1. About this policy
This Privacy Policy explains how PokeSingle ("we", "us", "our") handles personal information when you use the PokeSingle app, its scanning and collection services, and these legal and support pages.
PokeSingle is the service operator and the point of contact for decisions about personal information described here. Contact us at hello@pokesingle.com for privacy questions or requests.
This policy describes the current service. Features and analytics availability can vary by platform, app version, and service configuration. Reading this policy or accepting our Terms of Service does not itself give consent to optional processing where consent is required.
2. Information we handle
| Category | Information and source | Purpose |
|---|---|---|
| Account and sign-in | Your email address, display name, internal account ID, chosen sign-in provider, provider account identifiers, verification status, and authentication/session records. Apple or Google may provide your name, email address, and profile image when available. Apple may provide a private relay address. | Create and secure your account, authenticate requests, manage devices, and recover access. We do not receive your Apple or Google password. |
| Guest use | A technical guest identifier, local preferences, and session credentials. Core collection features can be used without registering a member account. | Keep guest data separate, maintain your session, and transfer your collection when you choose to sign in. |
| Collection and preferences | Saved cards, quantities, card attributes you enter, binder names and contents, watchlist choices, scan results, pending reviews, language, and notification preferences. Data is held on your device and, for connected features, on our servers. | Organize and synchronize your collection, provide prices and requested alerts, and restore synchronized member data. |
| Catalogue and prices | Search terms, filters, selected cards, and price requests you submit to our catalogue and pricing services. | Return requested search results, card details, and price information. Raw search text is not included in our custom analytics events. |
| Images and recognition | Card photographs you capture or select for scanning, cropped or processed copies, extracted card text, recognition candidates, your corrections, and scan metadata such as time, platform, app version, language, camera source, and processing timings. | Identify cards, show scan history and review results, investigate errors, and evaluate and improve recognition quality. |
| Notifications | Installation identifiers, push delivery tokens, platform, time zone, category preferences, delivery records, and pending-review metadata. | Deliver enabled collection summaries, price changes, watchlist opportunities, and scan-review reminders at suitable times. |
| Support | The reply email and message you submit, report category, app version, and language. You control the content of your message. | Receive and answer questions, resolve problems, and prevent support abuse. |
| Usage analytics | App-instance or SDK-generated identifiers, member account ID after sign-in, app opens, screen views, feature interactions, authentication outcomes, scan outcomes/timings, and aggregate collection-operation counts. SDKs may collect device model, operating system, app version, language, session information, and approximate country or region derived from network information. | Understand feature use, measure reliability and product outcomes, and improve the app. |
| Security and service operation | IP address, user agent, request timestamps, session and service identifiers, error categories, and rate-limit records, including hashed abuse-prevention keys where implemented. | Operate the service, authenticate sessions, prevent abuse, investigate faults, and protect accounts. |
Our custom analytics events exclude email addresses, authentication codes and tokens, raw search text, card identities and inventories, binder names, photographs, raw URLs, and raw error messages. This restriction applies to analytics; the app still processes relevant collection and image data to deliver the features you request.
We do not request contacts, microphone access, or precise device location for the current service. Network-derived approximate location is different from GPS location.
3. Camera, photos, and scanning
Camera access lets you photograph a card. The system photo picker lets you select an existing image. Images submitted for a scan are uploaded to our scanning service; recognition is not entirely on your device. On-device image preparation or text recognition may also run before upload.
When capture storage is enabled, the scanning service retains processed input images, card crops, extracted text, results, and feedback for recognition review and quality evaluation. Authorized operators may inspect this material to investigate incorrect results. Separate capture uploads may also be stored with your account where that feature is enabled. Images are not intentionally published as part of your collection.
Photograph cards only. Avoid including faces, addresses, payment details, identity documents, or other private material. You can decline camera access and use other available collection features. You can change camera and photo permissions in your device settings.
4. Analytics and advertising
When enabled for your app build, we use Mixpanel for product analytics and Google Analytics for Firebase for selected usage and outcome events. Some aggregate synchronization events are sent by our API. Analytics providers receive their own SDK or app-instance identifiers. Member activity is associated with an internal account ID after sign-in; guest activity uses SDK-generated identifiers. Signing in can associate earlier app activity with your member activity.
The current Firebase configuration denies advertising storage, advertising user-data use, and ad personalization. We do not currently use these integrations to serve personalized advertising, send email or phone lists for advertising, or request the device advertising identifier. Any future advertising use requiring additional disclosures or permission must be addressed before it starts.
The current app has no dedicated analytics on/off switch or analytics consent dialog. Notification and camera permissions do not control analytics. To object to analytics or request access or deletion, contact hello@pokesingle.com. We will explain the available controls and assess your request under applicable law. A local SDK reset or signing out does not erase historical records already held by an analytics provider.
6. Purposes and legal bases
Where the GDPR or comparable law applies, the relevant basis depends on the activity:
- Providing the service: account access, requested scans, collection storage and synchronization, and requested support are processed as necessary to provide the service under our agreement with you.
