CardSheen Privacy Policy

Last updated: October 25, 2026

CardSheen (formerly CardComps) is a mobile app for Android and iOS for scanning and collecting Pokémon Trading Card Game cards. It is made by XEPATOP, an independent developer in Subotica, Serbia (“I”, “me”). This policy explains what the app collects, why, where it goes and how you can delete it. Contact:dev@xepatop.com.

Short version: the app needs photos of your cards to recognise them and an account to keep your collection. It counts on my own server how people use it (sign-ups, visits, which steps of the app they reach) and sends error reports when it crashes. There are no ads and no third-party analytics, advertising or tracking SDKs, and I don't sell or share your data for marketing.

1. What the app collects

• Account. Your email address, and your name if you sign in with Google or Apple. With Sign in with Apple you can hide your email; then I get only a private relay address from Apple. If you sign up with a password, it is stored only as a hash by the sign-in provider; I never see it.
• Scan photos. When you scan, the app sends camera frames of the card (usually two photos, a few small frames and a short video of a few seconds taken while you tilt the phone) to the recognition server. Frame the card, not your surroundings: anything else in the frame is sent too.
• Your collection. The cards you add, with quantities, printing, language, condition, grade, purchase and sale records, portfolios, favourites, price alerts and daily snapshots of the collection value. It lives on your phone and is synced to my server so it survives a new phone.
• Usage statistics. When you open the app: the day, the platform (Android or iOS), the app version and the language setting of the phone. And whether you reached a few steps: finished the introduction, scanned your first card, opened the subscription screen (and from which feature), started, finished or failed a purchase, restored a purchase. These are linked to your account ID and stored on my server only.
• Push token. If you allow notifications, a device token so the server can send your price alerts.
• Crash reports. When the app crashes or hits an error, it sends a report: what went wrong in the code, the phone model, Android or iOS and app versions, the screens you opened just before, and your account ID. No email, photos or screenshots are included.
• Purchases. Subscriptions are bought through Google Play or the App Store. I get the subscription status and purchase records (product, price, currency, country, dates, renewals, cancellations and refunds), never your payment card details.

The app does not collect your location, contacts, advertising ID or device identifiers beyond the push token.

2. Why

• To recognise the card and its printing, and show its price (scan photos).
• To keep and sync your collection and send the alerts you set (account, collection, push token).
• To provide the subscription you paid for (purchases).
• To understand how many people sign up, use the app, subscribe and leave, and which of my changes and promotion help (usage statistics, purchases). Only as totals and trends: not for ads, not for profiling, not sold or shared.
• To improve recognition: photos of scans where you told the app its answer was wrong (see section 4).
• To find and fix crashes and errors (crash reports).

Legal bases under the GDPR: performance of our agreement with you (running the features you use and the subscription), my legitimate interest in fixing errors and in understanding how the app is used, and legal obligations to keep purchase records.

3. Where it is stored and who processes it

• Recognition server: Hetzner Online, data centre in Helsinki, Finland.
• Collection, alerts, usage statistics and purchase records: my server at CLOUD.DOG, Estonia.
• Sign-in: Supabase (account email and sign-in sessions).
• Card recognition service: when the app can't identify a card from its printed text alone, the photo is sent to a third-party recognition API (Scrydex, USA). It receives the image only, without your account.
• Subscriptions: Google Play or the App Store, and RevenueCat (USA), which manages subscription status and sends purchase events to my server. RevenueCat receives your account ID, not your email.
• Notifications: Expo push service, Google Firebase Cloud Messaging and Apple Push Notification service deliver alerts to your phone.
• Crash reports: Sentry (Functional Software, Inc.), stored in its EU data centre in Germany.
• Google Sign-In or Sign in with Apple, if you choose them.

Some of these providers are outside the EU/EEA; transfers rely on the providers' standard contractual clauses.

4. How long I keep it

• Scan photos are deleted automatically. The full scan is deleted as soon as you accept the card; the straightened card image stays at most 24 hours so the scan queue can show it. Scan photos are not linked to your account on the server.
• Scans you mark as wrong (wrong card or wrong printing) are kept to find and fix the recognition error. They are moved off the public server within about two hours and kept in my private test set without your account or email.
• Account, collection and usage statistics are kept until you delete your account and are deleted with it.
• Purchase records are kept as long as tax and accounting law requires, also after you delete your account.
• Crash reports are deleted automatically after at most 90 days.

5. Your rights and deleting your data

You can see and export your collection in the app (CSV export). You can delete your account and all data linked to it in the app: Settings → Danger zone → Delete account and data. Or follow the steps onthe account deletion page. Deleting your account does not cancel a subscription: cancel it in Google Play or the App Store. You can also ask me by email to access, correct or delete your data, or object to processing, including the usage statistics. If you are in the EU, you can complain to your data protection authority; in Serbia, to the Commissioner for Information of Public Importance and Personal Data Protection.

6. Children

CardSheen is not directed at children under 13, and I don't knowingly collect data from them. If you think a child has created an account, write to me and I'll delete it.

7. Security

All traffic between the app and the servers is encrypted (HTTPS). Server access requires your sign-in token, and each user can reach only their own data.

8. Changes

If this policy changes, I'll update the date above. For significant changes, the app will tell you.