Privacy policy

We built PokeTracer to help collectors track, value, share, and scan Pokemon TCG collections without turning their data into someone else's product. In plain English:

• We collect the data needed to run the app: account details, collection data, card scanner uploads/results, billing status, cookie choices, and operational logs.
• We never sell your data. Ever.
• Payments are handled by Stripe. We store Stripe customer/subscription identifiers, but never your full card number.
• Scanner images are stored privately and processed by our scanner pipeline. They are not public, but they are not processed only in-memory.
• You can export your data, request deletion, manage cookies, and cancel paid plans from the app where those controls are available.

This policy applies to the PokeTracer web app, API, scanner, billing, support, and public sharing features. For GDPR purposes, the controller is KMDevelopmentNL, trading as PokeTracer, Netherlands.

Privacy questions, access requests, and deletion requests can be sent to privacy@poketracer.com. Security issues can be sent to security@poketracer.com.

When you use PokeTracer, we collect:

• Account and profile data: name, email, password credentials or Google sign-in identifiers, handle, avatar/profile image where provided, optional location, bio, display preferences, and account security metadata.
• Collection data: binders, cards, quantities, variants, grades, notes, purchase prices, wishlists, exports, share settings, and price alert rules.
• Scanner data: photos or image files you upload, generated crops/outputs, detected card candidates, matching scores, run status, error messages, queue metadata, and scanner logs needed to debug and improve matching.
• Billing data: plan, billing interval, Stripe customer ID, subscription ID, price ID, payment status, invoice/receipt links, and cancellation status. Full card numbers are handled by Stripe and are not stored by PokeTracer.
• Support and privacy requests: messages, feedback, export/delete/reset requests, and the metadata needed to handle them.
• Technical data: IP address, browser/device information, cookie consent, session identifiers, CSRF tokens, API logs, rate-limit events, security events, and diagnostics.

We use personal data only where we have a legal basis, including performance of the service contract, legitimate interests such as security and reliability, consent for optional cookies/communications, and legal obligations such as accounting and abuse handling. We use your data to:

• Create and secure your account, including email/password login and Google sign-in.
• Show, sync, export, and share your collection where you choose to make a binder public.
• Run the card scanner, including processing private uploads or camera captures and returning card matches.
• Provide price data, price alerts, notifications, changelog/status updates, and support.
• Create Stripe Checkout sessions, manage subscriptions, apply webhooks, provide the billing portal, and keep tax/accounting records.
• Measure reliability, prevent abuse, investigate failures, and improve product quality using aggregated or minimized diagnostics where possible.

We use service providers to run PokeTracer. They may process personal data only as needed for their role, subject to their own terms and data protection commitments. Depending on your use and our deployment configuration, these include:

• Hosting, database, queues, and private file storage: Laravel Cloud and configured S3-compatible storage such as Cloudflare R2 for app infrastructure, logs, scanner uploads, and outputs.
• Stripe: subscription checkout, invoicing, payment method updates, receipts, billing portal, and payment-related fraud prevention.
• Google: Google sign-in. Google shares your name, email address, and profile picture with us only after you approve the sign-in flow.
• Scrydex: card metadata, set data, images, listings, population reports, and market pricing information used to power search and collection features.
• Scanner processing: uploaded images or camera captures may be processed by PokeTracer scanner infrastructure to detect and match cards.
• Email and support providers: transactional email, support replies, product notices, and security communications.
• Analytics providers: only if analytics cookies are enabled or configured. We do not allow advertising trackers on PokeTracer.

If you enable public sharing, the selected collection data becomes visible to anyone with the public link. This can include your public handle, display name, avatar/profile image or initials, bio/location if shown, selected binders, card lists, quantities, variants, and collection value displays. Keep private binders private if you do not want that information public.

If the GDPR or similar privacy law applies to you, you can ask us to:

• Access the personal data we hold about you, including by using the privacy export in Settings where available.
• Correct inaccurate profile or collection information.
• Delete your account or specific data where we no longer need to keep it.
• Restrict or object to certain processing, including optional communications and non-essential cookies.
• Port collection data in a structured format such as CSV or JSON where available.
• Withdraw consent where processing depends on consent, without affecting earlier lawful processing.

We keep data only as long as it is needed for the service, security, accounting, dispute handling, or legal duties. Current retention principles:

• Account, profile, collection, alerts, and share settings are kept while your account is active.
• Scanner uploads, crops, outputs, run metadata, and logs are kept privately for operational debugging and matching quality, then deleted or anonymized when no longer needed. Deleting your account removes user-linked scanner runs unless we must keep limited records for security, dispute, or legal reasons.
• Session, security, and diagnostic logs are usually kept for a short operational period unless needed to investigate abuse or failures.
• Billing, invoice, tax, and accounting records may be kept for up to 7 years or longer where required by law.
• Backups are rotated on the infrastructure provider schedule and may briefly retain deleted data until overwritten.
• Aggregated or anonymized statistics that cannot reasonably identify you may be kept indefinitely.

Some providers may process data outside your country or the European Economic Area. When this happens, we rely on appropriate safeguards such as data processing agreements, standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms offered by the provider.

We use reasonable technical and organizational measures such as HTTPS, private storage, authentication, access controls, queue isolation, logs, and least-privilege handling. No internet service can guarantee perfect security, so please use a strong password, protect your Google account, and contact security@poketracer.com if you suspect unauthorized access.

PokeTracer is not directed at children. You must be old enough to consent to digital services in your country, and at least 16 in the EEA/UK unless a parent or guardian validly consents. If you believe a child has created an account without proper consent, contact us and we will take appropriate action.

If we update this policy, we will change the "Last updated" date. For material changes, we will take reasonable steps to notify active users, such as email or in-app notice, before the change takes effect where required.

Privacy contact: privacy@poketracer.com

General support: support@poketracer.com

If you are in the EU and believe we have not handled your privacy request properly, you may also complain to your local supervisory authority, including the Dutch Autoriteit Persoonsgegevens where applicable.