Privacy
Version of October 20, 2026
This translation is provided for convenience. In case of any discrepancy, the French version prevails.
CardRed TCG collects as little data as possible, never sells it, shows no ads and does no advertising or analytics tracking. Your collection and your photos stay on your phone; only what is needed for the account, the backup, social features and notifications goes through our servers.
Data controller: Corentin Ruggeri, publisher of CardRed TCG. Contact: contact@cardredtcg.com.
1. What stays only on your phone
- Your collection (cards, purchases, prices paid, notes), your binders, your wishlist, your settings and your alert history.
- Photos taken with the camera (scan, centering): they are analyzed directly on the phone and are never sent to a server. The only exception, with no photo: when you correct the scanner (see the table below).
- So that the app works without Internet: a copy of the card images already displayed (like a browser cache, automatically deleted beyond 4,000 images) and a copy of your username and avatar (deleted when you sign out).
- Without an account (guest mode), no personal data is sent to the publisher.
2. What we receive, why, and on what basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| E-mail, username, password (encrypted, unreadable by the publisher) | Create the account, sign you in, recover your password | Contract (terms of use) |
| Date of birth | Check that you are at least 16 | Legal obligation and contract |
| Country, language of your cards, "how did you hear about the app" | Adapt the app; know where players come from | Legitimate interest |
| Newsletter and notification preferences | Send you only what you chose | Consent (can be withdrawn) |
| Date you accepted the terms and the community rules | Prove your agreement | Legal obligation and contract |
| Backup of your collection | Restore it on a new phone | Contract |
| Avatar, number of cards, "private profile" and "social" settings | Show your profile according to your choices | Contract |
| Friends, requests, blocks, shared binders, showcase, votes | Make social features work, only if you turn them on | Contract |
| Reports sent or received, sanctions | Moderate the community and protect players | Legitimate interest and legal obligation |
| Karma and its history | Fight abuse and apply the Community Rules (visible only to you and the moderators) | Legitimate interest |
| Suggested prices ("Is this price wrong?"): card or sealed product, price, details | Correct prices with the community, after review by the moderators (your username is never shown to other players) | Legitimate interest |
| Scanner corrections: the language, the text read on the card (name and number) and the card you chose — never the photo | Improve recognition for everyone once 3 players make the same correction (your username is never shown) | Legitimate interest |
| Referrals: who referred you, who you referred, date | Grant referral rewards | Contract |
| Notification token, price alerts copied to the account | Send you your alerts, only if you turn them on | Consent |
| Failed sign-in attempts, technical logs (including the IP address) | Security: block attacks, investigate abuse | Legitimate interest |
We never ask for your real name, address, phone number, location or contacts. No automated decision-making or profiling is carried out about you.
3. What other players see
- Nothing, as long as social features are turned off (default setting).
- Social turned on: your username, your avatar, "member since", and what you choose to share (showcase, binders according to their visibility). With a low-key profile, only your username, your avatar and "member since".
- Your e-mail, your date of birth and your full collection are never visible.
- If you entered a referral code: your referrer sees your username, your sign-up date and your progress towards validation (e-mail confirmed or not, days left, number of cards up to 20).
4. Who processes data on our behalf
- Supabase Inc.: hosting of accounts and data, servers in the European Union.
- Google LLC (Firebase Cloud Messaging): sending notifications; receives the phone's token and the text of the notification. Transfer to the United States covered by the EU–US Data Privacy Framework and standard contractual clauses.
- OVH SAS: domain name, contact e-mail and website (France).
- Cloudflare (Turnstile): anti-bot check at sign-up and sign-in.
- Services contacted directly by your phone: TCGdex (card images and prices) and pokemontcgapi.com (product photos). They see your phone's IP address, like any website, but receive no data from your account.
Your data is never sold, rented or transferred for advertising purposes.
5. How long
| Data | Duration |
|---|---|
| Account, profile, backup, social, alerts | As long as the account exists |
| After a deletion request | 30 days (you can cancel), then permanent automatic erasure |
| Notification token | Until sign-out, notifications are turned off or the account is deleted |
| Failed sign-in attempts | Erased as soon as a sign-in succeeds; 15-minute lock at most |
| Reports and sanctions | As long as needed for moderation; those about you are erased with your account |
| Server technical logs | A few days (depending on the host) |
6. Security
Encrypted connections, encrypted passwords, encrypted session on the phone, access rules that limit each player to their own data, anti-bot check, e-mail code to delete an account. No system is infallible: in case of a breach that puts you at risk, you will be informed, as will the Data Protection Authority.
7. Minimum age
CardRed TCG is reserved for people aged 16 and over. Age is checked at sign-up. An account belonging to a younger person is deleted.
8. Your rights
At any time, you can ask to access your data, correct it, erase it, restrict its use, object to processing based on legitimate interest, withdraw your consent and receive a portable copy of your data. Most of this can be done directly in the app (profile, settings, account deletion). Otherwise, write to contact@cardredtcg.com from your account's e-mail address: answer within one month at most.
You can also file a complaint with the Data Protection Authority (Belgium): rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.
9. Cookies
The app and the cardredtcg.com website use no advertising or audience-measurement cookies.
10. Changes
This policy may change. In case of an important change, you will be notified in the app before it takes effect.