Privacy Policy

Data Controller

Tevin Tober · Trachtenweg 5a · 33607 Bielefeld
devtev94@gmail.com

What the App Processes

Camera

Used only for scanning cards. No images are saved or transmitted.

Collection data

Stored locally on your device. No third party has access. A collection only leaves your device if you explicitly share it — encrypted, see “Shared collections”.

tcgdex.dev API

Used for card images. We transmit nothing about you; retrieving an image necessarily reveals your IP address to the provider.

Price API

Card prices (Cardmarket data) are retrieved via our own price API. Only the card's product ID is transmitted. Operated on our own server at STRATO GmbH (Germany); the IP address is not stored, in the access log it is only truncated and deleted after two days.

Promo codes

When a promo code is redeemed, the app transmits nothing but the code itself to our server. Only the code and the time of redemption are stored — no device ID, no user identifier. In the access log the IP address is truncated and deleted after two days.

PokéAPI Artwork

Pokémon images are displayed via the public PokéAPI (https://pokeapi.co/). We transmit nothing about you; retrieving an image necessarily reveals your IP address to the provider.

eBay Affiliate Links

When opening a link, eBay processes data according to their own policies. We do not transmit anything.

Shared collections

When you share a collection it is stored on our server so everyone involved sees the same state. It is encrypted on your device beforehand. The key sits in a part of the invite link that browsers and apps do not transmit to servers — so we cannot read the contents of a shared collection.

The server holds only: a random identifier, the encrypted contents, a counter for synchronisation, the time of the last change, and per access a token hash plus the key encrypted for that access. No account, no name, no email address, no device ID; the names you give invitations also stay on your device.

No IP address is stored: for rate limiting the IP address is held in memory for at most two minutes as a short value that cannot be reversed, and in the access log it is truncated and deleted after two days. Run on our own server at STRATO GmbH (Germany). Legal basis: Art. 6(1)(b) GDPR.

The owner can delete a shared collection at any time and revoke individual invitations. Without changes we delete it automatically after 180 days.

Advertising — Google AdMob

The app uses Google AdMob for funding. On first launch, you choose whether to see personalized or non-personalized ads — and can change this at any time under . Settings → Ad Preferences

Depending on your consent, Google processes: device information, IP address, usage statistics, and potentially interests. Legal basis: Art. 6(1)(a) GDPR. Data transfers to the USA are based on EU Standard Contractual Clauses.

More info: Google Privacy · Ad Settings

App Tracking Transparency (iOS)

On iOS devices, the app uses Apple's App Tracking Transparency (ATT) framework to request permission before showing personalized ads. This consent is optional — if denied, only non-personalized ads are shown.

If you have consented, Google AdMob may use your device's Advertising Identifier (IDFA) to personalize ads. You can revoke consent at any time in iOS Settings under Privacy & Security → Tracking.

Usage Analytics — Aptabase

The app collects anonymous usage statistics to understand which features are used and where errors occur. No account, no advertising IDs, no cookies, no cross-device tracking.

Collected are app version, operating system, device model, language, region, session length and events such as “card scanned” or “search performed”. Search terms are transmitted only when a search returned no results — that is how we spot missing cards.

The analysis runs on our own server at STRATO GmbH (Germany); the data is not passed on to third parties. The IP address is not stored, only used to derive the region; in the access log it is truncated and deleted after two days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app).

More info: Strato Privacy

In-App Purchases

The app offers an optional premium subscription via the Apple App Store or Google Play Store. Payment processing is handled exclusively by Apple or Google — we do not receive any payment data (e.g. credit card or bank details).

What data Apple or Google processes during a purchase is governed by their respective privacy policies: Apple Privacy · Google Privacy

Data Retention

Collection data remains until manually deleted or the app is uninstalled. Shared collections are deleted from our server automatically 180 days after the last change — or immediately if the owner deletes them. Google AdMob stores data according to its own policies.

Your Rights

Access (Art. 15) · Rectification (Art. 16) · Erasure (Art. 17) · Restriction (Art. 18) · Data portability (Art. 20) · Objection (Art. 21) · Withdrawal of consent (Art. 7(3) GDPR).

For AdMob-related requests please contact Google directly. General questions: devtev94@gmail.com

Changes

This policy may be updated. The current version is always available in the app and on this website.