Privacy Policy

The data controller is TCG Card Scanner, a private hobby project (“we”). Send questions about your personal data, and requests to exercise your rights, to support@tcgcardscanners.com.

• Account: email address, an internal account ID, your password stored as an encrypted hash (never in plain text), a display name if you give one, and temporary verification and reset codes.
• Collection: the cards and sealed products you save, with name, set, number, product type, condition, the AI's notes, market price, a link to the official product image and when you saved them. We also store a daily value of your collection for the price charts.
• Plan and usage: your subscription plan and renewal date, scans left per mode, scan packs bought, and your referral code and number of referrals.
• Technical information: your IP address is used briefly to limit the number of requests and protect the service from abuse. Our hosting provider logs incoming requests, and our server logs can contain your email address for some account events, such as an account being deleted.
• Only on your phone: your watchlist, your own folders and settings such as currency, language and notifications are stored only in the app and are never sent to us.

• The app uses the camera, or photos you pick from your photo library, only when you scan a card or sealed product yourself. You grant this permission on your phone and can withdraw it at any time in your phone's settings.
• The photo is sent encrypted to our server and on to Anthropic to identify the card or product and, in Authenticity and Pre-Grading mode, to assess authenticity and condition.
• We don’t store your photos. A photo exists only in memory while it is being analysed. Your collection never stores your photo, only the official product image from our catalog.
• Photos are not used to recognise people. Photograph only the card or the packaging. If a person appears anyway, the photo is handled the same way and is not stored.
• Under Anthropic's terms for its API, images sent through the API are not used to train its AI models, and are kept only for a limited time for safety and abuse prevention.

• Contract: to create and run your account, identify what you scan, store your collection and keep track of your plan and scans.
• Legitimate interest: to protect the service from abuse, troubleshoot and improve it, and for anonymous visitor statistics on the website.
• Consent: for the app to use the camera and photo library, through your phone's permission prompt.
• Legal obligation: to keep accounting records once payments are introduced.

• Anthropic (USA): AI analysis of the photos you scan.
• Render: runs our server, our databases and the website.
• Resend (USA): sends verification and reset codes to your email address.
• Cloudflare: domain name and anonymous, cookie-free visitor statistics for the website.
• Expo (EAS): builds the Android app and delivers the file when you download it.
• Card and price data: Pokémon TCG API, TCGdex, TCGCSV (TCGplayer's data) and Cardmarket. Our server sends them only card and product names, never your personal data. The app loads product images straight from their image servers and exchange rates from the European Central Bank, so they see your IP address, just as when you visit a web page.
• Payments: purchases are switched off during the beta and we process no payment details. When payments are introduced they will go through a payment provider or app store. We never receive your card number, and this policy will be updated with the provider's name before then.

We never sell your data, and the app uses no advertising or tracking tools.

Some of the services above operate in the USA. Data transferred there is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, depending on the provider.

• Account and collection data is kept until you delete your account.
• Verification and reset codes are valid only for a short time and are removed once used.
• IP addresses for abuse protection are held in memory for about a minute.
• Server logs are kept for a limited time by our hosting provider and then deleted automatically.

You can delete your account directly in the app under Profile → Account settings → Delete account. Your account, every saved card and product, and your collection's price history are then deleted immediately and permanently from our server, and the app clears what it has stored locally. Data left in server logs disappears when the logs are cleared. You can also ask us to delete your account by emailing support@tcgcardscanners.com.

• Find out what data we hold about you and get a copy of it.
• Correct inaccurate data. You can change your email address and name yourself in the app.
• Have your data deleted, see section 8.
• Restrict or object to certain processing, and receive your data in a machine-readable format.
• Withdraw consent, for example the camera permission.

Email support@tcgcardscanners.com and we'll reply within one month. You also have the right to complain to a supervisory authority, in Sweden the Swedish Authority for Privacy Protection (IMY), or the authority in your own country.

The service is not aimed at children under 13. If you are under 13, you need a parent's or guardian's permission to create an account. If you believe a child has given us data without permission, contact us and we'll delete it.

All traffic between the app and our server is encrypted. Passwords are stored only as hashes, sign-in uses time-limited tokens and an account can only be deleted with its password. No method is completely secure, but we work to protect your data.

The website uses no cookies. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't track you across websites. Your language choice is stored locally in your browser. Fonts are loaded from Google Fonts, which means Google sees your IP address.

We update this policy when the service changes. The date at the top shows when it last changed, and we announce significant changes in the app or on the website.