Last updated: October 28, 2026
SlabTracked ("we," "us," or "our") provides a submission-tracking and listing platform for graded collectibles — including comics, trading cards, magazines, video games, and other slabbed items graded by services such as CGC and PSA. This policy explains what information we collect, how we use it, and the choices you have. It covers both the SlabTracked web application and the SlabTracked browser extension. By using SlabTracked, you agree to this policy.
Chat with SlabTracked uses your browser's speech recognition, which may process audio through the browser provider. SlabTracked does not upload or store a voice recording. After you consent and choose Build my list, your transcript, selected grading service, service level and expected item count are sent to our configured processor (Gemma 4 through Ollama, or OpenAI) to create editable entries. The original transcript remains in the open form's memory and is not saved by SlabTracked. Generated drafts and hashed request records may be cached for up to 24 hours to recover results and prevent repeat charges. Operational logs contain token counts, timing and estimated cost, not transcript text. Entries you add to the form follow the normal draft and submission storage rules. Item names, printed identifiers, year, set and language are used to search the CGC or PSA catalogue and select the best supported match. Uncertain matches are flagged for review. Review identities and signature requests before submitting.
You can connect an AI service of your choice through SlabTracked's MCP connector. You sign in and approve the specific permissions the service requests. Read access covers selected saved collection, submission, and inventory records. Separately approved write permissions can expose collection customizations, preparation drafts and item notes, dealer intake item notes, or saved marketplace drafts, and permit the corresponding collection, inventory, preparation, dealer intake, or marketplace actions. Existing read-only connections do not gain write permissions automatically. Marketplace publishing can make listings available to buyers and incur marketplace fees; public collection edits can affect an existing shared collection page.
Your chosen AI service receives the records and results its approved tools retrieve and handles them under its own privacy and retention policies. Review those policies before connecting. The connector does not disclose your grading-service passwords, account access tokens, or customer contact details. SlabTracked retains tool names, result status, connection identity, and timestamps in activity history for 90 days, without tool arguments or record contents. For writes, encrypted result receipts and request hashes are retained for 30 days to prevent duplicate changes on retries. Marketplace jobs also retain encrypted operation details and results for up to 30 days to complete and verify the requested work.
You can inspect permissions and revoke a connection in AI agent settings. Revocation stops future authorized requests. It does not remove information already held by your AI service or reverse changes already completed, including a published marketplace listing. Connection grants last for up to 30 days and must then be approved again.
When you choose image scan and consent, resized front-photo overviews or still frames selected locally from a short video, plus temporary item crops, are sent through SlabTracked to third-party AI processors to suggest an editable list of collectibles. The initial scan may use multiple bounded analysis calls so each detected item can be read separately. Proposed video identities may be sent to a second processor for independent review; when a photo-scan item remains incomplete, SlabTracked may send only that item's temporary crops to a second processor for enhanced review. Do not include faces, addresses, payment information, or other sensitive details. This beta does not require back photos and does not submit anything to a grader. For video capture, audio is not used, the raw video stays on your device, and up to two selected still frames from each detected item may be sent as one logical entry after you choose Scan. SlabTracked processes scan photos and selected frames temporarily rather than saving them as inventory images. Suggested text and scan-control records are temporarily cached to recover completed scans and limit abuse; rows you add to a form follow the existing draft and submission storage rules. AI suggestions can be inaccurate and must be reviewed before submission.
For hosted CGC submissions, you can enter your login in SlabTracked and have Browserbase sign in on your behalf. We encrypt it using AES-256-GCM with protection tied to your SlabTracked user and chosen CGC account. By default the encrypted password is removed when the sign-in attempt begins, when you close the session, or by cleanup after the session expires (at most 20 minutes, plus the cleanup interval). If you explicitly choose Save encrypted login, we retain it for future hosted drafts until you forget it or disconnect that account in Hosted CGC settings. A failed saved login is paused until you update it. Each Collector or Dealer account has its own private Browserbase context, including login cookies and browser storage. Disconnecting deletes that context and the saved login. Hosted browser recording and session logs are disabled. CGC receives the login; SlabTracked does not collect payment card details for this workflow.
