Privacy Policy

Last updated: 2026-11-05

TCGVerse is an app for keeping track of your card collection. This policy explains what data we process, what for, and what you can do about it.

1. YOUR ACCOUNT

You need an account to store your collection. You can create one with an email and password, sign in with your Google account or, on iPhone, with your Apple ID.

Identity is handled by Firebase Authentication, from Google: it stores your email and, if you sign in with Google or Apple, the identifier each of them gives you. It is also what sends you the email to confirm your address and the one to change your password. We never see your password, and our server does not even store your email: only the identifier Firebase returns.

If you sign in with Apple you can hide your email; Apple then gives us a forwarding address (ending in privaterelay.appleid.com) and that is the only one we know. We do not store your name even if Apple offers it.

Legal basis: performance of the contract.

2. YOUR PROFILE

Display name (optional), country, language and currency. They are what let us show you the app in your language and prices in your currency.

Legal basis: performance of the contract.

3. YOUR COLLECTION

The cards you record and how you organise them: game, set, number, quantity, condition, finish, the card's printed language, the price you paid if you note it down, and the folders and decks you put them in.

Legal basis: performance of the contract.

4. SERVICE USAGE

How many scans and imports you have used this cycle, so we can apply your plan's limits.

And technical records of each request to our server — IP address, date and time, what was requested and how it answered — used to stop abusive use and to fix bugs. Google Cloud keeps them for 30 days and they are deleted automatically. They do not contain your photos or your email.

And, to check that requests really come from the app and not from a program imitating it, your phone asks Apple (App Attest) or Google (Play Integrity) for a proof, which Google's Firebase App Check verifies. That proof says the app is genuine; it does not carry your account, your email or your collection.

Legal basis: performance of the contract, and legitimate interest in protecting the service.

5. CARD PHOTOS

This is the part people usually ask about, so here it is precisely.

When you scan, the photo travels to our recognition service, is processed in memory to identify the card, and is discarded when it finishes. It is not written to disk or to any database, ours or anyone else's.

If you choose to keep a photo of one of your cards, that photo stays on your phone. It is never uploaded. Uninstall the app or delete your account and it goes with it.

6. CATALOGUE IMAGES

Card images are not ours: your phone downloads them directly from whoever publishes them — Scryfall (Magic), Pokémon TCG API, Scrydex and TCGdex (Pokémon) and TCGplayer (One Piece); Pokémon TCG API serves the newest sets from Scrydex's servers. Like any website you visit, those servers see your IP address and which image is requested. We send them nothing else: not your account, your email or your collection.

Yu-Gi-Oh! is the exception: the data and the images come from YGOPRODeck, which requires us to host the images ourselves, so we serve them from our own storage on Google Cloud and your phone never connects to YGOPRODeck. The app downloads images from nowhere else.

Legal basis: legitimate interest in showing you the cards, which is what the app is for.

7. YOUR SUBSCRIPTION

If you pay for Infinity, the charge is made by the App Store or Google Play. We never see your card or your payment details. RevenueCat, which connects the store to our server, tells us whether your plan is active and until when, and that is all we store. To link the purchase to your account, RevenueCat receives your account identifier —not your email— from the moment you open the plans screen, which is where it shows you your store's price.

Legal basis: performance of the contract.

8. ANALYTICS (ONLY IF YOU TURN IT ON)

It ships switched off. If you enable it in Profile, we send PostHog —on servers in the European Union— which screens you use and the errors you hit, so we know what to fix.

It is identified by a random number for your installation, not by your email or your account identifier. We do not send your cards, your photos or your email. For errors we send the type, a truncated message and the technical trace.

Legal basis: your consent. You can withdraw it at any time from the same switch, and sending stops there and then.

9. WHO WE SHARE THEM WITH

Only with those who provide the service for us, and only for that:

• Google Cloud, where the server, the database and card recognition run, in data centres in the European Union.
• Google (Firebase Authentication and App Check), to identify you and to check that requests come from the app (point 4).
• Apple, if you sign in with your Apple ID, and on iPhone for the proof that the app is genuine (point 4).
• Scryfall, Pokémon TCG API, Scrydex, TCGdex and TCGplayer, which serve the card images (point 6). Nobody but us serves the Yu-Gi-Oh! images: YGOPRODeck is only the source of the data.
• RevenueCat, if you open the plans screen or pay for Infinity (point 7).
• Apple or Google, as stores, if you pay for Infinity: the charge is theirs and follows their own privacy policies.
• PostHog, only if you turned analytics on.

We do not sell your data, we do not hand it to advertisers, and there is no advertising in the app.

Google, Apple, RevenueCat and the image servers are mostly in the United States, so some data may leave the European Union. When it does, it is with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

10. HOW LONG WE KEEP THEM

As long as you have an account. Deleting it deletes everything — collection, decks, folders, profile, counters, subscription status, your record at RevenueCat and the identity itself — with no bin and no grace period. If you signed in with Apple, we also withdraw TCGVerse's access to your Apple ID.

The technical records in point 4 do not depend on your account: they are deleted automatically after 30 days.

Database backups keep what was there for 7 more days and are overwritten automatically. They are only used to restore the service after a failure, and in that case we delete again whatever had already been asked to be deleted.

Deleting your account does not cancel your subscription: that is done in your store. And the stores keep their own payment records, which we do not control.

11. YOUR RIGHTS

• Access and portability: export your collection to CSV from Profile.
• Rectification: edit your profile and your cards inside the app.
• Erasure: Profile, Delete account. Immediate and final.
• Withdraw consent: turn analytics off.
• Objection, restriction or anything else: write to danijmal@gmail.com.
• Complain: to your national data protection authority. In Spain, the Agencia Española de Protección de Datos (www.aepd.es).

12. MINORS

You must be 16 or older to use TCGVerse. If you are younger, do not create an account.

It is 16 and not less because that is the age the GDPR sets by default for someone to consent on their own to this kind of processing. Member states may lower it to 13 — Spain has it at 14 — but asking for 16 works across the whole Union regardless of where you are.

If we learn of an account belonging to someone under that age, we delete it along with all its data.

And if you are under 18, you need permission from a parent or guardian to pay for Infinity.

13. CHANGES

If we change something that matters we will tell you inside the app before it takes effect, and we will change the date above.

14. CONTROLLER

Daniel Josemaria
Lista de Correos, Calle Porto Cristo, 13, 28924 Alcorcón (Madrid), España
Email: danijmal@gmail.com

For any question about your data, or to exercise your rights, write to that address.