How CardScanR protects your collection

How your collection is protected

• Local-first default: Your inventory lives in a local database on your Android device unless you opt in to cloud sync.
• No scan photo upload via sync: Collection sync sends metadata, not raw scan photos from your camera roll.
• Account separation: Cloud data is tied to authenticated accounts. Supabase row-level security and ownership checks in RPCs aim to stop other users querying your private collection.
• Opt-in sharing only: Share links on the web companion are off by default. Shared responses omit notes, owner user id, emails, and payment details.
• Secrets not in the public app: The Android app and public website use publishable Supabase client credentials. Service-role keys and other privileged secrets are not shipped in the public app. A publishable anon key in client code is expected for Supabase apps; it is not a private server secret.

Transport and device networking

Network calls from the app and website use HTTPS. The Android app sets usesCleartextTraffic to false, so cleartext HTTP is not permitted for app traffic.

Website responses include security headers (including Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security on cardscanr.com).

What happens if CardScanR is attacked

No online service can promise it will never be targeted. If we detect or are notified of a security incident affecting customer data, we aim to investigate promptly, contain impact where possible, notify affected users when appropriate, and document lessons learned.

Because scan photos are not uploaded through collection sync, a cloud database incident would primarily concern metadata you chose to sync, account profile fields, and operational records; not your full camera roll of card scans.

How we test security

• Automated tests cover auth boundaries, sync isolation, and RPC ownership checks in the app and backend repositories.
• Row-level security policies are reviewed when collection or sharing features change.
• Public website builds merge legal and marketing content with a single CSP authority to reduce accidental browser policy conflicts.
• Beta feedback and error reports help us find real-world issues; they are not a substitute for formal penetration testing on every release.

Backups and recovery (honest limits)

Operator and admin access

When you enable cloud features, operators can access systems that store your cloud data for support, security review, and operations. Admin RPCs require authenticated admin checks. We do not present your collection as a casual public admin gallery in the Android app, but we will not claim operators can never access stored cloud data when required for their role.

Report a security concern

Email [email protected] with enough detail to reproduce the issue. For structured disclosure metadata, see /.well-known/security.txt.

Please do not publicly disclose unresolved critical issues before we have had a reasonable chance to respond.

What we cannot guarantee

• Perfect security or zero risk.
• That local files on a lost, stolen, or compromised device remain private without your device passcode or encryption.
• That third-party providers (Supabase, Google, Cloudflare, catalogue or pricing APIs) will never experience outages or incidents.
• Automatic cloud backups or PITR on our current Supabase Free plan.
• That optional diagnostics or feedback you choose to send stays free of sensitive information unless you review it first.