Privacy Policy

01Overview

CarteDex is a trading card game (TCG) scanner and collection manager for Pokémon and Magic: The Gathering cards, published by Tech52 Apps. The app is local-first: you can use it without an account, and your collection stays on your device. If you sign in, you can enable cloud backup, shared collections and friends.

02Information we collect

• Account and authentication. If you sign in with Google or with Apple, Firebase Authentication provides a unique user ID and, depending on the provider and your choices, your email address.
• Collection data. Cards you add or scan, including card ID, name, set, number, image URL, rarity, quantity, finish (normal, holo, reverse holo, foil), condition, language, first-edition flag, and timestamps.
• Shared collection metadata. If you create or join a shared collection we store the collection name, owner UID and email, member UIDs, and join requests (requester UID/email and timestamp).
• Friends data. If you use the friends feature we store a generated friend code linked to your account, pending friend requests, and friend links between accounts. Friends with an active subscription can view the contents of your collection.
• Subscription status. Whether your CarteDex Pro entitlement is active, so the app and our servers can unlock paid features.
• CardTrader token (optional). If you add a personal CardTrader token for price lookups, it is kept in your device's encrypted secure storage and used only to call CardTrader APIs.
• Feedback you send. If you use the in-app feedback or bug report form, the message you write and basic technical context are sent to our feedback provider.
• Diagnostics. Basic crash or diagnostic data may be collected by platform services.

03Camera access and on-device processing

Camera access is used to scan cards. Images are processed on your device using a local machine-learning model and are deleted immediately after processing. We do not upload or store camera images on our servers.

04Price lookups

CarteDex can show card prices from two sources, and each works differently:

• Cardmarket (Europe). The app requests prices from a price service operated by Tech52 Apps, which returns figures derived from Cardmarket's daily price guide. Requests contain the card identifiers being priced and an app-attestation token; if you are signed in, they may also carry your authentication token. We do not use these requests to build advertising profiles.
• CardTrader (Italy). Requests are sent from your device directly to CardTrader using the personal token you provide. Your token is never sent to our servers.

05Notifications

If you allow notifications, CarteDex can alert you on-device when cards in your collection rise noticeably in price. These notifications are generated locally on your device from your own collection data; they are not push messages sent from our servers.

06How we use information

• Authenticate you and secure your session.
• Store your collection locally and, if enabled, back it up to Firebase.
• Enable shared collections and friend connections you explicitly create, join or accept.
• Fetch card details and images from third-party card databases.
• Provide price lookups and collection value history.
• Verify your CarteDex Pro entitlement and unlock paid features.
• Respond to feedback and bug reports you choose to send.

07Where data is stored

• On device. Local SQLite databases store your collection, cached prices and price history. App settings are stored in local app preferences; your CardTrader token is stored in the platform's encrypted secure storage.
• Cloud (optional). If you sign in and enable cloud features, your collection data, shared-collection metadata and friends data are stored in Firebase (Google Cloud).

08Sharing of information

We do not sell your personal information. We share data only to provide the app's features. If you join a shared collection, other members can access that collection's data, and the owner's email is stored with the collection to identify the owner. If you accept a friend, that person can view your collection contents while both of you hold an active subscription. You can remove a friend at any time from the Friends screen.

09Third-party services

The app relies on third-party services to provide core functionality:

• Firebase — Authentication, Firestore and App Check — Privacy Policy
• Google Sign-In and Google Play Services — Privacy Policy
• Sign in with Apple — Privacy Policy
• RevenueCat, for subscription status and purchase entitlement management — Privacy Policy
• Google Mobile Ads, for advertising and consent management — Privacy Policy
• Wiredash, for in-app feedback and bug reports you choose to send — Privacy Policy
• TCGdex for Pokémon card metadata and images; Scryfall for Magic: The Gathering card metadata and images.
• CardTrader API, for price data when you provide a token.
• Google Cloud, which hosts the Cardmarket price service operated by Tech52 Apps.

These services may receive your IP address and standard request metadata.

10Legal bases for processing (GDPR)

• Contract performance. To provide core app features, including managing your collection, shared collections and subscriptions.
• Consent. For optional features such as sign-in, cloud backup and restore, friends, notifications, personalised advertising where required, and CardTrader price lookups, when you choose to enable them.
• Legitimate interests. To maintain app security, prevent abuse, and improve stability and performance.

11Your GDPR rights

If you are located in the European Economic Area, you have the right to access your data, correct inaccuracies, request deletion, restrict or object to processing, and request data portability.

To exercise these rights, contact us at info@tech52apps.com. You can also use the account deletion flow described at Account Deletion. You also have the right to lodge a complaint with your local data protection authority.

12International transfers

If you enable cloud features, your data may be processed by Google Firebase on servers outside your country. Google applies appropriate safeguards for international data transfers as described in their privacy documentation.

13Data retention and deletion

Local collection data remains on your device until you remove it or uninstall the app. Cloud data is retained while you use cloud features. You can delete your account in the app or request deletion using the public instructions at Account Deletion.

14Children's privacy

The app is not directed to children under 13. We do not knowingly collect personal information from children under 13.

15Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the effective date above.

16Contact

17Related documents