Privacy

Controller and contact

Lena Christin Gögel
c/o Autorenglück #49915
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany
Email: cardcaseapp@gmail.com
Contact form: cardcase.online/en/contact

Data in the Android app

Card quantities, conditions, print variants, languages, purchase prices and slab details (grader, grade, certificate number) of individual copies, notes and your own prices for cards, wishlists, sets you created, price queries and the history of your collection value are stored in the app's private storage on your device. The app also caches catalog entries, variant metadata, prices and images. There is no Card Case account and no online synchronization of your collection of our own.

Depending on your settings, Android may include app data in a device backup. Where it is stored and how it is handled depend on your settings and the respective backup provider.

Cards, images and prices from the internet

The app obtains card and set information from TCGdex (api.tcgdex.net), and for the Japanese, Traditional Chinese and Korean views also their own catalogs; the app brings the Simplified Chinese catalog with it. Images come from sources including assets.tcgdex.net, pokezentrum.de, images.pokemontcg.io, billsarchive.com, archives.bulbagarden.net, images.pokemoncard.io, assets.pokemon.com, game.pokemontcgpocket.app, cdn.jsdelivr.net and cloudfront.net. The app loads prices from Cardmarket's public price list (downloads.s3.cardmarket.com). It checks there at most every few hours whether new prices are available and only then downloads the list again. Price information may additionally come from TCGdex.

With such HTTPS requests, the respective providers can see the IP address, the time and the requested URL. A URL may reveal the card being displayed or a comparison image loaded for the scanner. No complete CSV collection is sent to these providers. Server locations and retention periods are determined by the external providers; processing outside the European Economic Area is possible.

“Auf Cardmarket öffnen” (open on Cardmarket), the eBay actions and “Zertifikat prüfen” (verify certificate) only open the external browser after you tap them. The eBay search contains the card name, set and card number in the URL, for slabs also the grader and grade. “Zertifikat prüfen” opens the verification page of the respective grader: for PSA, CGC, TAG and ACE with the certificate number in the URL; for Beckett, SGC, AOG, PGS, AP Grading, Black Grading and CCC, the number is copied to the clipboard instead and the grader's search page is opened. From that point on, the privacy notices of the respective service apply. Card Case does not retrieve eBay sales data or certificate data in the background.

Camera and card scanner

The scanner only accesses the camera after you allow it in Android. The camera image, recognized text, scanned QR codes and barcodes and the image comparison are processed on the device. Photos you choose from the gallery in the scanner are also only read on the device; they are neither uploaded nor stored in the app. The app does not transfer any camera image to a server of its own or to TCGdex. For the comparison, reference images may be retrieved from the image sources named above.

Text recognition and reading QR codes and barcodes on slab labels use Google ML Kit. For Japanese, Chinese and Korean script, the device downloads the recognition once via Google's Google Play services the first time you scan in that language view. According to Google, input images and recognition results stay on the device. ML Kit may transmit device and app information, installation identifiers, performance and error data as well as usage events to Google. Details are in the ML Kit terms and the ML Kit data disclosure.

Import, export and sharing

When you start an export or share something yourself, the app creates a CSV file or a message text and opens the Android file picker or the share menu. The chosen storage location or target app receives the selected content and processes it according to its own privacy rules.

When importing, Card Case reads a file you selected to restore your collection or wishlist. You have to delete files and messages that you store or send outside the app yourself.

The collection backup may also contain the collection value history, your notes and own prices as well as the recorded conditions, print variants, languages, purchase prices and slab details. Shared card lists (text messages) do not contain purchase prices, notes or own prices. This content is also passed to the chosen storage location or target app when you start an export or share.

Purposes and legal bases

Card Case lets you manage cards and custom sets, retrieve prices and images, use the scanner and import and share lists. The collection itself is kept on your device. For online content and voluntary participation in the beta test, requests are sent to the providers named in this notice or to cardcase.online.

Insofar as personal data is processed, we base the technically necessary operation, the secure provision of the features and the handling of beta feedback on Art. 6(1)(f) GDPR (legitimate interest). The camera and feedback are voluntary. Without an internet connection, current online content is not available; without a beta approval you cannot send beta feedback through the app. No solely automated decisions with legal or similarly significant effects are made.