If you choose to enable auto-login in the browser extension, the grading-account email and password you enter are held only for the current browser session in companion version 2.10.5 and are used solely to sign in to your own CGC or PSA account. For regular-account CGC server sync, you may instead enter your credentials for one background sign-in and verification attempt. SlabTracked does not save that password for recurring sync. With your consent, Browserbase retains the resulting encrypted browser session for 72 hours by default, or up to 14 days only with your separate explicit agreement to the longer period, to request CGC Comics and CGC Cards CSV exports for the products you select. Server access stops at expiry; hourly cleanup deletes the saved session. Disconnect in Connected Accounts to delete it sooner. A security check pauses syncing until you reconnect. Renewing requires fresh consent and verification.
For automated PSA server sign-in, you enter your email and password in SlabTracked on your phone or computer. With your consent, SlabTracked stores these credentials encrypted for 72 hours by default or up to 14 days with explicit agreement. The server decrypts them only when needed to sign in to your PSA account in Browserbase, including recovery of expired PSA sessions during that access period. Verification codes are forwarded once to your private PSA sign-in page and are not saved. Other security checks may require a computer. With your explicit consent, Browserbase retains the resulting encrypted browser context, including PSA cookies and browser storage, for 72 hours by default or up to 14 days with your explicit agreement to the longer period. Server access stops at expiry, and hourly cleanup deletes the expired credentials and saved context. You can disconnect sooner; PSA may also invalidate the login sooner. Renewing requires your consent again. Connections authorized before timed access was introduced keep their existing consent until renewed or disconnected. SlabTracked stores the opaque Browserbase context identifier, selected access period and expiry. If you separately authorize scheduled access, short-lived server browsers reuse that context about every 15 minutes while a known PSA order is active, and about every six hours otherwise, to request your private order list, exact in-progress stages, return-shipping data, and available completed-order cert data, including PSA's per-order CSV fallback. The browser extension remains an optional companion. When you start a hosted PSA submission, the remote browser uses your authorized PSA context to send your saved item details and selected service options to PSA. SlabTracked reads the native draft and checkout details, records choices and terms you explicitly approve, and stores verified completed-order details and a private receipt to link the order to your draft. Finish on PSA closes the hosted session before opening the exact saved draft in your own browser, where you sign in to the same PSA account, enter payment details and place the order. You can also use the private PSA browser with a desktop keyboard. SlabTracked does not collect payment card details for this workflow. See "Browser extension" and "Data storage & security" below.
Companion version 2.10.24 corrects PSA order-count handling and displays sync failure causes and attempt times in the popup. Order-list diagnostics use request status, market and counts rather than raw order responses. Failed order reads do not replace previously synced orders. This update adds no permissions, hosts, credential retention or external data recipients.
Companion version 2.10.23 saves canonical CGC and PSA submission links and native identifiers with the active submission attempt. Tracking parameters are removed. After an order is saved, CGC print capture may open one inactive, read-only packing-slip tab using your existing grader session, then close only the tab it created after capture. PSA native PDFs are retrieved independently when available. SlabTracked stores the captured document or item record privately to generate branded packing slips. These links do not contain passwords or session cookies. No new permissions, hosts, credential retention or external recipients are added.
Companion version 2.10.19 prepares missing-catalogue entries from saved intake details, records inferred, defaulted and unknown values including a current-year fallback for CGC and PSA, and retains saved-item identifiers and positions for submission history and recovery. These records are stored in the existing device-local workflow state and sent to SlabTracked with authenticated submission capture. Hosted preparation retains equivalent evidence in its existing attempt checkpoints. No new permissions, allowed hosts, password retention or external recipients are added.
The SlabTracked browser extension acts on the supported CGC, PSA, Whatnot, and SlabTracked pages declared in its manifest. It reads private grading order and invoice records, statuses, certificate numbers, item details, and grader-provided return tracking numbers to sync them to your SlabTracked account. You can start submission-form assistance and Whatnot inventory workflows from SlabTracked. You review final submissions and marketplace actions. Certification enrichment and carrier delivery updates run through SlabTracked's server integrations; the extension does not open public certification pages, carrier pages, or eBay listings.
