Privacy Policy

Marius Eckerle, Mauerbergstr. 112, 76534 Baden-Baden, Germany. Email: support@pokefolio.app. VAT identification number under § 27a UStG: DE352888406.

This policy covers the Pokefolio app for iOS and pokefolio.app. It also explains processing by providers used for accounts, subscriptions, technical operation and marketing measurement.

For an account, we process your user ID, email address, display name where provided, sign-in and authentication information, and settings. When you sign in through Apple or Google, we receive the account information released by that provider. Apple may provide a private relay email address. Authentication tokens support sign-in; we do not receive your Apple or Google password.

Account data may include cards, sealed products, quantities, variants, language, condition, grading, purchase prices, collections, wishlists, portfolio values and their history. We use this information to display and synchronize your collection, calculate statistics and provide the functions you select.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide agreed functionality. Account and cloud-synchronization functions require the relevant information and cannot be provided without it. Optional functions are voluntary.

Card recognition runs locally on your device. Scan images are not sent to our backend for recognition or stored there. We do not transmit them to OpenAI or comparable external AI services.

Camera and, where applicable, photo permissions support capture, import or saving functions you choose to use. You can change permissions in your operating-system settings. Refusing a permission limits the corresponding function.

Local image processing does not mean all scan-related information remains on the device. Scan usage counters and collection entries you confirm may be sent to our services to manage usage limits, subscriptions and collections. Necessary processing is based on Article 6(1)(b) GDPR.

We use Supabase for authentication, database, file storage and backend functions. It processes account, collection, settings and usage information needed to provide the service. Supabase Privacy Policy.

Requests to our website, backend and integrated services generate technical connection data such as IP address, timestamp, requested resource, app or browser information and errors. We use this for delivery, security, troubleshooting and abuse prevention. The legal bases are Article 6(1)(b) GDPR for service provision and Article 6(1)(f) for our interest in secure and reliable operation.

Search terms and filters are processed to answer your search request, not retained as a permanent search history for usage analytics. We do not operate a separate automatic crash-reporting service for the app. Technical error logs needed for operation and diagnostic details included in a support request are distinct from such usage analytics.

Apple processes payments through the App Store. We do not receive full card or bank details. We and RevenueCat process information such as app-user or customer identifiers, product and transaction identifiers, purchase times, prices, currency, trials, subscription status, renewals and refunds to verify purchases and provide access.

When available in your account, we also transmit your email address and display name to RevenueCat as customer attributes associated with your app-user ID. RevenueCat may therefore hold directly identifying account information, not only pseudonymous transaction records. On iOS, the app also enables collection of Apple AdServices attribution tokens through RevenueCat to associate purchases with Apple Ads campaigns.

RevenueCat also receives usage attributes, including counts of cards, products, collections, scans and price alerts, and the Postback install identifier. These support product-usage analysis and subscription revenue attribution. The identifier links purchase history to an app installation; this information is not anonymous.

Purchase verification and access provision rely on Article 6(1)(b) GDPR; legally required records rely on Article 6(1)(c). Section 7 discusses additional product and marketing measurement. RevenueCat Privacy Policy; Apple Privacy Policy; Google Privacy Policy.

Where information about consumption of purchased services is provided to a store in connection with a refund request, applicable legal requirements, including any required separate consent, apply. This policy does not provide that consent.

We use Postback.sh, provided by Tap & Swipe in France, to attribute app installations and measure marketing performance. Connected services are RevenueCat, Apple Ads, TikTok, Meta and Google; processing depends on the platform and campaign.

Data includes installation and device identifiers (particularly the Postback ID and iOS IDFV), IP address, technical device, app and network information, timestamps, and campaign and referral information. Approximate region may be derived. Advertising identifiers depend on availability and permissions; iOS IDFA is included only with existing ATT authorization. Postback does not request that authorization itself.

The app reports registrations and completed onboarding; recurring automatic session events are disabled. Linking RevenueCat enables trials, purchases, renewals, cancellations, refunds and revenue to be attributed to the installation and marketing source. Marketing links may additionally provide click, referrer and browser data for click-to-install attribution.

Enabled advertising integrations may send selected install, attribution and conversion data to the respective advertising platform, where its own privacy terms also apply. Identifiers can link events; these records are pseudonymous, not anonymous. Further information: Postback, Apple, TikTok, Meta and Google. Sections 7 and 12 explain legal bases and your rights; section 11 covers retention.

We distinguish processing necessary for the app from additional product analytics and marketing measurement. Where additional analysis may lawfully rely on Article 6(1)(f) GDPR, our interests are understanding Pokefolio’s use and reliability and measuring marketing effectiveness. Your interests and fundamental rights must be considered.

