Your data, straight up.

Who looks after your data

Cardodex, reachable at contact@cardodex.app, is the controller of your data. Details about the publisher are in the legal notice.

What we keep

Your account: your email address, your username, your password (only in a hashed form that nobody can read back), your date of birth and, if you gave it, your nationality. If you sign in with Google, Google sends us your email address, your name and your account picture.

Your collection and what you do in the app: your cards and their details (condition, language, notes, price paid), your binders, your showcase, the cards you are looking for, your listings and sales, your settings, your badges.

Your profile and the community: your bio, your profile picture (a card from your collection), your visibility, your friends, likes given and received, reports and blocks.

The messages you send us from the app (reporting a problem or an error on a card), with the screenshot you attach, your device model and the app version. If the app crashes, an automatic report (the error message and the page where it happened) is linked to your account so we can fix the problem.

If you turn on notifications: the technical address your browser or phone provides to deliver them, and the device language.

If you subscribe: the identifier of your account with our payment provider. We never see your card number.

Your date of birth is used to check your age (a public profile is only possible from age 15); your nationality is only used for anonymous statistics. Neither is ever displayed.

Your photos

The photos you take to scan a card stay on your phone. To recognize the card, the app only sends a fingerprint of the image (a series of numbers) and the text read on it, never the photo.

Two features send a photo, and only when you start them: AI identification (Collector and Master) and The Eye, the card condition analysis. The photo is then sent to Anthropic, which provides the AI, for the duration of the analysis. We do not keep it; only the result of the analysis is stored.

Why

To run the service you ask for by creating your account: your collection, its prices, scanning, your profile, exchanges with other collectors, your subscription.

To keep the app safe: moderation of usernames and bios, fighting like fraud, locking an account after several wrong passwords.

To send you the necessary emails (sign-in, address confirmation, orders) and, if you turned them on, notifications.

To know how many people use Cardodex and which pages are useful: anonymous audience measurement, without cookies and without following a person from one day to the next (Vercel Web Analytics: page views, country, device type).

We do not use your data for advertising, we do not sell it and we do not profile you.

What others see

Your profile is private by default. Depending on the setting you choose, your friends or everyone can see your username, profile picture, bio, showcase or collection. Prices are only shown if you allow it. Your live listings are visible to collectors, with your username.

Our providers

Vercel (app hosting, servers in Frankfurt, and audience measurement), Neon (database, in Frankfurt), Cloudflare (card image storage, domain name, incoming email), Resend (sending email), Stripe (payments), Anthropic (AI identification and The Eye), Google (Sign in with Google), and the notification services of Apple, Google and Mozilla.

Some of these providers are based in the United States. Transfers take place within the framework of the GDPR (adequacy decision or the European Commission's standard contractual clauses). Anthropic does not use data sent through its API to train its models.

How long

As long as your account exists. When you delete it, all your data is erased immediately; database backups keep it for a few days at most, then it is gone.

Exception: the sales you completed remain, with no link to you (no username, no account), because they are used to calculate prices for everyone. Invoices and payments are kept for the period required by law.

Your rights

At any time you can view, correct or export your data (Settings, “Export my collection”), and delete your account (Settings, “Account and data”, “Delete my account”). You can also object to processing or ask for it to be restricted.

For any request: contact@cardodex.app. We reply within one month. If you believe your rights are not respected, you can contact the French data protection authority, the CNIL (cnil.fr), or the authority of your country.

Cookies

Cardodex only uses necessary cookies: the one that keeps you signed in and those that remember your settings (language, theme, currency, chosen game). The app also keeps a few display preferences on your device. No advertising or audience-measurement cookies (audience is measured without cookies): that is why we do not ask for your consent.

Younger users

If you are under 15, ask one of your parents for permission before creating an account. Your profile then stays private: it can only be made visible from age 15.

Changes

If this policy changes, the new version is published here with its date. For a significant change, we let you know in the app or by email.