NuGrade Privacy Policy

Last updated: 2026-08-19.

Plain-English summary. We collect the minimum we need to run NuGrade: the captures you send us, your account identity, purchase records, and limited analytics and diagnostics. We do not sell your data. You can delete your account in the app at any time.

1. Who We Are

This Privacy Policy describes how NuGrade ("we", "us") handles personal information collected through our mobile app, website, and related services.

For privacy questions or data subject requests, contact support@nugrade.app.

2. Data We Collect

2a. Identity and Contact

Email address — when you sign up with email and password.
Early-access email address — when you ask us to notify you about early access and launch. Joining this list does not create a NuGrade account.
Business inquiry details — when a shop or professional seller submits the bulk-grading inquiry form: an email address, and optionally a business name, an approximate monthly volume range, and any message you write. Submitting the form does not create a NuGrade account and does not add you to the early-access list.
Sign-in provider identifiers — when you use a third-party sign-in provider, we receive the account identifier and email address that provider makes available to us.
Hashed password — only when you sign up with email/password. Your password is protected using industry-standard hashing; we do not store the cleartext password.

2b. Capture Media

Photos and videos of your comic book that you submit through the app.
Capture metadata related to your submission, such as timestamps and quality or coverage information used to process the submission.
Intake survey answers — your text responses about restoration, odor, brittleness, signature provenance, etc.

2c. Generated Output

Grade reports and report exports generated from your submission.
Quality, support, and dispute-review records related to a submission or report.

2d. Billing

Purchase records — app-store or payment processor transaction identifiers, purchase history, credit ledger entries, refund events, and chargeback events.
We do not receive or store your full credit card number.

2e. Telemetry

Optional product and website analytics — after you allow analytics on the website, Google Analytics and PostHog receive page URLs, page views, feature interactions, general usage patterns, and pseudonymous technical identifiers. Website analytics does not load or send events before that choice.
Diagnostics and error reporting — crash logs, performance data, and technical details needed to diagnose problems and improve reliability.
Session replay is not enabled on the website. We will update this policy and the relevant consent control before enabling it.

We configure analytics and diagnostics to minimize personal data. We do not intentionally send report media, survey answers, full payment details, or account passwords to analytics or diagnostics providers.

We do not use third-party advertising cookies or cross-site advertising pixels.

Website analytics is optional. A single Privacy choices control governs both Google Analytics and PostHog, including matching server-side website events. You may allow, decline, inspect, or later withdraw that choice. On withdrawal, we stop future capture and remove applicable Google Analytics and PostHog identifiers from this browser. Withdrawal does not retroactively erase aggregated or deidentified statistics already produced; contact us to exercise an applicable deletion right.

Sentry error diagnostics are separate from optional analytics and remain active as an essential reliability service. We configure Sentry without user email, IP address, cookies, form data, report media, or survey answers and use it only to detect and repair service failures.

3. How We Use Data

We use the data described above only to:

Generate and check your grade report. Captures and survey answers are processed by our automated grading, report-generation, and quality-assurance systems, including systems operated by service providers on our behalf.
Operate your account. Authentication, credit accounting, refund processing, support requests.
Send requested launch updates. If you join the early-access list, we use your email for NuGrade early-access and launch communications. You can withdraw from the list at any time by contacting us.
Answer business inquiries. If you submit the bulk-grading inquiry form, we use what you send to reply and to discuss pricing for your volume. We do not add those details to the early-access list.
Detect and prevent fraud. Abuse detection, duplicate-account detection, chargeback reconciliation.
Improve the product. Aggregated or deidentified analysis of product quality, grading quality, and capture quality.
Comply with law. Tax reporting, audit obligations, lawful government requests.

We do not sell personal data and we do not share it with advertising networks.