Where device access, attribution or disclosure to advertising platforms requires consent under section 25 TDDDG and/or Article 6(1)(a) GDPR, that consent must be obtained separately. App use or acceptance of terms or this policy does not replace required consent. An operating-system permission does not automatically satisfy every privacy requirement.

Pokefolio currently has no dedicated in-app switch for disabling attribution and usage analytics. Device advertising-identifier settings may limit the use of those identifiers but do not stop all processing by Postback or other services. For an objection, deletion request or withdrawal of consent you have actually given, contact support@pokefolio.app. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Our website integrates Vercel Web Analytics and Vercel Speed Insights. These process page views, referring pages, approximate region, browser, operating-system and device information, and performance measurements such as loading times to improve the website and its speed.

Vercel describes Web Analytics as measurement without third-party cookies, using short-lived visitor identification; Speed Insights provides technical performance statistics. This differs from personal install attribution in our apps. Article 6(1)(f) GDPR applies where a lawful balancing of interests permits processing and consent is not required. Further information: Web Analytics, Speed Insights and Vercel Privacy Policy.

Technically necessary local storage may be used for website preferences and, within the app, authentication, settings and locally stored content. Device access is additionally governed by section 25 TDDDG where applicable.

If you enable push notifications, we process device tokens, selected price alerts and preferences for price alerts, collection updates and news, such as new set releases and product announcements. The relevant platform’s notification services deliver notifications. You can change operating-system permissions and available in-app notification settings. Necessary processing for requested alerts relies on Article 6(1)(b) GDPR, or Article 6(1)(a) where consent is required.

For support requests and voluntary feedback, we process contact information, messages, attachments and diagnostic information included in your request. When you open a support email from the app while signed in, the email draft is automatically filled with your user ID, Pro status, app version, iOS version and device model. You can review the draft before sending; opening it alone does not send the email. The contact form sends your name, email address and message to our website server, which forwards them to support@pokefolio.app through an email service provider. Form entries are not stored in our own website database. For abuse prevention, short-lived hashed IP identifiers and request counters may be processed in the respective server instance’s memory for up to ten minutes, based on Article 6(1)(f) GDPR. The basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) for handling other enquiries and product feedback.

Opening external marketplace or affiliate links provides the destination with connection and referral data. Affiliate identifiers may attribute a qualifying purchase and commission. The destination’s privacy notice applies to its processing. Opening a marketplace link does not involve sending your full collection or payment details to that marketplace.

Recipients include the infrastructure, authentication, notification, purchase, analytics and attribution providers used for the relevant purpose and the enabled advertising platforms listed in section 6. Disclosure may also be necessary to comply with legal obligations or establish, exercise or defend legal claims.

International providers may process data outside the European Economic Area, particularly in the United States. Postback identifies Cloudflare and Neon as infrastructure and database providers. International transfers must satisfy Articles 44 et seq. GDPR, for example through an applicable adequacy decision or EU Standard Contractual Clauses with necessary supplementary safeguards. You can request information on safeguards for a specific transfer from support@pokefolio.app.

Account and collection information is stored to provide your account and the functions you use. You can initiate account deletion in account settings or contact support@pokefolio.app. Uninstalling the app alone does not delete the backend account or cancel a store subscription.

We do not store scan images in our backend. No fixed automatic deletion period is currently configured for identifiable usage and attribution records. Relevant criteria are the processing purpose, the need to retain the association and statutory deletion and retention obligations. A user ID alone does not justify indefinite retention.

Postback describes retaining attribution data for the duration of an active client account and raw click data for 30 days. These periods concern our client relationship with Postback; deleting your Pokefolio account does not automatically remove all related provider records. Valid deletion requests must also address personal data held by service providers, subject to legal exceptions.

Deleting your Pokefolio account also does not automatically erase purchase records, customer attributes or other records held by RevenueCat. A request to erase personal data held by these providers can be made through the contact address above; legal retention requirements and other statutory exceptions remain applicable.

Legally required records and information needed for specific legal claims may remain for the applicable period. Backup copies may persist until normal rotation. Only statistics that are actually and irreversibly anonymous may be retained independently of personal-data retention periods.

Subject to the GDPR, you have rights of access (Article 15), correction (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You may withdraw consent with effect for the future.

Under Article 21, you may object on grounds relating to your particular situation to processing based on Article 6(1)(f). You may object to direct marketing at any time. Send requests to support@pokefolio.app. These rights are subject to their statutory conditions and exceptions.

You may complain to a data protection authority, particularly where you live or work or where an alleged infringement occurred. At our place of business, the authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. We do not make solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.

Pokefolio is intended for users aged 13 and over. Additional legal requirements apply to contracts and consent involving minors, including permission from a legal representative where required. Contact us with questions concerning processing of a minor’s data.

We update this policy when functionality, processing or legal requirements change. The date above identifies the version. We provide appropriate notice of material changes. Updating this policy does not grant new consent.