Apple user identifier and, if you choose to share it, your email address. Apple may give us a private relay address instead of your real one.
Your business data. While you are logged in, the app automatically backs up your data to your account so you can restore it on a new or replacement phone and use the same data in the web app. This includes your inventory, costs, prices, deals and trades (including any customer names or notes you type), shows, cash box entries, expenses, and app settings. We keep the most recent backup only.
Referral and invite details. Your referral code, who invited you (if anyone), any invite code you used, and whether a referral credit has been issued.
Messages to us. If you email us, we keep the message and your email address so we can help you.

Information created when you use the Service

Subscription details. Your plan (Founder or standard), trial dates, subscription status, and the customer and subscription identifiers our payment processor assigns to you.
Login sessions. When you log in, we issue a session token that expires after 90 days. Our server stores only a hashed version of it.
Technical information. When the app or website connects to our server, our hosting provider processes standard technical information such as your IP address, device or browser type, and the time of the request. We use it to deliver the Service, prevent abuse, and fix errors, and keep it only in short-lived server logs.

Information we do not collect

Payment card details. You enter these on Stripe’s secure pages, and Stripe stores them.
Face ID or other biometric data. Face ID is handled by Apple on your device; the app only learns whether the check passed.
Your location, contacts, or advertising identifiers.

3. Information about your customers

You may choose to record details about the people you buy from, sell to, or trade with, such as a name or a note on a deal. We store that information only as part of your backup and use it only to provide the Service to you. We never contact your customers or use their information for our own purposes.

You are responsible for having a lawful basis to record your customers’ information and for meeting any privacy obligations you owe them. Card shows often include young collectors, so we recommend recording only the customer details you actually need and avoiding personal details about minors.

4. How we use information

To create and secure your account, log you in, and reset your password.
To back up and restore your business data across your devices.
To look up current market prices for the cards you search for.
To run free trials, subscriptions, Founder pricing, invite codes, and referral credits.
To send account emails, such as password reset codes, billing notices, and important changes to the Service or this policy.
To answer your questions and provide support.
To detect, prevent, and investigate fraud, abuse, and security problems.
To comply with the law and enforce our Terms of Service.

We do not use your business data for marketing, and we do not use it to train AI models. We only email you about your account. If we ever send product news, every message will include a way to unsubscribe.

We use a small number of service providers to run the Service. Each receives only the information it needs to do its job for us.

Cloudflare hosts our website, server, and database, where your account and backup are stored.
Stripe processes subscription payments and runs the billing page where you manage or cancel your subscription. Stripe receives your email address and the payment details you enter on its pages.
Apple provides Sign in with Apple and distributes the app.
Resend delivers our account emails, such as password reset codes. It receives your email address and the message content.
JustTCG supplies market price data. When you look up a price, we send card details such as the game, card name, set, number, and condition. We do not send personal information.
Anthropic will power card photo scanning, a feature that is coming soon. When you use it, the photo you take is sent to Anthropic solely to identify the card. Under its commercial terms, Anthropic does not use this data to train its models.

We may also share information when the law requires it, to protect the rights, safety, or property of our users, the public, or us, or as part of a merger, acquisition, or sale of our business, in which case this policy will continue to apply to your information. We will share information for any other purpose only with your consent.

We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.

6. Cookies and similar technologies

Our website does not use advertising cookies, analytics, or third-party tracking scripts. It uses your browser’s local storage for one purpose: to keep you logged in. Logging out removes it. The web app also keeps your business data in your browser’s storage, so it works like the iPhone app and syncs with your account; when you log out, it is removed from that browser once everything is saved to your account. While you move between our sign-up and log-in pages, it may also keep an invite code, or the email you typed, in your browser’s session storage so you don’t have to type it again. Your browser clears that when you close the tab.

The website loads fonts from Google Fonts, so your browser connects to Google’s servers, which receive your IP address as part of that request. When you subscribe or manage billing, you are taken to pages run by Stripe, which may use cookies for security and fraud prevention under its own privacy policy.

The app contains no advertising or third-party analytics software.

7. How long we keep information

Account and backup data are kept for as long as your account exists. Each new backup replaces the previous one.
Password reset codes are stored only as a hash and expire after 15 minutes.
Server logs are kept for a short period and then deleted automatically.
Deleted accounts. When you delete your account, we immediately remove your account, cloud backup, login sessions, and referral records from our database. Copies may remain in our hosting provider’s encrypted backups for a limited period (typically no more than 30 days) until they are overwritten.
Billing records are kept by Stripe for as long as tax, accounting, and other laws require, even after you delete your account.
Data on your phone stays on your device until you delete it or remove the app. Deleting your account does not erase it.

8. Your choices and rights

See and export your data. Your data is always visible in the app, and you can export your inventory and show reports as spreadsheet files.
Correct your data. You can edit your data in the app at any time.
Delete your account. On the website, go to Your account > Delete account, or in the app go to Settings > Your account > Delete account, or contact us. This permanently deletes your account and cloud backup. If you have a paid subscription, cancel it first under Manage subscription; if you have already deleted your account, contact us and we will cancel it for you.
Emails. Account emails are part of the Service and cannot be turned off while your account is open.

State privacy rights. Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of certain profiling. We do not sell personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects.

To make a request, contact us from the email address on your account. We may need to verify your identity before acting on it. You may also use an authorized agent where the law allows. We will respond within the time the law requires, and we will not treat you differently for exercising your rights. If we decline your request, you may appeal by replying to our decision, and if you are still not satisfied, you may contact your state attorney general.

9. How we protect information

All connections between the app, the website, and our server are encrypted (HTTPS).
Passwords are stored only as salted PBKDF2 hashes. Session tokens and password reset codes are stored only as hashes.
Password reset codes expire after 15 minutes and allow only a limited number of attempts.
Our hosting provider encrypts stored data at rest.
On your phone, you can lock the app with Face ID and use privacy mode to hide costs and profit from customers.
Access to production systems is limited to the people who need it to run the Service.

No method of storing or transmitting information is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law. Please use a strong password that you do not use anywhere else.

10. Children

The Service is for adults, 18 or older, who are using it for their business. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

11. Where information is processed

We are based in the United States, and the Service is intended for use in the United States. Your information is stored and processed in the United States and in other countries where our service providers operate. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country.

12. Changes to this policy

We may update this policy as the Service changes. When we do, we will post the new version on this page and update the “Last updated” date. If a change materially affects how we handle your personal information, we will tell you by email or in the app before it takes effect.

13. Contact us

Questions, requests, or concerns about your privacy can be sent to:

Cabinkrue LLC, doing business as Hawaii Supply Co.
State of Hawaii, USA
Email: support@hawaiisupplyco.com

The short version