Dexly Privacy Policy

Dexly helps you browse the Pokémon Trading Card Game catalog, scan cards to identify them, and track your collection across devices. Unlike some of our other apps, Dexly uses accounts and a backend server so your collection can sync and so you can share lists with other collectors. This policy explains exactly what we collect, who processes it, and the controls you have.

1. Accounts & Authentication

Sign-in is handled by Firebase Authentication, a Google service. You can sign in with Sign in with Apple, Google, or email and password. Depending on the method, Firebase processes:

• Your email address and (where provided) display name
• A unique account identifier (Firebase UID)
• Your password, if you use email sign-in — set and verified by Firebase; we never see or store it
• The authentication tokens needed to keep you signed in

If you use Sign in with Apple, we store an encrypted Apple refresh token solely so we can honor your request to delete your account. We store your email, display name, and chosen sign-in providers on our own server to operate your account.

2. Collection Data You Create

When you track cards, we store that data on our server so it syncs across your devices:

• Cards you mark as owned, wanted, or for trade, and quantities
• Condition, grading details (company, grade, cert number), notes
• Acquisition details you choose to add (price, currency, date)
• Custom lists you create, including their names and descriptions
• Lists you follow from other collectors
• Your app preferences (theme, display density, notification and privacy settings)

3. Public Lists

Custom lists are public by default. When a list is public, its name, description, the cards it contains, and your display name can be seen and followed by other users. Do not put information you want to keep private into a list name or description. You control whether a list is public.

4. Card Scanning

Scanning runs on your device. The app ships with its own card-recognition model and matches the captured image locally. The image is not uploaded, and no third party ever sees it.

Some older devices cannot run that model. On those, the captured image is sent to our own server, which runs the same model and returns a match. The image is held only for as long as it takes to produce that match and is never stored.

We keep a count of how many scans you (or, for guests, your device) have made in order to enforce free-tier scan limits. If you scan without an account, we generate a random device identifier held in your device's secure storage. It is not tied to your identity and is used only to meter free scans.

5. Analytics & Advertising Measurement

The app includes Google Firebase Analytics, which collects usage and diagnostic data to help us understand how the app is used and improve it. This can include an app-instance identifier, device model and operating system, app version, in-app events, and a coarse, IP-derived location (such as country). We do not use this data for advertising and do not sell it. For details, see Google's Firebase privacy information.

We advertise Dexly on other platforms. To learn which ads actually lead to installs, the app includes AppsFlyer, a mobile attribution service. When you install the app, AppsFlyer processes your IP address, device model, operating system version, app version, and install and launch timestamps, and reports to the advertising platform that ran the ad — currently Reddit — whether the install came from one of our campaigns.

We do not collect your device's advertising identifier. The app does not request the Google Advertising ID or Apple's IDFA, and the AppsFlyer SDK is explicitly configured not to read them. Attribution is therefore approximate. We use this only to measure whether an ad campaign works. We do not build advertising profiles, and we do not target you across apps. See AppsFlyer's Privacy Policy and Reddit's Privacy Policy.

6. Subscriptions & Purchases

Dexly Pro is offered as a subscription. Payments are processed by Apple (App Store) or Google (Google Play); we never receive your card or payment details. Subscription status is managed through RevenueCat, which processes your purchase history, entitlement status, and an anonymous app-user identifier solely to manage your subscription. See RevenueCat's Privacy Policy.

7. Hosting & Storage

Our backend and database run on Google Cloud Platform. Catalog and card images are served from Google Cloud Storage. Your account and collection data are stored in our database on this infrastructure.

8. Third Parties We Use

• Google Firebase — authentication and analytics
• Google Cloud Platform — hosting, database, and image storage
• RevenueCat — subscription management
• AppsFlyer — measuring which ad campaigns lead to installs
• Reddit — advertising platform, receives the install measurement described above
• Apple / Google Play — payment processing for subscriptions

We do not sell your personal data. The only data shared with an advertising platform is the install measurement described in section 5, and it is never used to build a profile of you or to target you across other apps.

9. Your Rights & Control

• Edit your profile and collection at any time in the app
• Set any list to private, or delete lists you created
• Request a copy of your data via Profile → Download my data; we email you an export of your collection
• Delete your account from within the app — this permanently erases your collection after a short grace period
• Manage or cancel your subscription in your Apple ID or Google Play account settings

10. Children's Privacy

Dexly is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal data, contact us and we will remove it.

11. Legal Notice

Dexly is an unofficial, independent app and is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, Creatures Inc., or The Pokémon Company. All Pokémon names, cards, and trademarks are the property of their respective owners.

12. Contact

Questions? dev@mordsmith.com