Privacy Policy

This policy covers pokedy.com and the current Pokedy iOS app, including their account, collection, card scan, grading and subscription services. The data controller is Bergen SNC, chemin des Plateires 2, 1009 Pully, Switzerland. For questions or requests about your data, contact pokedy.co@gmail.com.

We process data needed for the service you request, security, support and purchase management. Where the GDPR applies, the legal basis depends on the purpose: performance of the contract, our legitimate interests in operating and protecting the service, legal obligations, or consent where required. A privacy policy does not replace specific consent.

We process your name, email address, Pokedy identifier, optional profile image, account creation and sign-in dates, preferences and session information. You can sign in with Apple, Google or an emailed link; the website also offers other providers where available. Your chosen provider supplies the authorised profile information and identifiers, which may include an Apple relay address.

Pokedy retains identifiers and tokens needed for these connections, including a revocable Apple authorisation. We do not receive passwords for your Apple, Google or other provider accounts. Email sign-in uses Resend to deliver the sign-in link.

On iOS, we process the installation identifier, optional device name, app and operating system versions, session activity and synchronisation information. The installation identifier is hashed for authentication; it is also retained in the push notification register when you register that device for notifications.

We retain added cards, quantities, conditions, languages, collection names and descriptions, wishlist, price and currency preferences and valuation history to manage and synchronise your collection. Grading records include card references, front and back photos, notes, scores, confidence and analysis dates. Additional views can be used to inspect surface defects.

This information provides your results, history and collection features. AI results are estimates, not official certification or decisions with legal or similarly significant effects on you.

Grading sends OpenAI the front and back photos, additional views you supply, the card name, set and rarity, and instructions needed for the analysis. Cloudinary photo URLs may contain technical account and upload identifiers.

AI scanning sends OpenAI the card photo, any detail crops and local text recognition (OCR) lines supplied with the request. It reads visible information and finds the card in the catalogue. This flow does not create an archive of scan photos or scan results in our database; technical request records are nevertheless logged.

When decorative image generation is enabled, OpenAI receives the catalogue reference image and, for some backgrounds, an already generated decorative image. These generations use catalogue references rather than photos of your physical card. Their outputs are stored on Cloudinary and reused for the same card.

Avoid including people, documents or private information in photos. These AI operations send data to an external provider. Its retention, security controls and any use to improve models depend on its terms and provider account settings. We do not guarantee either zero retention or an absolute exclusion of all training. Deleting your Pokedy account does not automatically erase records already held by that provider.

Cloudinary hosts and delivers grading photos and decorative images. Profile images uploaded through website settings use UploadThing. Sign-in and catalogue providers may also host displayed images; loading them sends network information such as your IP address to those providers.

If you enable sharing of an analysis, other people can use its link to view associated photos and results. You can disable sharing or delete the analysis. Copies saved by recipients and already cached images are not instantly erased by this action.

We process account creation, sign-ins, collection actions, grading requests, purchases and technical data to operate the service, understand its use and prevent abuse. Technical records may include request identifiers, errors, versions, processing times and AI service usage. Request limits use fingerprints of the account or IP address; this does not prevent the hosting provider from receiving IP addresses in its own logs.

On the website, our activity register may link actions to a user, visitor and session, with language, context, acquisition category and plan. Events sent from this register to Vercel use limited dimensions without user, visitor or session identifiers. The web measurement tools below have their own processing.

Apple handles payments for iOS purchases. Pokedy receives or verifies transaction, product, purchase account and environment references, dates, renewals, refunds and entitlements to allocate subscriptions and credits and prevent duplicates. We do not receive your full payment card number through this flow.

Stripe handles website payments and subscriptions. Registration through the web sign-in flow may already send your name and email to Stripe to create a customer, even without a purchase. Purchases send necessary account and payment references and limited analytics context to link a payment to its journey. Information entered into payment interfaces is processed by Stripe under its own obligations.

If you allow notifications, we retain the Apple push token, installation identifier, app version and delivery information. Apple Push Notification service (APNs) receives the token, message and grading identifier used to open the result when designs are ready. You can disable notifications in iOS settings. This stops their display without necessarily immediately erasing the server’s technical register.

Resend receives your email address and the contents of sign-in, welcome and collection update messages. A digest may include your name, tracked cards, quantities, wishlist and value estimates. We also retain sending references and delivery, failure, bounce or complaint statuses to monitor sending.

Collection email updates are currently enabled by default for new accounts. You can turn them off and save your choice in website settings at /dashboard/settings#retention-email; digests link to those preferences. This setting covers the digest, not emails needed for sign-in or service operation. A message already accepted or scheduled by the provider may need separate cancellation.

Pokedy may also send marketing emails. You can object at pokedy.co@gmail.com and use the unsubscribe link where provided in the communication. The digest setting does not manage every marketing campaign.

The website uses cookies and local storage for sign-in, language, appearance, some preferences and ongoing journeys. Product analytics uses random visitor and session identifiers, a 30-minute context cookie renewed during activity and local storage that persists until cleared. These data may link an anonymous visit to registration on the same browser.

