About This Policy
YTD Labs ("YTD Labs," "we," "our," or "us") operates TCGster. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the TCGster mobile app, website, APIs, and related services (the "Service").
Information We Collect
Account and identity information
You may use an anonymous account or sign in with Apple or Google. Depending on how you use the Service, we may receive and store an account identifier, name, email address, profile image, authentication-provider identifier, verification status, session information, IP address, and user-agent information.
Card scans and collection information
When you scan a card or choose an image from your photo library, we collect:
- The captured or selected card image.
- Scan and identification results, including possible matches, card identifiers, and failure information.
- Cards, variants, quantities, grades, notes, tags, preferences, and other information you save to your collection.
Purchases and subscriptions
We receive subscription and entitlement information from Apple, Google, and RevenueCat, such as product, status, renewal, trial, and transaction identifiers. Payment card details are processed by the applicable app store and are not provided to us.
Usage, device, and diagnostic information
We collect information about how the Service is used, including app opens, screens viewed, scan and collection actions, searches and filters, selected preferences, paywall and purchase-flow events, app version, device type, operating system, locale, network information, crash reports, error details, and performance data. Analytics events may be associated with your TCGster account identifier. On iOS, the app collects an Apple AdServices attribution token and sends it to RevenueCat, which uses it to request and store Apple Search Ads attribution data for campaign and subscription measurement. Session replay is not enabled in the app.
Communications
If you contact us or submit feedback, we collect the message, contact information, and any other information you choose to provide.
Website information
Our website may use Cloudflare Web Analytics to understand aggregate traffic and performance without advertising cookies. Our hosting and security providers may also process standard request information, such as IP address, browser type, requested page, and timestamp, to deliver and protect the website.
Camera and Photo Library
TCGster accesses the camera or photo library only after you grant permission and choose to scan or select a card image. The live camera preview is used on your device to frame the scan. The captured or selected image is uploaded to private cloud storage and processed by our card-identification providers. Do not include people, documents, or sensitive personal information in card images.
How We Use Information
We use information to:
- Provide card scanning, identification, pricing, collection storage, synchronization, and account features.
- Authenticate users, maintain sessions, and secure the Service.
- Process subscriptions, restore purchases, and manage access to premium features.
- Measure app-acquisition campaigns and subscription performance.
- Respond to support requests and feedback.
- Analyze usage, diagnose errors, prevent abuse, and improve reliability and product experience.
- Comply with legal obligations and enforce our Terms of Service.
Legal Bases for Processing
If data-protection law in the EEA, United Kingdom, or a similar jurisdiction applies, we rely on:
- Contract: to provide the Service you request.
- Legitimate interests: to secure, maintain, understand, and improve the Service, provided those interests are not overridden by your rights.
- Consent: when you grant device permissions or where consent is otherwise required.
- Legal obligations: when processing is necessary to comply with law or valid legal requests.
How We Share Information
We disclose information only as needed for the purposes described above, including to:
- Cloud infrastructure providers that host the API, database, private image storage, website, and related systems.
- Card-identification providers, including Ximilar, OpenRouter, and underlying AI model providers. Ximilar receives a time-limited signed link to the card image; the link's storage path includes internal account and scan identifiers. AI model providers may receive the image content and scan instructions.
- Analytics and diagnostics providers, including PostHog, which process usage events, device information, account identifiers, and error data.
- Subscription and attribution providers, including RevenueCat, Apple, and Google, which process subscription, purchase, entitlement, and Apple Search Ads attribution information. On iOS, RevenueCat receives the Apple AdServices attribution token and requests attribution data from Apple.
- Authentication providers, including Apple and Google, when you choose social sign-in.
- Professional advisers, authorities, or transaction participants when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a corporate transaction.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use third-party advertising networks in the Service.
Automated Processing
Card identification uses automated image recognition and AI-assisted processing. Results may be incomplete or incorrect and should be reviewed before you rely on them. This processing does not produce legal or similarly significant effects about you.
Retention and Account Deletion
We retain account information, collection data, scan images, identification records, and related service data while your account is active or as reasonably necessary to provide, secure, and improve the Service. Usage, diagnostic, transaction, and support records may be retained for shorter or longer periods depending on operational, fraud-prevention, accounting, dispute, and legal requirements.
You can delete your account in the app. Account deletion removes your collection, tags, scan records, private uploaded images, linked authentication accounts, and active sessions from our primary systems. We retain a pseudonymized account record to preserve system integrity. That record keeps its internal account identifier and onboarding answers, while the name and profile image are cleared and the email address is replaced with a randomly generated deleted-account address. Because the internal identifier and onboarding answers remain, this record may still be personal information under applicable law. Limited information may also remain in backups, security logs, analytics systems, subscription-provider records, or records that we must retain by law. Deleting your TCGster account does not cancel an App Store or Google Play subscription.
International Data Transfers
We and our service providers may process information in countries other than where you live. Where required, we use recognized transfer mechanisms and contractual protections for international transfers.
Security
We use reasonable technical and organizational safeguards designed to protect information, including access controls and private storage for uploaded scan images. No system is completely secure, and we cannot guarantee absolute security.
Your Choices and Privacy Rights
Depending on where you live, you may have the right to:
- Access, correct, or receive a copy of personal information.
- Request deletion, restriction, or objection to certain processing.
- Withdraw consent where processing is based on consent.
- Request data portability.
- Appeal a denied privacy request where local law provides that right.
- Complain to your local data-protection authority.
You can manage camera and photo permissions in device settings and delete your account in the app. To make another privacy request, email [email protected]. We may need to verify your identity before completing a request, and legal exceptions may apply. We will not discriminate against you for exercising applicable privacy rights.
Children's Privacy
The Service is not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
Changes to This Policy
We may update this Privacy Policy as the Service or legal requirements change. We will post the revised policy, update the date above, and provide additional notice when required by law.
Contact Us
YTD Labs is responsible for the processing described in this policy. Questions and privacy requests can be sent to [email protected].