Extension version 2.9.0 removes the PSA relay, shared-search proxy, submission-ID pools, and request-header rewriting from the regular companion and drops the declarativeNetRequest permission. Private CGC and PSA sync remains supported, including granular PSA status stages. Sync success is reported after the server acknowledges saved records; failed attempts remain retryable. Companion version 2.10.9 and developer relay 1.3.1 update the brand artwork without changing permissions or data handling. Companion version 2.10.8 adds host access to login.collectiblesgroup.com for CGC’s shared Collector and Dealer sign-in. Optional saved credentials are submitted only to supported CGC login forms; security checks and password resets remain under your control. Hosted preparation and server CSV sync use the same supported CCG login flow. This does not add credential storage or share credentials with a new provider. Companion version 2.10.7 fetches CGC invoice CSVs in memory and uploads their contents to SlabTracked for server-side record import. It never starts a native CSV download. If CGC blocks the request, sync reports a failure without saving a file in Downloads. The downloads permission has been removed. Status propagation and certification enrichment are handled independently on the server.
In companion version 2.9.1, Pause and Sign out keep scheduled grading sync stopped across browser restarts. Manual CGC and PSA sync, sync interval changes, and deferred enrichment timers also respect Pause until you resume. These controls do not delete records already saved to your SlabTracked account.
In companion version 2.9.2, Whatnot CSV uploads stay in memory for the active import and are sent to your Whatnot inventory page. Starting an import clears any older unused CSV upload job from local storage. Import results return to the SlabTracked page that started the upload, and success requires confirmation from Whatnot.
In companion version 2.10.0, convention names/dates, selected creator names and CGC catalog IDs, creator requests, and custom-label requests are saved with your presets and submission drafts. Creator search sends your search text to CGC through SlabTracked; no AI matching is used. The companion stores preparation progress on this device and enters matched choices on your CGC form. You review waivers, shipping, payment, and final submission yourself. When CGC presents its holder-removal waiver, SlabTracked can show the current text and relay your explicit agreement to that exact waiver. We retain its text fingerprint and the times you approved it and it was applied. Shipping and payment open on CGC’s own site using the same account.
Companion version 2.10.10 associates autofill with a saved SlabTracked batch and attempt identifier. It checks authorization with SlabTracked before grader mutations and retains confirmation captures for reconciliation. Intake revisions, item movements, order mappings and notification delivery outcomes are recorded for your dealer workflow. This update adds no browser permissions or new external data recipients.
Companion version 2.10.11 keeps PSA submission preferences, quantities, declared values, the native PSA submission ID and a fill checkpoint in existing device-local workflow storage through checkout. Partial entry and failed receipt uploads retain this state for review; the corresponding accepted confirmation clears it. The companion does not automatically accept PSA terms or place the final order. This update adds no permissions, host access, credentials or external data recipients.
Companion version 2.10.12 reads the Canadian and US PSA order pages needed to verify your existing orders and recognizes PSA's Holder and Label Review stage. It uses the existing signed-in browser session and PSA host access. Incomplete tracking checks preserve previously saved order details. This update adds no permissions, credentials or external data recipients.
Companion version 2.10.13 records interrupted or timed-out preparation as a stopped submission attempt and sends its failure reason to SlabTracked through the existing authenticated job-status connection. Saved batch and attempt identifiers support review and recovery, and the grader tab and saved progress remain available for review.
For a CGC Comics submission with a selected saved account, SlabTracked stores the saved account reference, Dealer or Regular account type and member number with the submission attempt. The account type and member number are sent to the companion and kept with its existing device-local workflow data so it can verify the complete signed-in account number before changing the grader form. Automatic confirmation linking also checks the selected account and original attempt; account and attempt evidence is retained with the order capture. A different or unverified account leaves the capture available for review instead of automatically confirming the batch. The submission job does not include saved passwords. Older companions that cannot perform this check cannot pick up these submissions. If you enable optional automatic sign-in, the account type you choose in the popup is kept with your existing session-only login settings.
Version 2.10.13 also updates PSA form compatibility while preserving exact matching, saved preparation checkpoints, receipt verification and your control over terms acceptance and final order placement. This release adds no browser permissions, host access, password retention or external data recipients.
Companion version 2.10.1 also carries shared submission services and declared-value defaults. Your most recent applied creator selection is saved to your SlabTracked account for reuse across drafts and devices. Field microphones use your browser’s speech recognition. JSA details, autograph minimum grades, and unavailable choices require review on CGC; payment and legal consent remain under your control.
Companion version 2.10.2 keeps a device-local record of the requested settings and acknowledged book progress to verify its shipping handoff. It can open Shipping after preparing the draft; shipping choices, payment and legal agreements remain yours. This update adds no new permissions or third-party data sharing.
