Privacy Policy

When you create an account, Supabase Auth (our authentication provider, self-hosted on our own infrastructure) stores your email address and a hashed password. We never see or store your raw password.

If you set a username, display name, or bio, those are stored with your account and shown publicly only if you turn on "Make my profile public."

The cards you add to your collection, your binders, your import history, and any Card Inspector submissions are tied to your account and only visible to you, unless you mark a binder or profile public.

Deleting your account deletes all of this data (see "Deleting your account" below).

Every page load sends a lightweight, anonymous beacon (/api/hit) that we use to see which pages get used. It records the page path, the referring site's domain, and any UTM campaign tags -- never the full URL you came from, never your raw IP address.

To estimate unique visitors without identifying anyone, we compute a one-way hash of your IP address, browser user-agent, and the current date, combined with a private salt, and store only that hash. It rotates every day and cannot be reversed back into an IP address. No cookies are set for this.

When you scan a card with the camera, the photo is processed entirely in memory to compute a match against our card index: we never write the photo itself to disk or to any storage bucket, on the website or in the mobile app.

If you are signed in and confirm that a scan result is correct, we store a mathematical fingerprint of that photo (a perceptual hash -- effectively a 256-bit summary that cannot be turned back into an image) linked to the card it matches, so future scans of that card recognize it faster. We do not store the photo that produced it. This fingerprint is visible to everyone (it only ever identifies a card, never you), though we keep a record of which account contributed it so we can rate-limit abuse; deleting your account clears that link but leaves the fingerprint itself in place, since it carries no personal information.

The only cookie this site sets is your Supabase authentication session cookie, which keeps you signed in. We do not use advertising or tracking cookies, and the anonymous visit logging above uses no cookies at all.

Card images are served from our own infrastructure and from the card-data providers we source images from: images.pokemontcg.io, images.scrydex.com, s3.pokeos.com, tcgplayer-cdn.tcgplayer.com, assets.tcgdex.net, and www.pokemon-card.com. Loading a card image on this site may cause your browser to make a request to one of these hosts. We do not control their own data practices.

You can delete your account and all of the data listed above at any time from Account Settings on the website, or from Settings in the mobile app. Deletion asks you to confirm twice before anything happens, and it cannot be undone.

Questions about this policy or your data: email info@stephenscode.dev.