Privacy Policy

How We Use Your Data

• Save the normalized results of a sync you started to your private TheShowBase account
• Power My Club, ownership indicators, collection tracking, program-reward tracking, team building, and personalized market tools
• Resume long scans after the side panel closes or Chrome suspends the extension worker
• Secure the import API, enforce rate limits, detect abuse, and diagnose reliability problems

Local Processing and Storage

• User initiated: The extension reads MLB The Show data only after you choose a sync or optional scan.
• Normalized checkpoints: Card, collection, program, progress, and retry checkpoints are stored locally so an interrupted scan can resume. The extension retains only a bounded number of completed run records.
• Tokens: TheShowBase access tokens use browser session storage. A refresh token is stored locally until you disconnect the account, clear extension data, or uninstall the extension.
• No raw pages: MLB responses are parsed in memory. Raw HTML/JSON pages and SDS cookies are not saved or uploaded by the public Web Store build.

Server Storage and Security

• HTTPS: Authentication and import traffic is encrypted in transit.
• Private account data: Supabase access controls and authenticated server APIs restrict imported club data to its owner and authorized service operations.
• Current snapshots: Inventory and current collection/program observations are replaced by newer complete scans rather than appended indefinitely.
• Historical evidence: Import-run summaries and exact-scan summaries may be retained for reliability and audit purposes. Confirmed earned program rewards remain in a monotonic ledger until the imported data or account is deleted.
• Human access: We do not allow people to read extension user data except with your specific consent for support, when necessary for security, when required by law, or after aggregation/anonymization for internal operations.

Your Choices and Rights

You have complete control over your data:

• Choose: Standard sync, exact Collected scan, and exact program-reward scan are separate actions.
• Pause or cancel: Long scans can be paused or cancelled from the side panel.
• Access, export, or delete: Contact support@theshowbase.com to request a copy or deletion of imported extension data without needing to uninstall.
• Disconnect: Disconnecting clears local TheShowBase authentication tokens. Uninstalling clears extension-local data and stops all future collection.
• Account deletion: Deleting your TheShowBase account removes account-linked imported snapshots, reward evidence, and importer audit records.

Service Providers and Data Sources

• Google OAuth: The sign-in provider for your TheShowBase account.
• Supabase: Authentication and database infrastructure for account-linked imported data.
• Vercel: Hosting, API execution, and operational/security logging for TheShowBase.
• MLB The Show / Sony Interactive Entertainment: The authenticated, read-only source of the club and progress data you request to sync.

Data Retention

Current imported snapshots are kept until replaced or deleted. Historical import/scan summaries, earned-reward evidence, and limited security records are retained while your account remains active unless you request earlier deletion. Authentication access tokens expire automatically; locally stored refresh token remains until disconnect, browser-data clearing, or uninstall.