Privacy policy

What we collect

Account data: your email address and the account identifier issued by Firebase Authentication when you sign in with email or Google. If you use the app as a guest, we store a random device identifier instead.

Card photos: the image you upload for a scan. It is sent to our recognition service, matched against the card catalog, and discarded once the result is returned. We keep a photo only if you tick the donate box when confirming a card.

Scan and collection data: the card you confirmed, printing, finish, condition, quantity, tags and notes, plus scan timestamps and how many scans you have used.

Support messages: the email address and content of anything you send to our support address.

Analytics and advertising: page views, whether a scan completed, whether an account was created, and your cookie choice. These load only if you have consented, or if you are outside the EEA, the UK and Switzerland and have not opted out.

Why we use it

To identify the card in your photo, show sourced market references and price history, and keep your collection in sync across your devices.

To count free scans, run subscriptions, and prevent abuse of the scanner.

To improve recognition accuracy — only with photos you explicitly donated.

To measure which campaigns bring people who actually scan a card. We never use your card photos or collection for advertising.

Legal bases (EEA, UK, Switzerland)

Performance of a contract for your account, scans and collection. Legitimate interests for security, abuse prevention and basic service statistics. Consent for donated photos and for analytics and advertising cookies, which you can withdraw at any time below or in the banner.

Who we share it with

Google (Firebase Authentication) for sign-in; Google Analytics and Google Ads for measurement when you consent; Cloudflare as our network and DNS provider; RevenueCat for subscription entitlements once paid plans go live. Price references come from TCGdex, TCGplayer, eBay and Cardmarket; we request price data from them and do not send them anything about you.

We do not sell your data. We disclose data only where the law requires it.

How long we keep it

Account data, collection entries and scan history stay while your account exists and are removed when you delete it. Undonated scan photos are not stored after recognition. Donated photos stay until you delete them from your account page. Server logs and rate-limit records are kept for a short operational window and then removed automatically.

Your choices and rights

You can export or edit your collection, delete donated photos, and delete your whole account and its data from the account page. You can also ask us to access, correct, delete or export your data, or object to processing, by email; we reply within five working days.

Contact: [email protected]. If you are in the EEA or the UK you may also complain to your local data protection authority.

Children

Foilkeep is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.

International transfers and governing law

Our servers and service providers process data outside your country, including in the United States and the European Union. This policy is governed by the laws of Vietnam, without prejudice to mandatory consumer and data protection rights in your country of residence.

We update this page when our processing changes; the date above always reflects the version in force. Foilkeep is an independent tool and is not affiliated with, endorsed by or sponsored by The Pokémon Company, Nintendo, TCGplayer, eBay or Cardmarket.