Retention and deletion in the app

Collection, wishlist and custom sets remain stored until you remove entries or the app data. The collection value history stays stored locally and is included in the CSV backup when you export the collection. Catalog information is renewed regularly; cached images and prices remain until they are replaced or the app data is deleted.

Uninstalling removes the local app data. Files you have already exported and Android backups are not deleted automatically as a result. External services apply their own retention periods.

Email enquiries

If you write to us, we use your email address and your message to reply to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling the enquiry). Correspondence is only kept as long as necessary for handling it or because of statutory retention obligations. Messages sent through the contact form are covered by the section Contact form.

Your rights

In accordance with the GDPR, you can request access, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interests. You also have the right to lodge a complaint with a data protection supervisory authority. For this or for questions, contact cardcaseapp@gmail.com. You can edit locally stored collection data in the app and export it as CSV.

Visiting this website and cookies

The website, beta API and database are hosted by IONOS SE. When you visit, connection data that is technically necessary for delivery and security is processed, in particular IP address, time, requested address and browser information. IONOS processes access logs according to the deletion periods of the booked web hosting contract. The legal basis is Art. 6(1)(f) GDPR (secure and reliable operation of the website). We do not create visitor profiles from this and do not use any analytics or marketing scripts on the public website.

When the protected beta admin area is accessed, a technically necessary session cookie is set for sign-in and protection against misused form requests. It is only transmitted via HTTPS and does not contain a password. The sign-in expires after eight hours of inactivity.

Access to the beta admin area

The admin area is protected by a user name, a password and a one-time code from an authenticator app. We store the user name, a password hash, an encrypted authenticator key, session data and information about failed sign-ins and temporary lockouts. The password is not stored in plain text. This processing serves to protect beta approvals and messages (Art. 6(1)(f) GDPR).

Beta approvals and feedback

For the beta test you receive an access code. On activation and verification, the app processes the code and a randomly generated installation ID stored locally. The server stores hash values of these as well as the times of activation and of the last check. This allows a code to be assigned to an installation and a revoked approval to be recognized.

If you send feedback from the app, your message, a name you give voluntarily, the app version, the time and an identifier to avoid duplicate messages are transmitted to cardcase.online over an HTTPS connection. The data is stored in the beta database and can only be viewed in the protected admin area; no automatic email with the feedback is sent. A valid access code is required to take part; giving a name is voluntary. The legal basis is Art. 6(1)(f) GDPR (running and evaluating the beta test, handling the feedback and protection against misuse).

Approvals and feedback remain stored as long as they are needed for the beta test and for handling the feedback. After that they are deleted in the admin area; when an approval is deleted, the feedback assigned to it is deleted as well. For deletion requests, you can reach us at cardcaseapp@gmail.com.

Automatic version check

From app version 0.14.62 on, Card Case retrieves the publicly provided version information from https://cardcase.online/api/update/ via HTTPS when it starts. No collection, beta codes or installation IDs are transmitted. The retrieval involves the technically necessary connection data described in the section about visiting this website.

Choosing “Später erinnern” (remind me later) is stored locally on your device and postpones the notice for the same version by 24 hours. An APK download only starts in the browser after you tap. The version check serves to provide current app versions.

Contact form

With the contact form at cardcase.online/en/contact you can write to us without opening an email program. We store your email address, your message, a name you enter voluntarily, the language of the page and the time in the website's database at IONOS SE. The message is only visible in the protected administration area. We use the details exclusively to answer your enquiry; the reply comes by email from cardcaseapp@gmail.com. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling the enquiry).

To protect against mass-sent messages, the server stores a non-reversible check value of your IP address with each message for 24 hours and uses it to limit the number of messages per connection; the IP address itself is not stored for this. A hidden field that only automated programs fill in keeps spam out. The form sets no cookies and loads nothing from other providers.

We delete messages from the form as soon as your enquiry has been dealt with, automatically after 180 days at the latest. The section “Email enquiries” applies to the email reply.