Privacy Policy
Effective date: October 14, 2026 · Applies to the iOS app “Card Value” (German: “Kartenwert”) and this website.
The short version: cards are recognised on your iPhone, and your collection stays there. To show prices and card images the app asks the open TCGdex database for a card ID, nothing else about you. Purchases go through Apple and RevenueCat; usage statistics are anonymous. No accounts, no ads, no tracking across apps.
1. Controller
Caspar Baumeister
Dernburgstraße 7
14057 Berlin, Germany
caspar.baumeister.dev@gmail.com
As a sole developer I am not required to appoint a data protection officer. For any question about this policy or your data, please e-mail me.
2. What the app processes, and why
2.1 Card recognition on your device
When you scan a card or a binder page, the photo is analysed on your iPhone using Apple's built-in text recognition (Vision framework). The recognised text is matched against a card database that ships inside the app. The photo is not uploaded for this step; Apple's on-device recognition does not send the image to Apple either.
AI fallback. If on-device recognition cannot find a confident match, the app can send that one photo, your app language and a random installation ID to our server, a Google Cloud Function (Firebase) in the region europe-west1 (Belgium), which forwards the image to the Google Gemini API to read the card name and number. The photo is held only for the duration of the request and is not stored on our server or in the AI service after the response; we keep neither the image nor the result. Technical request logs (timestamp, request ID, status, installation ID, IP address, never the image) are retained for up to 30 days. Please make sure only the card is in the frame.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract: recognition is the core service). The installation ID and rate limiting serve our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).
2.2 Prices and card images (TCGdex)
To show prices and card images, the app requests data from TCGdex (api.tcgdex.net, assets.tcgdex.net), an open trading-card database that in turn publishes market prices from Cardmarket (EUR) and TCGplayer (USD). Each request contains the card ID (for example “sv03.5-045”) and the language, and, as with any internet request, your IP address and basic HTTP headers reach the TCGdex servers. We do not send an identifier for you or your collection, and TCGdex has no way to see which cards belong together. Prices are cached on your device for 24 hours. When you tap “Refresh prices”, one request per card in your collection is made. See tcgdex.dev for the project.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract: showing prices is what the app is for).
2.3 Purchases (Card Value Plus)
Subscriptions are processed by Apple through the App Store. To check whether Plus is active and to restore purchases, the app uses RevenueCat (RevenueCat, Inc., USA). RevenueCat receives a random app user ID generated on your device, the App Store receipt / transaction information (product, dates, status) and basic device information. We never receive your name, Apple ID, address or payment details.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Transfer to the USA is covered by the EU-US Data Privacy Framework and/or EU standard contractual clauses in RevenueCat's data processing agreement.
2.4 Anonymous usage statistics
The app records simple usage events, for example “onboarding step 3 viewed”, “paywall viewed”, “scan completed (mode: binder, method: ocr)” or “card added (variant: holo)”, together with technical information (app version, iOS version, device model, language, screen size). Events are sent to PostHog (PostHog Inc.; data hosted in the EU, Frankfurt). Events are tied to a random identifier generated on your device, not to your name, e-mail or Apple ID. IP addresses are anonymised and not stored with events. We do not use the advertising identifier (IDFA), do not build person profiles and do not track you across other companies' apps or websites. Photos, card names, your collection, prices and search terms are never part of these events.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding where the app is confusing and in fixing errors, implemented with the least intrusive means (random ID, anonymised IP, EU hosting, no profiling).
2.5 Data stored on your device only
Your collection (card IDs, variants, quantities, date added, price at the time of adding, optional photos), the value history of your collection, the price cache, your settings and the installation ID are stored locally on your iPhone. They are never uploaded to us. You can delete all of it at any time via Settings › Delete all data in the app, or by deleting the app. Depending on your iCloud settings, iOS may include app data in your device backup; that is controlled by Apple and you.
2.6 Camera, photo library, sharing
The app asks for camera access to scan cards, and, only if you choose a picture from your library, for access to the selected photos. Both permissions are optional and can be revoked in iOS Settings. The app never scans your photo library on its own. “Share missing list” opens the iOS share sheet with a plain text list; what happens with it next is up to the app you choose.
2.7 Links to Apple, support e-mail
“Manage subscription”, “Rate the app” and “Report a problem” open Apple's pages or apps; Apple's privacy policy applies there. If you e-mail us, we process your e-mail address and the content of your message to answer you (Art. 6(1)(b) and (f) GDPR) and delete the correspondence once the matter is closed, unless statutory retention periods apply.
3. This website
This site is hosted on Firebase Hosting (Google Ireland Limited / Google LLC), delivered via a global content delivery network. When you open a page, the server processes your IP address, the requested URL, the time, browser and referrer in technical logs to deliver the page and ensure security (Art. 6(1)(f) GDPR). The site uses no cookies, no analytics and no external fonts or scripts. Your language choice (EN/DE) is stored in your browser's local storage only.
4. Recipients and international transfers
| Recipient | Purpose | Location / safeguard |
|---|---|---|
| TCGdex (open-source project) | Card data, images and market prices (card ID + IP address) | See tcgdex.dev. No identifier for you is transmitted. |
| Google Cloud / Firebase (Google Ireland Ltd., Google LLC) | AI fallback recognition (Cloud Function + Gemini API); website hosting | Cloud Function in europe-west1 (Belgium). Google may process API requests in other regions; EU standard contractual clauses and the EU-US Data Privacy Framework apply via Google's Cloud Data Processing Addendum. Google DPA |
| RevenueCat, Inc. | Purchase validation | USA. Data Privacy Framework / standard contractual clauses. revenuecat.com/privacy |
| PostHog Inc. | Anonymous usage statistics | Hosted in the EU (Frankfurt). posthog.com/privacy |
| Apple Inc. | App distribution, payments, subscriptions, on-device text recognition | Apple's own terms and privacy policy apply. |
We do not sell personal data and do not share it with anyone else.
5. Retention
- Card photos: processed on your device; a photo sent to the AI fallback is not stored, discarded immediately after the response.
- Server request logs (without images): up to 30 days.
- Usage events: up to 12 months, then deleted or aggregated.
- Purchase records at RevenueCat: for as long as your subscription exists, plus statutory retention periods.
- Data on your device: until you delete it in the app or delete the app.
6. Your rights
Under the GDPR you have the right to access the personal data we hold about you, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). Because the app uses only random identifiers, we usually cannot link data to you as a person; if you want us to delete something, please send us the installation ID shown in the app's Settings. You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, datenschutz-berlin.de).
7. Children
The app is not directed at children and does not knowingly collect personal information from anyone, including children under 16.
8. Trademarks
Card Value is an independent app and is not affiliated with, endorsed, sponsored or approved by The Pokémon Company, Nintendo, Creatures Inc. or GAME FREAK Inc. Card names, set names and images are trademarks of their respective owners and are used for identification only.
9. Changes
If this policy changes, the updated version will be published on this page with a new effective date. Material changes will also be announced in the app.
10. Contact
Caspar Baumeister · Dernburgstraße 7 · 14057 Berlin · caspar.baumeister.dev@gmail.com