Privacy Policy

1. Information We Collect

1.1 Account data : email address or phone number, username, password (stored only in hashed/encrypted form), profile photo and nickname.

1.2 Third-party sign-in : if you sign in with Apple or Google, we receive your name, email address (or Apple’s private relay address) and an authentication token from that provider.

1.3 Images you provide : photos you take for card recognition (processed on your device, see Section 4) and your profile photo (uploaded to our servers for display).

1.4 Usage data : features you use, search keywords, catalog / grading / market pages you view, items you save or favorite, and timestamps.

1.5 Device and log data : device model, operating system, unique device identifiers (such as IDFA or Android Advertising ID), IP address, language, crash logs and diagnostic data.

1.6 Payment and subscription data (if applicable) : purchases and subscriptions are processed by the Apple App Store or Google Play. We do not collect or store your payment card details; we receive only a transaction receipt, order ID and subscription status.

2. App Permissions

The following permissions are requested only when you actively use the corresponding feature. You may enable or disable them at any time in your device settings.

2.1 Camera : to scan and photograph cards, and to take your profile photo.

2.2 Photo Library (read) : to select card images or your profile photo to upload.

2.3 Photo Library (write) : to save card images and scan results to your album.

2.4 Network access : to connect to our services and load images and data.

2.5 Notifications : to send you service messages and optional marketing messages.

3. How We Use Your Information

3.1 Provide the App’s features, including card recognition, search, catalog and market-price lookup;

3.2 Create and manage your account, and save your queries and favorites;

3.3 Process purchases and subscriptions, and provide customer support;

3.4 Maintain security, prevent fraud and debug the App;

3.5 Improve and develop our services.

Legal bases (EEA/UK): contract performance, our legitimate interests (security, analytics, service improvement), legal obligations, and consent where required (withdrawable at any time).

4. Card Recognition (On-Device)

4.1 Card recognition uses on-device text recognition technology (Google ML Kit). Recognition runs locally on your device, and your photos are not uploaded to Google.

4.2 We use the recognized text (for example, a card name or number) to look up catalog, grading and market data on our servers.

4.3 We do not use your photos for facial recognition or biometric identification.

4.4 Your profile photo, if you choose to provide one, is uploaded to and stored on our servers for display purposes.

5. Third-Party SDKs

To provide our services, the App integrates the following third-party software development kits (SDKs). How each third party handles your information is governed by its own published privacy policy.

5.1 Google Sign-In : Provider: Google LLC. Purpose: to enable fast sign-in with your Google account. Information involved: Google account identifier, email address, nickname and avatar; during sign-in, your device information and IP address are processed by Google per its privacy policy. Policy: https://policies.google.com/privacy

5.2 Sign in with Apple : Provider: Apple Inc. Purpose: to enable fast sign-in with your Apple account on Apple devices. Information involved: Apple account identifier, email address (you may choose a hidden relay address), and name (only at first authorization). Policy: https://www.apple.com/legal/privacy/en-ww/

5.3 ML Kit Text Recognition : Provider: Google LLC. Purpose: on-device text recognition of card photos for the card scanning feature. Recognition runs locally on your device and your photos are not uploaded to Google. Information involved: to provide and improve the recognition service, Google may collect app information, app interaction data and device identifiers, as described in its official disclosures. Terms: https://developers.google.com/ml-kit/terms ; Data disclosure: https://developers.google.com/ml-kit/data-disclosure

6. Local Components

We use the following open-source components that run only on your device and do not transmit your personal information to any third party: networking (dio), local storage (shared_preferences, sqflite, cached_network_image), session management (cookie_jar), data signing (crypto), animation (lottie), localization (intl), image processing (image), app info (package_info_plus), system sharing (share_plus), external link handling (url_launcher), and permission management (permission_handler).

7. How We Share Information

7.1 We do not sell your personal information.

7.2 We share it only with: service providers (cloud hosting, analytics, crash reporting, customer support) under contract and only as needed to operate the App; sign-in partners (Apple, Google) to enable login; legal and safety recipients where required by law; and business transferees in a merger, acquisition or sale of assets (with notice to you).

8. International Data Transfers

We operate globally. Our servers are located outside of mainland China, and your information is processed on those overseas servers and is not transferred to mainland China. Where required (for example, under the GDPR), we use appropriate safeguards such as Standard Contractual Clauses.

9. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy: account data while your account is active; images as described in Section 4; transaction records as required by tax and accounting law; and support records as needed. We then delete or de-identify it.

10. Your Rights

Depending on your location, you may have the right to: access, correct or delete your personal information; restrict or object to processing; data portability; withdraw consent; and opt out of the “sale” or “sharing” of personal information (we do not sell it or share it for cross-context behavioral advertising).

These rights are provided under the GDPR / UK GDPR (including the right to lodge a complaint with your supervisory authority), US state laws such as the CCPA / CPRA (including the right to opt out of sale, sharing and targeted advertising), and Southeast Asian laws such as the Singapore PDPA and Thailand PDPA.

To exercise any right, use Account Settings in the App or email tousu@gecahobby.com. You may also delete your account as described in our Account Deletion Agreement. We will not discriminate against you for exercising your rights.

11. Children’s Privacy

The App is not directed to children under 13 (or under 16 in the EEA/UK, or the applicable age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

12. Cookies and Similar Technologies

The App and any related web pages may use cookies and similar technologies for functionality and analytics. You can manage advertising identifiers in your device settings (for example, “Limit Ad Tracking” on iOS or “Opt out of Ads Personalization” on Android).

13. Data Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version in the App, revise the “Last Updated” date, and provide additional notice where changes are material.

15. Contact Us

Shenzhen Biaoka Technology Co., Ltd.

Address: Room 1908, Tower B, Phase 1, China Merchants Qianhai Economic and Trade Center, Nanshan District, Shenzhen, Guangdong, China

Email: tousu@gecahobby.com

16. Links to Third-Party Websites

The App may contain links to third-party websites or services (for example, when you tap a link that opens in your browser). We are not responsible for the privacy practices or the content of those third-party websites. We encourage you to read the privacy policies of any third-party websites you visit.