Your collection is private by default. Your e-Pack password and session cookies stay in your browser. Joining the waitlist does not create an app account.
Beta waitlist
The public website is a demo and product-information page. If you join the waitlist, we store your email address, signup time and the version of your consent in Exchange’s separate data storage. We send a signup confirmation and notify the project owner of the new signup. We also use the list for beta invitations and launch updates. Joining does not create an app account or start a subscription.
Resend processes the recipient address and message contents to send the confirmation and owner notification. We retain mail-queue records and provider acceptance receipts to handle failures and prevent repeat signup emails. A provider acceptance receipt is not proof that a message reached your inbox.
Waitlist addresses are not public or available through customer collection APIs. To withdraw your signup or request deletion, email charles@kasel.tech from the address you signed up with. We will remove the active signup after verifying the request. Protected backups may retain an earlier copy. We do not sell waitlist addresses or use them for unrelated advertising.
What we use
Google sign-in verifies your Exchange identity. We keep Google’s account identifier and our own workspace membership and session records. We check your verified email during sign-in but do not retain your Google email, profile or access tokens in the Exchange database.
When you choose Connect e-Pack, the companion reads the username returned by e-Pack in your signed-in browser. When you choose Sync, it reads owned collection pages and sends only the collection fields needed for your import: group identifiers, set/player text, quantity and any explicit physical or redemption status. You review and confirm before those groups become saved holdings.
What stays in your browser
You sign into e-Pack on e-Pack’s own website. The companion uses that browser session for same-site, read-only requests. It does not read, copy or send your e-Pack password or session cookies to Exchange. It does not read unrelated websites, collect browsing history, trade cards or post listings.
The companion processes short-lived connection codes to bind a read to the Exchange session that requested it. It does not store your collection in extension storage. The limited-testing account pages use secure session cookies. The public waitlist does not require an account or set an Exchange login cookie.
Where data goes
We use service providers for secure data storage, website delivery, sign-in and email. Google provides sign-in and Resend delivers signup emails. Service providers process the information needed for those functions, including standard connection and security metadata. The companion sends its approved output only to the canonical Exchange website over HTTPS. Your e-Pack credentials are not sent to those Exchange services.
Use and access
We use this information to authenticate you, keep your workspace separate, show your collection, perform imports you request and maintain the service. We do not sell collection or identity data, use it for advertising, or use it to train general-purpose AI models. Authorized operators may access service data when needed for support, security or maintenance.
Use of information received from Google APIs follows Google’s API Services User Data Policy, including its Limited Use requirements. Use of data through the companion follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
Retention and deletion
Disconnecting an e-Pack account stops new syncs and cancels pending work; it keeps your previously saved holdings. Connection attempts expire, and sessions can be revoked by signing out. Expiration does not mean every related database record is immediately erased.
During testing, export, deletion and retention requests are handled manually. Contact charles@kasel.tech from the account you want help with. We will verify the request before providing or deleting private records. Protected backups may retain earlier copies; their retention is addressed as part of a deletion request. Self-service export/deletion and scheduled retention are still being built.
Contact and changes
Questions about this notice can be sent to charles@kasel.tech. We will update this page when the service’s data handling changes. ePack Exchange is independent of Upper Deck; signing into Exchange does not grant it your e-Pack login credentials.