Privacy Policy
Last updated: June 3, 2026
How Card Bullpen handles waitlist email and analytics — small footprint, honest by default.
Pictured: an illustrated sample card — brand mark for Card Bullpen. Decorative only.
1. Who we are
This is the privacy policy for Card Bullpen (“Card Bullpen,” “we,” “us,” or “our”) and the website at https://www.cardbullpen.com (the “Site”). Card Bullpen is operated by Card Bullpen, based in the United States.
Card Bullpen is a sports-card collection app — “the front office for your card collection” — that is in active development and has not yet launched (we’re aiming for 2026). Right now this Site is purely informational, plus a launch waitlist. There are no accounts, no logins, no purchases, and no app to use yet.
We keep this simple and honest, because that’s how we’re building the product. We collect very little, and we’ll tell you exactly what and why. Questions about this policy or your data? Email privacy@cardbullpen.com.
2. What we collect, and why
Here is everything we collect through this Site. There is nothing else.
a) Your email address — if you join the waitlist
If you enter your email into the waitlist form, we collect that email address for one reason: to let you know when Card Bullpen launches.
- What we collect: the email address you type in, plus a note of which page you submitted it from.
- Why: to notify you at launch.
- Legal basis: your consent — you choose to give us your email by submitting the form.
- What we don’t do: we don’t sell it, rent it, add you to unrelated marketing lists, or share it beyond the form provider below.
The waitlist form is handled by Formspree (formspree.io), a third-party form service that receives your submission, stores it, and forwards it to us by email. See their privacy terms (§4).
b) Analytics
We’d like to understand how people use the Site so we can make it better. We use two analytics tools that work differently on purpose:
- Google Analytics 4 (GA4). How GA4 is handled depends on where you visit from. Visitors in the EU, EEA, UK, and Switzerland see an opt-in cookie banner — GA4 loads only after you accept, and never loads if you decline or ignore the banner. Visitors from other regions (including the US) are covered by an opt-out model: GA4 loads by default to collect usage data (pages viewed, referrer, device/browser type, and a coarse location from your IP), but you can opt out at any time using the "Cookie settings" link in the footer. Either way, ad-related storage stays denied — we run no ads. (We use Google Consent Mode v2.)
- Cloudflare Web Analytics. Privacy-first and cookieless — aggregate counts (page views, referrers, basic performance) with no cookies, no cross-site tracking, no fingerprinting, and no profile of you. Because it stores nothing on your device, it runs without a consent prompt.
c) Server logs and security
The Site is hosted on Cloudflare Pages. As part of hosting, security, and content delivery, Cloudflare processes standard request information — your IP address, browser/user-agent, and timestamps — to serve pages, protect against attacks, and keep the Site available.
3. Cookies & analytics
The only cookies this Site sets are Google Analytics cookies — and only if analytics runs for you. We have no advertising or marketing cookies. Cloudflare Web Analytics sets no cookies at all.
Analytics is handled differently based on where you are:
- EU, EEA, UK, and Switzerland (GDPR regions): On your first visit you’ll see a cookie banner. Until you choose, analytics cookies are blocked — we use Google Consent Mode v2 with analytics storage denied by default (ad-related storage stays denied too; we run no ads). Click Accept analytics and GA4 loads and may set its cookies. Click No thanks, or ignore the banner, and GA4 never loads — no cookies, and nothing is sent to Google.
- Everywhere else (including the United States): Google Analytics runs by default as part of the opt-out model disclosed here. GA4 loads on page load and may set cookies. You can opt out at any time using the ”Cookie settings” link in the footer — clicking it opens the consent banner, and choosing “No thanks” stops GA4 for future visits.
Your choice is remembered so we don’t ask again on every page. Changing your mind: use the ”Cookie settings” link in the footer to re-open the banner, or clear your Google Analytics cookies using your browser’s privacy controls. Withdrawing consent stops GA4 going forward.
4. Third parties we rely on
| Provider | What it does for us |
|---|---|
| Google (Analytics 4) | Usage analytics — opt-in for EU/EEA/UK/CH; opt-out for other regions |
| Cloudflare | Hosting (Pages) + cookieless Web Analytics + security |
| Formspree | Receives, stores, and forwards the waitlist form |
Each provider has its own privacy terms governing how it handles data. We do not sell your personal information to anyone (see §6).
These providers are based in the United States, so joining the waitlist or consenting to analytics may involve transferring your data to, and storing it in, the US. If you’re in the EEA or UK, those transfers rely on the providers’ own safeguards (such as Standard Contractual Clauses). You can avoid analytics transfers entirely by declining cookies (§3), and you can ask us to delete your waitlist email at any time (§6).
5. How long we keep things
- Waitlist emails: kept until launch and for a reasonable period afterward to manage the announcement — or until you ask us to remove it, whichever comes first.
- Analytics data: retained per Google’s and Cloudflare’s default settings for their services.
- Server logs: retained by Cloudflare per its standard practices.
6. Your privacy rights
If you’re on the waitlist and want off, email privacy@cardbullpen.com and we’ll delete your email address. You can also withdraw analytics consent at any time (§3).
If you’re in the EU/EEA or UK, you generally have the right to access, rectify, erase, restrict, or object to processing, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority.
If you’re in California, you generally have the right to know, delete, and correct your personal information, and to opt out of its “sale” or “sharing” — though Card Bullpen does not sell or share your personal information as those terms are defined under California law — without being discriminated against for exercising your rights.
To exercise any right, email privacy@cardbullpen.com. We may need to confirm your identity (for example, that you control the email in question) before acting on a request.
7. Children
Card Bullpen is not directed at children, and we don’t knowingly collect personal data from children under 13 (or under 16 where a higher age applies, such as in parts of the EU). If you believe a child has given us their information, email privacy@cardbullpen.com and we’ll delete it.
8. Contact us
Questions, requests, or concerns about your privacy or this policy: privacy@cardbullpen.com — Card Bullpen, United States.
9. Changes to this policy
We may update this policy as the Site changes or as we get closer to launch. When we make changes we’ll update the “Last updated” date above, and for anything significant we’ll do our best to flag it clearly. This policy covers the pre-launch marketing site only — the Card Bullpen app, user accounts, and in-app data don’t exist yet and will get their own, fuller privacy terms when they launch.
Comfortable with that? The waitlist takes one email.