CardCollector Privacy Policy

CardCollector helps you browse the Pokémon Trading Card Game catalog, scan cards to identify them, and track your collection across devices. Unlike some of our other apps, CardCollector uses accounts and a backend server so your collection can sync and so you can share lists with other collectors. This policy explains exactly what we collect, who processes it, and the controls you have.

1. Accounts & Authentication

Sign-in is handled by Firebase Authentication, a Google service. You can sign in with Sign in with Apple, Google, or email and password. Depending on the method, Firebase processes:

• Your email address and (where provided) display name
• A unique account identifier (Firebase UID)
• Your password, if you use email sign-in — set and verified by Firebase; we never see or store it
• The authentication tokens needed to keep you signed in

If you use Sign in with Apple, we store an encrypted Apple refresh token solely so we can honor your request to delete your account. We store your email, display name, and chosen sign-in providers on our own server to operate your account.

2. Collection Data You Create

When you track cards, we store that data on our server so it syncs across your devices:

• Cards you mark as owned, wanted, or for trade, and quantities
• Condition, grading details (company, grade, cert number), notes
• Acquisition details you choose to add (price, currency, date)
• Custom lists you create, including their names and descriptions
• Lists you follow from other collectors
• Your app preferences (theme, display density, notification and privacy settings)

3. Public Lists

Custom lists are public by default. When a list is public, its name, description, the cards it contains, and your display name can be seen and followed by other users. Do not put information you want to keep private into a list name or description. You control whether a list is public.

4. Card Scanning

When you scan a card, the captured image is sent to Scrydex, a third-party card-recognition service, to identify the card. The image is used only to return a match and is not stored on our servers. We keep a count of how many scans you (or, for guests, your device) have made in order to enforce free-tier scan limits. See Scrydex's Privacy Policy.

If you scan without an account, we generate a random device identifier stored in your device's Keychain. It is not tied to your identity and is used only to meter free scans.

5. Analytics

The app includes Google Firebase Analytics, which collects usage and diagnostic data to help us understand how the app is used and improve it. This can include an app-instance identifier, device model and operating system, app version, in-app events, and a coarse, IP-derived location (such as country). We do not use this data for advertising and do not sell it. For details, see Google's Firebase privacy information.

6. Subscriptions & Purchases

CardCollector Pro is offered as a subscription. Payments are processed by Apple (App Store) or Google (Google Play); we never receive your card or payment details. Subscription status is managed through RevenueCat, which processes your purchase history, entitlement status, and an anonymous app-user identifier solely to manage your subscription. See RevenueCat's Privacy Policy.

7. Hosting & Storage

Our backend and database run on Google Cloud Platform. Catalog and card images are served from Google Cloud Storage. Your account and collection data are stored in our database on this infrastructure.

8. Third Parties We Use

• Google Firebase — authentication and analytics
• Google Cloud Platform — hosting, database, and image storage
• Scrydex — card recognition and catalog/pricing data
• RevenueCat — subscription management
• Apple / Google Play — payment processing for subscriptions

We do not sell your personal data and do not use it for cross-app advertising.

9. Your Rights & Control

• Edit your profile and collection at any time in the app
• Set any list to private, or delete lists you created
• Request a copy of your data via Profile → Download my data; we email you an export of your collection
• Delete your account from within the app — this permanently erases your collection after a short grace period
• Manage or cancel your subscription in your Apple ID or Google Play account settings

10. Children's Privacy

CardCollector is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal data, contact us and we will remove it.

11. Legal Notice

CardCollector is an unofficial, independent app and is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, Creatures Inc., or The Pokémon Company. All Pokémon names, cards, and trademarks are the property of their respective owners.

12. Contact

Questions? dev@mordsmith.com