Privacy Policy

Information We Collect

Account Information

When you create an account, we collect:

• Email address — used for authentication and account recovery
• Username — a public display name you choose
• Apple ID token — if you sign in with Apple, we receive a unique identifier and, on first sign-in only, your name and email as provided by Apple
• Google ID token — if you sign in with Google, we receive a unique identifier and your name and email as provided by Google

Collection Data

When you use the Service, we store:

• Your card collection (cards you own, quantities, and custom lists/decks you create)
• Any notes you add to list entries

Search Queries

When you search for cards — including Art Search, our semantic (meaning-based) search — the text of your query is sent to our servers and processed as described under Third-Party Services below. On the server we:

• Send your query text to Voyage AI to find relevant cards
• Record queries in our server-side operational telemetry (see Analytics & Monitoring) for performance and reliability

Search query handling happens entirely on the server. The app on your device does not log or store your searches.

Automatically Collected Information

• Device-local cache — card data and price sync timestamps are cached on your device to improve performance. This data never leaves your device.

Information We Do NOT Collect

• We do not collect location data
• We do not use analytics or tracking SDKs in the app (the app itself does not track or profile you; server-side operational telemetry is described below)
• We do not collect crash reports from your device
• We do not access your contacts, photos, or files
• Camera access is used only for real-time card scanning via on-device OCR. No images are stored, transmitted, or saved.

How We Use Your Information

We use your information solely to:

• Authenticate you and maintain your account
• Store and display your card collection and lists
• Power card search, including Art Search, to find cards that match what you're looking for
• Monitor and maintain the performance and reliability of the Service
• Enable sharing of lists via public links (only when you explicitly choose to share). Shared lists publicly display your username as the creator.

Third-Party Services

Authentication

We use Supabase for authentication. Your email and authentication tokens are processed by Supabase. Sign-in with Apple and Sign-in with Google are also handled via Supabase using their respective identity tokens. See Supabase's Privacy Policy, Google's Privacy Policy, and Apple's Privacy Policy.

Semantic Search (Art Search)

Art Search uses Voyage AI (a MongoDB company) to understand the meaning of your search. The text of your query is sent to Voyage AI and used to find relevant cards. We send only the query text — not your account or identity. See Voyage AI's Privacy Policy.

Affiliate Links

When you tap the eBay or TCGplayer shop buttons, you are redirected to those platforms through affiliate links. These links contain tracking parameters that allow us to earn a commission on purchases you make. We do not receive any information about your purchases or browsing activity on those platforms.

• eBay Partner Network: Privacy Policy
• TCGplayer via Impact: Privacy Policy

Hosting

Our backend services are hosted on DigitalOcean. Your data is stored in databases managed by us on our infrastructure. See DigitalOcean's Privacy Policy.

Analytics & Monitoring

We send server-side operational telemetry to Grafana Cloud (Grafana Labs) to monitor the performance, reliability, and usage of our backend. This telemetry is generated on our servers — not by the app on your device — and may include search query text. See Grafana Labs' Privacy Policy.

Data Retention

We retain your data for as long as your account is active. You can delete your account at any time from the Settings screen within the app. When you delete your account:

• Your user profile is deleted immediately
• Your collection data (owned cards, lists, and list entries) is deleted shortly after
• Your authentication record is removed from our auth provider

Data Security

We use industry-standard measures to protect your data, including:

• All data transmitted between the app and our servers is encrypted via HTTPS/TLS
• Authentication tokens are stored securely on your device
• Passwords are managed by our authentication provider and are never stored by us directly

Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it.

Your Rights

You have the right to:

• Access your data — visible in the app (your profile, collection, and lists)
• Deleteyour data — use the “Delete Account” option in Settings
• Export your data — your collection is visible and can be shared via list sharing

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the “Last updated” date at the top of this page.

Contact Us

If you have questions about this Privacy Policy, contact us at:

Email: [email protected]