Privacy Policy

Effective date: October 1, 2026
Last updated: October 8, 2026

Shoebox Daily ("we", "us", "the site") operates shoeboxdaily.com. This policy explains what information we collect when you visit, why we collect it, who we share it with, and what control you have over it.

We have tried to write this in plain language. If anything is unclear, contact us at privacy@shoeboxdaily.com.

The short version

Shoebox Daily is a read-only site that shows live listings from eBay and links out to them. We earn affiliate commissions on qualifying purchases.

• We do not have user accounts, and you cannot create one.
• We do not ask for your name, address, or payment details, and we have no way to accept them.
• We do not sell or share your personal information for money or for cross-context behavioral advertising.
• We use one analytics tool, Google Analytics, and only after you consent.
• We honor Global Privacy Control signals automatically.

1. Information we collect

Information you give us

Almost none. The site has no accounts, no registration, and no newsletter signup. The only information you actively provide is:

• Filter and sort selections. When you narrow listings by grade, price, player or similar, those choices are sent from our server to eBay to retrieve matching results. They are not stored against you and are not linked to any visitor identifier.
• Searches. When you use the site search or the player search, the text passes through our server, which sends you to the matching page here or to an eBay search. We don't store it, though our hosting provider's logs record page addresses, which include the search text.
• Email content, if you choose to email us. The form on our contact page only writes the email for you in your own email app; nothing you type in it is sent to our servers. We keep correspondence only as long as needed to respond.

Information collected automatically

• Server logs. Our hosting provider, Vercel, records standard web server information including IP address, browser type and version, operating system, referring page, pages visited, and timestamps. This is generated by the normal operation of any website and is used for security, abuse prevention, and diagnosing errors.
• Analytics data, described in Section 3. Only collected after you consent.
• Clicks. If you have allowed analytics, clicks on affiliate links and ads are recorded in Google Analytics, as described in Section 3. Our own server does not log affiliate link clicks. The only clicks our server records are clicks on ads we sell directly, which pass through our site on the way to the advertiser: we log the ad, where it was placed, the page it was clicked from, and the time, with no identifier for you. Our hosting provider's platform logs include IP addresses, as described above.
• Local browser storage. We store your theme preference (light or dark), your cookie consent choice, and, if you play our card game, your best score in your browser's local storage. This data stays on your device, is not transmitted to us, and is not used to identify you.

Information we do not collect

We do not collect or process payment information, government identifiers, precise geolocation, biometric data, health information, or any special category of personal data. We do not build advertising profiles, and we do not use fingerprinting, session recording, heatmaps, or cross-site tracking pixels.

2. Cookies and similar technologies

We use two categories:

Strictly necessary. Local storage entries that remember your theme choice, your consent decision, and your best score in our card game. These cannot be turned off without breaking those features, and they do not track you.

Analytics. Google Analytics cookies, described below. These load only if you consent. If you decline, or if your browser sends a Global Privacy Control signal, they are never set.

You can also block or delete cookies through your browser settings. Doing so may reset your theme preference and cause the consent banner to reappear.

3. Google Analytics

We use Google Analytics 4 to understand how people find and use the site: which pages are viewed, roughly where visitors come from, and which outbound links are clicked. This helps us decide what to build and what to write.

What is collected: page views, approximate location derived from a truncated IP address, device and browser type, referral source, and interaction events including clicks on affiliate links, ads, and card show listings. Affiliate link clicks record the destination marketplace, the page the click came from, and our internal tracking code. Ad clicks record the ad, where it was placed, the advertiser, and the page the click came from. Card show clicks record the show, its state, whether it was a sponsored listing, and the page the click came from.

What is not collected: we do not send your name, email address, or any other direct identifier to Google Analytics, because we do not have them.

IP anonymization: Google Analytics 4 does not log or store full IP addresses.

Consent first: analytics does not load until you accept it in our consent banner. Declining is as easy as accepting and costs you no functionality.

Google processes this data as our service provider. Google's own handling of this data is governed by their privacy policy at policies.google.com/privacy. You can opt out of Google Analytics across all sites using Google's browser add-on at tools.google.com/dlpage/gaoptout.

4. Affiliate links and marketplace partners

Shoebox Daily participates in affiliate programs. When you click a listing or a marketplace link and then make a purchase, we may earn a commission. This costs you nothing and does not change the price you pay.

Our affiliate relationships include:

• eBay Partner Network
• Amazon Associates
• Fanatics Collect and Topps, through Impact.com

What this means for your privacy. Affiliate links carry a tracking code that identifies Shoebox Daily as the referrer and identifies which page you clicked from. When you follow one, the destination marketplace may set its own cookies and collect information about your visit under its own privacy policy, which we do not control. The networks send us commission reports, which can list the items bought through our links and when. They do not tell us who bought them: we never receive your name, contact details, or payment details.

Commissions do not influence which listings we show. On listing pages, results are ordered by the filters and sort you choose. Homepage sections are chosen by fixed rules that don't involve commission, such as end time, highest current bid, and number of bids. No marketplace or seller pays for a listing's placement or ranking. Advertising is always labelled "Advertisement" and kept separate from listings.

As an Amazon Associate, Shoebox Daily earns from qualifying purchases.

