Last updated 2026-11-02. Who we are: SlabbyPrep, part of CrabTree Collections, 6600 Hiatus Road, Tamarac, Florida, USA — crabtreecollections@gmail.com. For the little processing we do, we are the “controller”.
SlabbyPrep keeps nothing about you. We have no accounts, no database, no cookies, no analytics and no logs of our own. Your photos, measurements, the prices you type and your batch stay in your browser. Your licence and a device key live in your browser too.
The exceptions, one by one
Payment. Stripe processes your payment and keeps your email, billing address and card details under Stripe’s privacy policy. We never see your card number.
Email and card last 4. When you add a device, the email you type is sent to Stripe to find your subscription, and Stripe records that lookup in our Stripe account’s request logs for a limited time. The last 4 digits you type are compared on our server with the ones Stripe holds; they are never sent to Stripe, and we store neither.
Your Stripe subscription record carries the Terms acceptance stamp (which version, and when) and up to two random device codes, with the dates each was added and last used, the dates of device moves in the last 30 days and short fingerprints of licence keys issued before 2026-10-28 that were moved onto a device. None of these identify a person or hardware. If you arrived through a tagged link (a creator’s, a post’s or a shared report’s, for example ?src=yt-name), its tag is on the record too, so the source can be credited; it identifies the link, not you. Stripe also keeps each change to the record in its event history for about 30 days.
Hosting. Vercel, our host, sees your IP address to deliver pages and keeps its own request logs (time, the page and query string requested, your IP address and browser); on this site’s current plan Vercel keeps them for 1 hour (Vercel’s documentation), under Vercel’s privacy policy. If Vercel’s firewall suspects automated traffic it may show a security check, which sets a short-lived cookie of Vercel’s own.
Guessing limits. To stop anyone guessing card digits, your IP address and the email you type to add a device are held in our server’s memory until an hour after your last try, in a scrambled form that cannot be turned back, and are never written down.
Card searches. The card name you search for goes to PriceCharting from our server, without your IP address; your licence goes with the search to our server only to check your subscription is current, and is not kept. Our server keeps the answer to a search in its memory for up to 6 hours, so repeat searches do not reach PriceCharting again, and hands it only to subscribers; it is kept by search text, not linked to you.
What lives in your browser
Photos and the prices you type stay in the page’s memory and are gone when you close the tab. Your batch list (card names, centering and the verdict’s figures) and your licence are in local storage; your device key (IndexedDB — its private half cannot be read out of the browser, and only its public half and a signature are sent when your licence is issued or renewed); a creator tag from the link you arrived through, for that visit only (session storage). Clear the site’s data in your browser to delete them all.
Email
If you write to us, we keep the conversation only as long as needed to answer you.
Your rights
Under the GDPR, the UK GDPR and US state privacy laws you can ask what we hold about you and to correct, delete or receive it, object to processing, or complain to your supervisory authority. Because we hold nothing about you beyond what is in your own browser, most of these are satisfied by clearing your site data; for anything else, email crabtreecollections@gmail.com. Stripe answers requests about payment data.
International transfers
Stripe and Vercel are US companies. Where EU or UK data reaches them it is protected by their participation in the EU-US Data Privacy Framework and/or standard contractual clauses.
Age
SlabbyPrep is for adults (18+). We knowingly collect nothing from anyone, including children.
Changes
The date above says when this policy last changed.