- Legitimate interests: proportionate service security, abuse prevention, fault investigation, and service improvement may rely on our interests in operating a safe and reliable service, subject to your rights and a balancing of those interests. Product analytics or recognition evaluation can rely on this basis only where legally permitted.
- Consent: where applicable law requires consent for optional analytics, device access, notifications, or another activity, that consent is required. An operating-system permission does not replace a separate legal consent requirement.
- Legal obligations: we may retain or disclose limited information to comply with binding legal duties.
You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. We do not make decisions producing legal or similarly significant effects about you solely through automated processing. Automated card identification and price estimates are informational tools.
7. Retention and deletion
We retain information for the purposes described here, using the type of information, feature requirements, security needs, unresolved requests, and applicable legal obligations to determine the period:
- Account and collection records: retained while the account or guest workspace is in use, unless you remove individual content or delete the account. Local copies can remain on devices and in backups you control.
- Scan history and captures: retained to support history, feedback, error investigation, and recognition evaluation. The current scanning service does not apply a fixed automatic expiry to every stored capture. Contact us for deletion of scan history or review images that remain outside the member-account deletion process.
- Sessions and verification: credentials have configured validity periods and can be revoked. Expiry of a credential does not necessarily delete every related security record immediately.
- Support and operational records: retained as needed to resolve your request, prevent repeated abuse, investigate incidents, and meet legal obligations. Duration depends on the request or incident and whether a dispute remains open.
- Analytics: provider-side records follow the retention settings of the relevant analytics project. Account deletion does not automatically erase historical provider records. Requests for identifiable analytics data are handled separately with the provider where applicable; genuinely anonymous aggregate statistics may remain.
In-app account deletion removes account-owned database records and revokes sessions. Cleanup of separately stored account captures and external registrations is queued and may complete after database deletion. It does not automatically erase every scan-service review copy or historical analytics record. If you want those records included, contact us so we can locate and address them, subject to identity verification and applicable law. We may need the approximate scan date or another available scan reference; do not send authentication credentials.
Deletion can be subject to limited retention required by law, security needs, or an active legal claim. Backup copies may remain until the relevant backup cycle ends, with access limited to recovery and required purposes. Uninstalling the app alone does not delete a server account.
8. Your choices and rights
- Delete a member account: open Profile → Account & security → Delete account. Confirm the request and reauthenticate if asked.
- Delete a guest collection: open Profile → Collection data → Delete guest collection when using a connected guest account.
- Export your collection: open Profile → Collection data → Export collection. This exports collection information; contact us for a broader personal-data access request.
- Manage notifications: use the notification settings in Profile to change enabled categories. You can also revoke permission in your device settings.
- Manage camera and photos: change access in your device settings. Declining permission prevents the feature that needs that access.
- Make a privacy request: email hello@pokesingle.com or use Profile → Help & support. Tell us whether you want access, correction, deletion, portability, restriction, to object, or to withdraw a consent.
Depending on your location, you may have rights to access, correct, erase, receive a portable copy of, or restrict the use of your information, and to object to certain processing. We may request proportionate information to verify your identity. We respond within the period required by applicable law; GDPR requests are generally answered within one month, with any permitted extension explained to you. You may complain to your local data-protection authority, including in the EU/EEA country where you live, work, or believe an infringement occurred. You do not have to contact us first.
Guest data may be difficult to locate after you lose the device or session. Signing out, disabling notifications, or uninstalling does not replace an account-deletion request. Keep exported files private and delete copies you no longer need.
9. International processing and security
Our providers may process information in countries other than your own, including countries outside the European Economic Area. An EU analytics endpoint does not mean every provider or support operation is confined to the EU. Where required for a transfer, applicable safeguards must be in place, such as an adequacy decision or approved contractual clauses with supplementary measures as appropriate. Contact us for information about the safeguards relevant to your data.
We use safeguards such as encrypted network connections, access restrictions, account-based authorization, protected credential storage, and controlled service credentials. No internet service or storage system can guarantee absolute security. Protect your device and sign-in methods and let us know if you suspect unauthorized access.
10. Children
PokeSingle is a general-audience collector service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Where a higher local age or parental authorization is required, that requirement also applies. If you believe a child has provided personal information without the necessary authorization, contact us so we can investigate and address it.
11. These pages and external websites
These legal and support pages are hosted on GitHub Pages. They do not add analytics scripts, advertising pixels, third-party fonts, or optional cookies. GitHub processes technical request information, including visitor IP addresses, for hosting and security under the GitHub Privacy Statement.
External websites, including Cardmarket and sign-in providers, have their own privacy notices. An embedded marketplace page can use cookies or local storage and receive your network and browsing information. Review that service’s choices before interacting with it. Our app’s analytics exclusions do not control another website’s collection.
12. Updates and contact
We may update this policy to reflect changes to the service or applicable requirements. The date above identifies the current version. Material changes will receive additional notice where required, and any new consent required by law must be obtained before the relevant processing begins.
Privacy and support: hello@pokesingle.com.