Privacy policy

Last updated 29 October 2026

Who we are

CrossCheck TCG (a Chrome extension, its website www.sbm.co.uk and the server they talk to, api.sbm.co.uk) is provided by SBM LABS, LTD, a company registered in England and Wales (company number 17550726), registered office 128 City Road, London, EC1V 2NX. SBM LABS, LTD is the controller of your personal data under UK data protection law. Contact us through the contact form, or by post at our registered office. Using CrossCheck TCG is also covered by our terms of service. CrossCheck TCG isn't connected with ACE Grading, PSA or eBay.

What we collect, and why

• Your Google account's email address and name, when you sign in with Google (on the website or in the extension): to check you're on the beta list and keep you signed in. We ask Google only for your basic profile (the openid, email and profile scopes): we never see your password or anything else in your Google account.
• The waiting list: when you join it, your email and name, when you joined and when you last signed in, and anything you choose to tell us in its note box. We use them to let people in, in turn, and to show you your place.
• Messages you send us through the website's contact form: your name (if you give it), your email address, the topic and your message, and the IP address and browser they came from (to keep spam out). Only we see them, and we use your email address only to reply.
• The listings you check: when you open an eBay listing that looks like an ACE slab, the extension checks it. It sends the eBay item number and site, the listing's title and price, links to its photos (only when the listing doesn't state the certificate number) and the ACE certificate number, with which account asked. The server uses them to find the certificate and send you the result, to note which listings each certificate was seen on, to share its work fairly between users, and to count your daily limits. Once a listing's certificate is found, the server keeps it as that listing's answer for anyone who checks the listing later, so the work isn't done twice; that answer doesn't say who found it.
• Centering lines you place yourself in the extension's Adjust editor, with the listing you opened it from (item number, link, title and price) and how long you spent: kept to improve the measurement. Only your own results use your lines.
• Daily usage counts (lookups, photo readings, editor opens) and when you last used the server: for the daily limits.
• Finds, if the owner turns them on for you: which finds you've seen or hidden, so new ones are marked and hidden ones stay hidden. The finds come from eBay searches our server runs itself (public listings, through eBay's own API); nothing about eBay's sellers is kept.
• The extension's version (its number and which build), sent when it checks for news and updates, and which versions you downloaded from the website or through the extension's update, and when: so we know who has a fix and can help when an update goes wrong.
• Visits to the website, counted without cookies: for each page you open we keep which page it was, the site that sent you there (if any), whether you're on a phone or a computer, your browser's name, a rough country (from your browser's time zone or language, never your location), any campaign name in the link, and whether you clicked Join. To count each visitor once a day we keep a code made from your IP address and browser that changes every day and can't be traced back to you; your IP address isn't kept for this. It tells us how people find the site; it isn't shared with anyone and we don't use it to identify you. Kept for 13 months.
• Technical logs: the server's logs record requests with their IP address and time, for security and to fix problems. They're overwritten automatically as they grow.

Cookies

The website sets one cookie, only when you sign in: it keeps you signed in (it's needed for the site to work). There are no analytics, advertising or tracking cookies: we count visits without them (see above), and nothing from other companies is loaded on our pages.

What stays in your browser

Results, centering pictures and your settings are kept in your own Chrome profile (the extension's local storage) so panels open instantly. The extension only runs on eBay's sites (ebay.co.uk, ebay.com, ebay.ie, ebay.com.au and ebay.ca), where it looks at the pages you open to spot ACE slab listings; other listings aren't sent anywhere. It doesn't read other websites or your browsing history. On eBay search pages it sends the item numbers of the listings shown (with your sign-in) so it can show the results the server already has for them; nothing is looked up for them and the item numbers aren't kept.

Who else is involved

• ACE Grading: our server fetches ACE's public certificate pages and card images. Nothing about you is sent to ACE.
• Google Sign-In: Google confirms who you are when you sign in.
• Linode (Akamai) hosts our server and website in London, UK.

When a listing doesn't state the certificate number, our server reads it from the listing's public eBay photos itself (the QR code on the slab, else the number printed on its label): the photos aren't sent to anyone else.

We don't sell or rent your data, use it for advertising or credit decisions, or share it with anyone else unless the law requires it.

How long we keep it

• The waiting list: until you're let in (then it becomes your account) or you ask us to remove you.
• Messages: until we delete them; ask us and we'll delete yours.
• Your account, usage counts and saved lines: while you take part in the beta. Ask us and we'll delete them.
• Certificate results and listings checked: kept as a shared cache, so the same certificate or listing isn't looked up twice.
• Everything in your browser: until you remove it (the extension's settings page has Wipe all cache) or uninstall the extension.

Your rights

You can ask for a copy of what we hold about you, ask us to correct or delete it, or object to how we use it: use the contact form (choose My data) or write to us at our registered office. If you're unhappy with our answer you can complain to the UK's Information Commissioner's Office (ico.org.uk).

Security

Everything between your browser, the extension and our server goes over https. Sign-in sessions are stored only as one-way hashes, and access to the server is limited to its administrator.

Google user data

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Children

CrossCheck TCG is for people aged 18 and over, and we don't knowingly collect data from anyone younger. If you think someone under 18 has given us their details, tell us and we'll delete them.

Changes

If this policy changes, we'll update this page and the date at the top.