Skip to main content
    PRIVACY POLICY

    Card Collect — Privacy Policy

    Effective date: 6 October 2026
    Operator: Horus Teknoloji ve Dijital Hizmetler A.Ş. ("Horus Studios", "we"), support@horusstudios.com

    Card Collect is an iOS app that identifies trading cards from photographs, shows market prices, tracks a collection and produces an AI "Grade Report". This policy explains what the app collects and why.

    1. No account

    Card Collect has no sign-up and no login. On first launch the app creates an anonymous identifier (a random Supabase user id) and stores it in your device's keychain. That identifier is the only thing that ties your scans, your collection, your report credits and your purchases together. It is not linked to your name, email, phone number or Apple ID.

    2. What we collect

    Photographs you scan. The card photos you take or pick from your library are uploaded to our server (Supabase, hosted in the EU, Frankfurt) so an AI model can read the card. They are stored under your anonymous id so a report can be disputed or regenerated. You can delete them at any time (Profile → Delete all my data).
    Scan results. The identification, the matched catalogue card, the price at the time, and the Grade Report.
    Your collection. Cards you keep, binders, wishlist, price alerts, quantities, conditions, grades, what you paid and notes. The device is the primary copy; a mirror is kept on our server so a reinstall gets your collection back and so daily portfolio totals and price alerts can be computed.
    Purchases. Subscription and one-time purchase state, received from Apple through Adapty (our subscription provider), keyed by your anonymous id. We never see your payment details.
    Device and locale. Locale and preferred currency, so prices show in your currency.
    Diagnostics. Standard server logs (timestamps, status codes, error messages). No advertising identifiers; the app never requests App Tracking Transparency permission.

    3. What we do not collect

    No name, email, contacts, precise location, photo library beyond the photos you explicitly pick, advertising ID, or cross-app tracking.

    4. Third parties that process data

    • Supabase (database, storage, serverless functions) — EU region.
    • EachLabs (AI model routing) and the model provider it routes to (Google Gemini) — receive the card photographs and the prompt to produce the identification and the Grade Report. Photographs are passed as short-lived signed URLs.
    • Adapty — subscription management; receives your anonymous id and purchase events from Apple.
    • Apple — App Store purchases and, if you choose to rate the app, the rating prompt.
    • Card catalogues and prices — TCGdex, Scryfall, YGOPRODeck and Lorcast are queried from our server, not from your device; they do not receive your identifier. Card images shown in the app are loaded from those services' image hosts, which see your IP address like any image on the web.
    • frankfurter.app — exchange rates, fetched without any identifier. We do not sell personal data and we do not share it for advertising.

    5. Retention

    Scans, photographs and the collection mirror are kept until you delete them or delete all your data. Purchase records are kept as long as required for accounting. Server logs are kept for 30 days.

    6. Your choices and rights

    • Delete everything: Profile → Delete all my data removes your photographs, scans, collection and credits from our server and from the device, and mints a new anonymous id.
    • Export: Profile → Export gives you a CSV of your collection.
    • Notifications are only sent if you turn them on (price alerts, a reminder about a locked report). Turn them off in iOS Settings.
    • If you are in the EU/EEA, UK, Switzerland or a jurisdiction with similar rights, you can ask us to access, correct, delete or port the data linked to your anonymous id by emailing support@horusstudios.com with the id shown in Profile. We answer within 30 days.

    7. Children

    Card Collect is not directed at children under 13 and we do not knowingly collect data from them.

    8. Security

    Data moves over TLS. Photographs are in a private bucket and are only readable through short-lived signed links generated by our server functions. Database tables are not readable by the app directly.

    9. Changes

    We will post changes on this page and update the effective date. Material changes are announced in the app.

    10. Contact

    Horus Teknoloji ve Dijital Hizmetler A.Ş. · support@horusstudios.com