5. Third-party content

eBay listing data. Listings, images, titles, and prices are retrieved from eBay's API and displayed on our pages. Listing images are served directly from eBay's servers, which means eBay's servers receive a request from your browser, including your IP address, when a page loads.

News headlines. We display headlines and links from third-party publications. We show only the headline, source, and date. Clicking one takes you to that publication's own site under their privacy policy.

Fonts. Our typefaces are self-hosted and served from our own domain. No font request is made to Google or any other third party, so no third party receives your IP address for that purpose.

6. How we use information

• To display live listings and run the filters
• To understand aggregate site usage and improve what we build
• To measure which pages generate affiliate clicks
• To reply to messages you send us
• To stay within eBay's API rate limits (this uses no information about visitors)
• To diagnose errors and maintain security
• To comply with legal obligations

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

7. Legal bases for processing (EEA and UK visitors)

Where the UK GDPR or EU GDPR applies, we rely on:

• Consent for analytics cookies. You may withdraw consent at any time through the consent banner.
• Legitimate interests for server logs, security, abuse prevention, and affiliate attribution. Our interest is in operating a functioning, secure site and being paid for referrals we generate. We have considered the limited and non-intrusive nature of this processing against your rights.
• Legal obligation where we must retain or disclose information to comply with law.

8. Sharing your information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have never done either, and we have no plans to.

We share limited information with:

• Vercel, our hosting provider, which processes server logs
• eBay, whose servers deliver the listing images on our pages and so receive your IP address and browser details, and which receives the filter selections our server sends to retrieve listings (not linked to you)
• Upstash, which operates our server-side cache. The cache holds eBay listing data, news headlines, our own eBay access token and API usage counts. It contains no personal information about visitors.
• Google, for analytics, only with your consent
• Affiliate networks, which receive the tracking code attached to links you click

We may also disclose information if required by law, to enforce our terms, or to protect the rights or safety of users or the public.

9. Data retention

• Server logs: retained by our hosting provider according to their standard retention period, typically a matter of weeks.
• Cached listing data: short-lived, from fifteen minutes to a few hours depending on the page, with saved copies of each module held up to 48 hours so the site still works if eBay is unavailable. None of it is personal.
• Google Analytics data: retained for 14 months, after which it is automatically deleted.
• Local browser storage: stays on your device until you clear it.
• Email correspondence: kept only as long as needed to handle your inquiry.

We do not maintain a customer database, because we do not have customers in the data-collection sense.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we hold about you
• Access a copy of it
• Correct inaccurate information
• Delete it
• Opt out of its sale or sharing (we do neither)
• Opt out of targeted advertising (we do not engage in it)
• Not be discriminated against for exercising these rights
• Appeal a denied request

To exercise any right, email privacy@shoeboxdaily.com. We will respond within 45 days, and may extend once by a further 45 days where permitted, telling you why.

Verification. Because we do not maintain accounts, we often cannot link data to a specific person. Where we cannot verify a request, we will tell you and explain what we can do instead. This is a limitation of collecting very little data, not a refusal.

California residents

Under the CCPA as amended by the CPRA, we disclose the following about the preceding 12 months:

We have not sold or shared personal information in the preceding 12 months, and we do not knowingly collect personal information from anyone under 16.

You may also designate an authorized agent to submit a request on your behalf.

Other US states

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have broadly similar rights. Use the same email address above. If we deny a request, you may appeal by replying to our response, and we will tell you the outcome and how to contact your state attorney general.

EEA and UK residents

In addition to the rights above, you may object to processing based on legitimate interests, request data portability, and lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner's Office.

11. Global Privacy Control

We honor Global Privacy Control (GPC) signals. If your browser or extension sends a GPC signal, we treat it as an opt-out: analytics will not load, and no analytics cookies will be set. You do not need to do anything else, and the site will confirm on screen that the signal was received.

To learn more or enable GPC, see globalprivacycontrol.org.

12. Children's privacy

Shoebox Daily is intended for adults. Collecting sports cards is a hobby many children enjoy, so we want to be clear: this site is not directed to children under 13, we do not knowingly collect personal information from them, and we do not serve content designed to appeal to them.

If you believe a child under 13 has provided us with personal information, contact privacy@shoeboxdaily.com and we will delete it promptly.

We also do not knowingly process the personal information of anyone under 16 for targeted advertising or sale, which we do not engage in for anyone.

13. Security

We use HTTPS across the entire site. We store no accounts, no passwords, and no payment information, which removes the most common categories of breach risk. Server-side credentials are held in encrypted environment variables and are never exposed to your browser.

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

14. International transfers

We operate from the United States, and our service providers process data in the United States and other countries. If you are in the EEA or UK, your information will be transferred to the US. Our providers rely on Standard Contractual Clauses or equivalent safeguards for these transfers.

15. Links to other sites

This site links extensively to eBay, Amazon, Fanatics Collect, Topps, and news publications. We are not responsible for the privacy practices or content of any site we link to. Read their policies before providing them with information.

16. Changes to this policy

We may update this policy as the site changes or as the law does. We will revise the "Last updated" date above, and for material changes we will display a notice on the site. Continued use after a change means you accept the revised policy.

17. Contact

Questions, requests, or complaints:

Email: privacy@shoeboxdaily.com Site: https://www.shoeboxdaily.com Operated from: Oregon, United States

We aim to respond within five business days, and within the statutory deadline for formal privacy rights requests.