4. Retention

| Data class | Retention criteria | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account, contact, and authentication records | While your account is active, then deleted or deidentified after routine backup and administrative periods. | | Early-access email list | Until the requested early-access and launch communications are complete, or until you withdraw from the list. | | Business inquiry records | Until your inquiry is resolved and for a reasonable follow-up period afterward, or until you ask us to delete it. | | Submitted media, survey answers, and reports | While your account or report is active, unless you delete them or request deletion. | | Records of automated checks | Kept as a record of the automated processing run on a report, including after the underlying media is deleted. Service providers that process submitted media may retain it for limited periods under their standard terms, including for security, abuse-prevention, and legal-compliance purposes. | | Limited deletion, fraud, and dispute records | As needed to honor deletion requests, resolve disputes, prevent fraud, and comply with law. | | Purchase, credit, refund, and chargeback records | As required for tax, accounting, fraud-prevention, audit, and dispute obligations. | | Optional website analytics | While analytics consent remains granted and for short operational periods afterward, or in aggregated or deidentified form. The browser consent preference expires after 180 days unless renewed. | | Essential diagnostics | For short operational periods, or in aggregated or deidentified form, as needed to investigate and repair reliability failures. | | Support and privacy request records | As needed to respond to the request and meet legal obligations. |

We may retain limited records after deletion where necessary for legal, security, fraud-prevention, accounting, chargeback, dispute-resolution, or public deletion-notice purposes.

5. Sharing With Third Parties

We disclose personal information only to service providers and processors that help us operate NuGrade, including providers for cloud hosting, account authentication, storage, grading, report generation, quality assurance, payment and app-store billing, transactional email, analytics, diagnostics, customer support, reference-data lookup, fraud prevention, security, and legal compliance.

For website telemetry specifically, Google Analytics and PostHog process optional analytics only after consent, while Sentry processes the separate PII-minimized essential diagnostics described in Section 2e.

These providers may process personal information only as needed to provide services to us or as required by law. We do not sell personal information, share it with advertising networks, or share it for cross-context behavioral advertising.

6. International Transfers

NuGrade is operated from the United States. Data is processed on infrastructure located primarily in the United States. If you access the Service from outside the U.S., your data will be transferred to the U.S. for processing. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our service providers.

7. Your Rights

Depending on where you live, you may have some or all of the following rights:

Access — get a copy of the personal data we hold about you.
Correction — fix inaccurate data.
Deletion — delete your account and the data associated with it (subject to the retention table in Section 4).
Portability — receive your data in a machine-readable format.
Objection / restriction — limit how we process your data.
Withdraw consent — where processing is based on consent.

Deletion

Open the NuGrade mobile app.
Go to Settings → Account → Delete account.
Confirm the warning, then re-enter your password.
We delete or deidentify your account information and related content, subject to the retention limits described above. Some limited records may be retained where needed for legal, security, fraud-prevention, accounting, chargeback, dispute-resolution, or public deletion-notice purposes.

If for any reason you cannot complete the in-app deletion (lost device, lost password, or lost sign-in provider access), email support@nugrade.app with proof of account ownership and we will perform the deletion manually within 30 days, subject to legal exceptions.

Data export

Self-service data export may not be available in all cases. Write to support@nugrade.app and we will return a copy of your account data within 30 days.

To exercise any other right, email support@nugrade.app.

8. Children

NuGrade is not directed to children under 16 and we do not knowingly collect personal data from anyone under 16. If you believe a child has signed up for NuGrade, contact us and we will delete the account.

9. Cookies and Local Storage

The NuGrade web surface uses essential cookies or local storage for signed-in sessions, preferences, and security. We also store one first-party nugrade_analytics_consent preference for up to 180 days so the website and its server endpoints honor your choice.

Google Analytics and PostHog scripts, requests, identifiers, cookies, and local storage are blocked until you choose Allow analytics. If you decline, they remain blocked. Open Privacy choices on any website page to inspect or change the choice. Withdrawing consent disables future capture, clears applicable analytics identifiers and storage, and reloads the page without the analytics SDKs.

Sentry diagnostics do not use the analytics consent cookie. They operate under the separate, PII-minimized essential reliability policy described in Section 2e.

We do not use advertising or cross-site tracking cookies. We do not run a tracking pixel from a third-party ad network.

10. Security

We use technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls, monitoring, credential protection, and limits on who may access production data.

No system is perfectly secure. If you discover a vulnerability, please report it to support@nugrade.app; we will acknowledge within 5 business days.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where required, we will notify you of material changes before they take effect. The "Last updated" date at the top of this document reflects the current revision.

12. Contact

For privacy questions, data subject requests, or to designate a data protection authority complaint, contact support@nugrade.app.