Vercel Analytics and Speed Insights measure website usage and performance. The website loads Google Tag Manager and a Google AdSense script; Google Ads may also measure conversions when configured. Active tags may send browsing, network, device and conversion data to Google. Tag Manager tags and consent rules depend on website configuration.

You can block or clear cookies and storage in your browser; this may limit features and does not erase data already recorded on servers. The current iOS app contains no integrated advertising. Google and advertising processing described here concerns the website and web pages opened from the app.

Catalogue and pricing services, including TCGdex, Scrydex and eBay, receive card references and criteria needed for searches or estimates. Viewing prices does not connect your eBay account. Following an external link lets the destination website process your visit under its own rules.

When the eBay seller integration is available and you connect it, we retain the eBay identifier and username, OAuth permissions, an encrypted refresh token, marketplace, seller location and policy references, and listing statuses. Approved card information and photos are sent to eBay when you confirm publication.

Disconnecting eBay removes the OAuth connection held by Pokedy without automatically ending published listings. We also process verified eBay account-deletion notifications. Deleting your Pokedy account does not delete your eBay account or data already held by eBay.

Bergen SNC accesses data for operations and support, along with services necessary for the features you use: Vercel hosting, the Supabase PostgreSQL database, Cloudinary, UploadThing, OpenAI, Resend, sign-in providers, Apple, Stripe and catalogue or eBay services. Data may also be disclosed to meet a legal obligation or protect our rights.

Processing is not all limited to Switzerland. The service’s Vercel configuration specifies Frankfurt, Germany, and delivery uses international networks. Resend describes processing in the United States. Cloudinary describes processing in the European Union, United States, United Kingdom, Singapore and Israel. Other providers, including OpenAI, Apple, Google and Stripe, may also process data abroad, including in the United States, depending on the service and settings.

The actual production database region, other countries of access and applicable contractual safeguards need verification for each service. We do not present exclusively Swiss hosting or any particular transfer safeguard as established. You can request information about transfers at pokedy.co@gmail.com.

Account data, collections, wishlist, preferences and analyses remain stored while you use the account, until account deletion under the process below. Deleting an individual item may first hide it while retaining a synchronisation record; it does not always physically erase all copies.

Mobile sessions have a planned validity of 90 days, with cleanup planned after an additional 30 days following expiry. Technical mutation synchronisation records expire after 90 days, and request deduplication records after 24 hours when completed or failed. Actual erasure depends on cleanup tasks running.

After account deletion, billing link fingerprints remain to recognise late notifications and prevent entitlement recreation: a fingerprint of the App Store account token and, where applicable, of the Stripe customer identifier. They expire after 400 days; the Apple fingerprint can receive a new 400-day period when another matching notification arrives before expiry. Technical billing events, external references, dates and message fingerprints may remain without a direct link to the deleted account; there is currently no fixed automatic purge period for these events.

Logs, anonymous web events, synchronisation copies, backups and provider-held data do not all have a fixed retention period defined in the application. Backups may retain copies predating deletion. Actual periods and retention obligations for billing, security or disputes depend on the systems and obligations involved; immediate erasure of all these copies is not guaranteed.

You can request account deletion from the iOS app, use deletion in website settings or email pokedy.co@gmail.com. Deletion affects the account shared by the website and app. It removes collections, wishlist and analyses from the active database, together with sessions, devices, authorisations and other linked data erased with the account.

The process revokes the retained Apple authorisation, requests deletion of the Stripe customer where one exists, and asks Cloudinary to delete grading photos it can associate with controlled account uploads, with cache invalidation. If an external service is unavailable, deletion may remain pending and be retried; a failed request must not be treated as completed deletion.

For controlled uploads, cleanup of abandoned photos or deleted analyses includes a 65-minute safety delay followed by the scheduled task running. Processing happens in batches and may need several runs. Legacy website photos, UploadThing profile images and externally hosted images are not all covered by this automatic cleanup. Contact us to request their handling. Shared catalogue decorative images are not specific to your account.

Deleting Pokedy or your account does not cancel an App Store subscription: manage it in Apple subscriptions. Deletion also does not automatically remove eBay listings, delivered messages, third-party copies, backups or provider records described above.

Depending on applicable law, you can request access, correction, erasure or restriction, object to certain processing, withdraw consent, and request delivery or portability of data where that right applies. Email pokedy.co@gmail.com; we may request information needed to verify your identity. Legal obligations and third-party rights may limit some requests.

You can choose not to use AI features, disable iOS notifications and the digest, and change available preferences. Withdrawing consent does not undo prior processing. You can contact the competent authority, including the Swiss Federal Data Protection and Information Commissioner or your country’s authority where that right applies.

Pokedy is not intended for children under 13. If you believe a child has sent us data, contact pokedy.co@gmail.com. We may update this policy to reflect service and processing changes; the revised version and date are available at /privacyPolicy.