Companion version 2.10.3 verifies convention comic and creator catalog matches directly with CGC and waits for its form to confirm each signer and eligible custom label. It adds no permissions, credential storage, or data sharing with Browserbase. Extension submissions run in your own signed-in CGC browser tab.
Companion version 2.10.4 uses the existing account connection state to show the appropriate sign-in or sign-out actions in the popup. This display update adds no permissions, stored data, or data sharing.
Companion version 2.10.5 stores its SlabTracked token, account email and optional grader credentials in Chrome session storage, restricted to trusted extension contexts. Restarting Chrome, disabling, reloading or updating the extension clears these credentials. Sign out clears them too and pauses the companion; existing website login cookies are separate. Legacy credentials in local and Chrome sync storage are deleted, not migrated. Optional grader passwords are used only for the corresponding grader and are not sent to SlabTracked. PSA credential replies remain restricted to the top-level Collectors sign-in page. Preferences use Chrome sync storage. Order caches, pending jobs, retry state and diagnostic activity remain device-local; this update does not encrypt or remove those workflow records. Broad tabs permission is removed; matching host permissions still allow coordination on the supported sites. Synced records and status reports are sent to SlabTracked over HTTPS. Removing the extension clears its local data; account data can be deleted through SlabTracked's account controls.
The separate PSA Relay developer extension must be installed with Load unpacked and explicitly enabled. It receives shared search requests from SlabTracked, queries PSA using the operator's browser session, and returns matching search results, images, availability, locale, and submission-context metadata to SlabTracked. It keeps pool settings and retry timing locally, including a one-way authentication fingerprint, and uses Chrome sync storage for its SlabTracked login. Optional automatic PSA session recovery stores the operator's PSA email and password only in the developer extension's local storage, never Chrome Sync or SlabTracked. The Collectors host permission lets it submit those credentials only on the Collectors sign-in page in its own maintained relay tab. It reopens or refreshes that tab every 20 minutes while Chrome runs and pauses for verification or login failures. Forget PSA credentials removes the saved PSA login and disables automatic sign-in. It does not copy browser cookies or upload PSA credentials to SlabTracked. Its request-header rules apply only to its own PSA API requests. Disabling it stops relay polling and maintenance; disconnecting also clears its SlabTracked login. Version 1.1.1 changes only relay request timing and adds no data collection or permissions. Developer relay 1.3.0 adds optional draft recovery in its own maintained tab. It reads existing draft IDs and empty-card counts locally, can select a service level for an empty draft, and verifies search before adding that draft to the relay pool. Choosing the lowest-priced available service is a separate option. It stops at Item Entry and never creates or submits an order, adds cards, or pays. Draft lists are not uploaded to SlabTracked; the successful relay submission ID and region remain part of the existing availability metadata. This uses the existing PSA host permission and adds no new host access. This developer tool is excluded from the regular companion and its Chrome Web Store package.
SlabTracked's use of information received from the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Extension data is used to provide and improve the disclosed grading and inventory features, not for advertising or sale. We do not collect general browsing history.
| Permission | Purpose |
|---|---|
| storage | Store preferences and the SlabTracked login in Chrome sync storage; keep order state and optional grader logins locally |
| scripting | Read private grader submission/order data and assist with grading submission forms and Whatnot inventory |
| tabs, tabGroups | Coordinate grader workflows and keep one reusable CGC tracking tab visibly contained in the SlabTracked group |
| cookies | Detect grader sessions, authenticate with SlabTracked, and reset only a staged CGC form draft; grader cookies are not uploaded to SlabTracked |
| notifications | Alert you when a tracked submission changes status |
| alarms | Schedule periodic background syncs |
We do not sell, rent, or share your personal data with third parties for advertising or marketing, and your synced collectible data is associated only with your own SlabTracked account. We share data with service providers only as needed to operate SlabTracked:
To exercise these rights, email privacy@slabtracked.com.
We use session cookies for authentication and browser/extension storage to remember your preferences and keep synced data available locally. The extension stores data locally on your device and communicates with our servers only to sync your own data. You can clear this data at any time through your browser settings.
SlabTracked is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact privacy@slabtracked.com and we will delete it.
We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use of SlabTracked after changes constitutes acceptance of the updated policy.
Questions about this policy or our data practices? Email privacy@slabtracked.com.