What CardScanR collects and what stays on your device

Questions and answers

What data does CardScanR collect?

On your device, CardScanR stores your collection (cards, quantities, condition, favourites, binders, wishlist, and related metadata), app preferences, and scan frames used for recognition.

If you sign in and turn on cloud sync, we store collection metadata tied to your account in Supabase: card identity fields, quantities, condition, purchase and estimate fields, tags, catalogue image URLs, acquisition source text, and related sync records. Scan session metadata (counts, status, OCR excerpts) may also sync when signed in.

If you use Google sign-in, we receive profile fields needed for your account (such as email and display name) through Supabase Auth. Premium purchases are verified through Google Play Billing; we receive purchase verification data, not your full payment card number.

What does CardScanR not collect through normal collection sync?

Official CardScanR apps do not upload raw card scan photos through collection sync. Scan camera frames stay on your device unless you deliberately export diagnostics or attach images to feedback.

In the official Flutter app and web companion, collection item notes are sent as null during sync. Notes are intended to stay on your device. Acquisition source text can sync when cloud sync is enabled.

We do not run advertising SDKs, Facebook Pixel, Google Ads, or behavioural ad profiling in the app or public website source we ship.

Does CardScanR upload my card photos?

No, not through collection sync. Enabling cloud sync uploads collection metadata, not your camera captures or gallery photos used for scanning.

Catalogue artwork shown in the app is downloaded from official catalogue or CardScanR image hosts as reference URLs, not copies of your personal scan photos.

You may choose to include scan evidence in optional diagnostics exports or website feedback. Review anything you send before sharing it.

Can other collectors see my cards?

Not by default. Your private collection is isolated with Supabase row-level security and ownership checks in server RPCs. Other users cannot query your private collection.

Public sharing is opt-in through share links on the web companion. It is off by default. Shared views omit notes, owner user id, emails, and payment details.

Do you sell my personal information or collection data?

No. We do not sell personal information or collection data. Data is shared with service providers only as needed to operate features you use (authentication, optional sync, catalogue and pricing lookups), or if required by law.

Does CardScanR use advertising or behavioural profiling?

No advertising SDKs, Facebook Pixel, Google Ads, or behavioural ad profiling were found in the CardScanR app or public website source. We do not use your collection for advertising.

Do you use my scans or collection to train AI?

No customer-data model-training pipeline was found. CardScanR policy: customer data is not used to train CardScanR or third-party AI models unless a future separate opt-in exists. That training path is currently disabled.

On-device OCR (Google ML Kit) runs locally for scanning. It is not the same as uploading your collection to train a cloud model.

What analytics does CardScanR use?

The current app does not include Firebase Analytics, Crashlytics, Sentry, or similar third-party analytics SDKs in the shipped source reviewed for this page.

Operators may review beta feedback, error reports, and operational dashboards. Admin access requires authenticated admin checks; it is not a public gallery of user collections in the Android app.

What happens when I sign in with Google?

Google and Supabase process authentication under their own policies. CardScanR receives account profile fields needed to sign you in and show your account (such as email and display name).

Google does not receive your CardScanR collection through normal app use. Google Play Billing handles Premium checkout; we receive purchase verification, not your full card number.

How do Premium payments work?

Premium is purchased inside the Android app through Google Play Billing. Google processes payment. CardScanR receives subscription verification and entitlement status from Google Play, not your full payment card number.

Can I export my collection?

Yes. The Android app supports CSV export, JSON export, and local backup from Settings → Data and privacy. CSV and JSON are for portability. A local backup file can replace the collection on a device through Restore. Cloud-only fields may require sync to be enabled first.

Can I download a copy of my cloud data?

Use in-app export and backup tools for your collection file. For account-level requests (access or correction under applicable privacy law), contact [email protected].

How do I delete my cloud collection data?

Use Settings → Data and privacy → Delete cloud collection. That calls the same-user cloud purge RPC. Deleting cloud collection data does not automatically delete your account. Billing or audit records that CardScanR is required to keep are described on this page and are not treated as collection cards.

How do I delete my account?

Use the in-app delete-account flow (Supabase Edge Function), the hosted page at cardscanr.com/delete-account, or email [email protected]. Local device data is separate and may remain until you clear app storage or uninstall.

What happens if I uninstall or clear app data?

Uninstalling or clearing app storage removes the local collection on that device. Cloud restore works only after you enabled cloud sync and the app recorded a successful sync. CSV and JSON exports are a portability escape hatch, not a one-tap import. A local backup file created from Data and privacy can replace the collection on this device through Restore.

What happens if I stop using CardScanR?

Local data remains on your device until you uninstall or clear app storage. Cloud data remains until you delete it or delete your account through a supported process. Turning off sync stops new uploads; it does not erase data already stored in the cloud.

Which third parties receive data?

• Supabase: authentication, database, and storage when you use cloud features.
• Google: sign-in, Play Billing, and on-device ML Kit for OCR.
• Cloudflare: website hosting, CDN, and Turnstile on the feedback form.
• Pricing and catalogue backends (including eBay-related pricing backends): card identity search terms for price estimates, not customer identity or full collection dumps.
• Catalogue image CDNs: official artwork URLs for display.

Each provider processes data under its own policies.

How long do you keep data?

Local data stays on your device until you remove it. Cloud account and opted-in collection metadata remain until you delete them or your account through a supported process. Feedback and operational logs are kept only as long as needed for support, security review, and product improvement.

See Security for honest backup limitations on our current Supabase plan.

Who operates CardScanR and how do I contact you?

CardScanR is operated by Andrew Gore, Australia. Privacy and data questions: [email protected]. Support: cardscanr.com/support.