Privacy Policy

Everything you create in the app is stored only on your device:

• your collection, collections, quantities, condition, purchase prices and notes
• photos of the cards you scan
• scan history and activity
• your settings (currency, appearance)

We can't see this data, and it is not backed up to us. It is included in your device's own backup (iCloud or Google) if you have that turned on. Settings → Delete all local data removes it from the app. Deleting the app removes it too.

Scan photos you don't add to your collection are deleted automatically (we keep at most the latest 60, for at most 30 days).

The camera is used only to photograph the card you are scanning. The text on the card is read on your device (Apple Vision on iOS, Google ML Kit on Android). The photo is not uploaded anywhere.

When you scan or refresh a card, the app sends our server the card's details: player name, maker, set, year, card number and variant. The server looks them up on eBay (currently eBay UK and Germany) and returns current asking prices and listing photos.

• What is not sent: photos, your collection, notes, purchase prices, or any identifier for you or your device.
• Your IP addressreaches our server as with any internet request. We don't store it. To prevent abuse we keep a salted one-way hash of it, only to count lookups within an hour (at most 60 per hour). The hash can't be turned back into your address.
• Price resultsare cached on our server for up to 12 hours per card, so the same card isn't looked up again for every user. The cache contains product data only.
• Exchange ratesare fetched by our server from the European Central Bank's reference rates (via Frankfurter) and cached.
• Listing photosare loaded directly from eBay's servers, so eBay sees your IP address when the app shows them. Opening a listing or "See all" opens eBay's website, where eBay's own privacy policy applies.

Our server runs on Supabase, which processes these requests on our behalf.

Legal basis (GDPR): our legitimate interest in providing the price feature you ask for and keeping it secure (Art. 6(1)(f)).

CollectXI Pro is bought through the App Store or Google Play. Apple or Google handle payment; we never see your payment details or Apple/Google account.

We use RevenueCat to check whether your subscription is active. RevenueCat receives purchase receipts and an anonymous ID generated in the app. We don't give it your name, e-mail or any other identifier. See RevenueCat's privacy policy at revenuecat.com/privacy.

Legal basis: performing our contract with you (Art. 6(1)(b)).

The app can download small updates (bug fixes, text) from Expo's update service (EAS Update). The request includes technical details such as app version, platform and update channel, and your IP address. No personal data from the app is sent.

• No accounts, sign-in or e-mail collection.
• No analytics, advertising or tracking, and no tracking across other apps or websites.
• No selling or sharing of personal data.
• No crash reporting with personal data.

CollectXI is not directed at children under 13 and does not knowingly process their personal data.

Under the GDPR you can ask for access to, correction or deletion of personal data, object to processing, or complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no). Since we don't store data that identifies you, we usually have nothing to hand over or delete. The data in the app is yours, and you can delete it at any time in Settings.

If we change how the app handles data, we update this page and the date at the top. Significant changes will also be described in the app's release notes.

• Appivate AS
• Øvre Kråkenes 17, 5152 Bønes, Bergen
• hei@appivate.com