Privacy Policy

Last Updated: August 12, 2026

1. Introduction

Protecting your privacy is a core design decision in CardIQ, not an afterthought. The practices described here are built to comply with the major data protection frameworks worldwide, including the GDPR, the UK GDPR (and the Data Protection Act 2018), the CCPA, and PIPEDA.

Who is responsible for your data

CardIQ is operated by Andrés Felipe Saumet (Colombia), trading as Alquimia Studio, acting as the data controller. Contact: andressaumet@gmail.com

2. Information We Collect

CardIQ is deliberately built around minimal data collection:

Anonymous UUID: a random identifier created on your own device. It is never tied to who you are.
Card images: used exclusively while your card is being analyzed, as described in Section 3.
IP address: seen by our server on every request. We use it to limit abuse, and when something goes wrong it is recorded in an error log alongside your anonymous UUID.
Search queries: card names, sent out only to look up market prices.
Device advertising identifier (IDFA): accessed by the Meta (Facebook) SDK solely when you allow it through the iOS App Tracking Transparency (ATT) prompt. Decline it, and Meta gets nothing but anonymous, non-identifiable data.
App events: basic in-app actions (opening the app, making a purchase) reported to Meta so ad campaigns can be attributed.
Portfolio snapshots: once a day, the app saves the total estimated value of your collection on your device to power the Portfolio Value Tracker. These snapshots never leave your phone.

What we never collect

✗ Personal details: no name, no email address, no phone number
✗ GPS or precise location
✗ IMEI numbers or other hardware identifiers
✗ Anything you browse outside the app
✗ Biometric data, demographic info, or sensitive personal data
✗ Payment details

Legal basis for processing (GDPR)

Where the GDPR applies, our processing rests on: (a) legitimate interests — delivering the app's core features such as analyzing cards and tracking your portfolio, and protecting the service from abuse; (b) consent — advertising attribution through the Meta SDK, gathered via the iOS ATT prompt; and (c) performance of a contract — handling your subscription through RevenueCat.

3. Third-Party Data Processing

CardIQ backend server (image proxy)

Your card photos travel over encrypted HTTPS to a server we operate, which passes them along to OpenAI
Once analysis finishes, the images are discarded. We keep no copies and no logs of them
What the server does keep: the analysis result, cached for up to 24 hours so that re-scanning the same card does not cost another analysis; and IP addresses, used to limit abuse and recorded in error logs
This server runs in the United States

OpenAI (AI analysis)

Receives card images from our proxy for the sole purpose of analyzing them
Your images are not used to train OpenAI's models
OpenAI may briefly retain API inputs and outputs for abuse monitoring under its API data policy. We retain nothing once the analysis is returned to your device
Policy: https://openai.com/policies/privacy-policy

eBay API (pricing data)

Sees nothing beyond card and set names, sent by our server using our own credentials
Receives zero personal data — eBay never sees your device or your identifier
Policy: https://www.ebay.com/help/policies/member-behaviour-policies/ebay-privacy-notice

Meta (Facebook) SDK (advertising attribution)

Gets app events (opens, purchases) so advertising performance can be measured
Your IDFA is shared with Meta only when you've granted the ATT permission
With ATT declined, the only signal sent is anonymous, aggregated data through Apple's SKAdNetwork
Retention is subject to Meta's own policy
Policy: https://www.facebook.com/privacy/policy/

RevenueCat (subscription management)

Gets an anonymous device identifier plus your subscription status and purchase history
May pass purchase events on to Meta for attribution (server-to-server)
Policy: https://www.revenuecat.com/privacy

4. How We Use Your Data

Keeping your card collections organized, locally on your device
Assessing card condition and estimating value
Showing you current market pricing
Measuring how well our ads perform, through the Meta SDK

Just as important is what we don't do:

We never sell or rent your data. We don't exchange your information for money, and we don't provide it to data brokers.
The only advertising-related sharing we do is the one described in Section 3. If you grant the ATT permission, your advertising identifier and basic app events are shared with Meta so we can measure how our ads perform. Decline the prompt and none of that is shared.
We build no profiles of you beyond what's spelled out above, and nothing we show you is targeted on the basis of your cards or your collection.
Your card images and scan history are used for nothing other than returning the analysis to you.
Your data never trains an AI model. OpenAI does not use API data for model training.
The only personal data on our own servers is your IP address, kept for the reasons given in Section 3.

5. Data Storage & Security

Local storage (your device only)

All data stored in Hive database on your device
Protected by iOS/Android system encryption
Only CardIQ app can access
Deleted when you uninstall the app. What our server and our providers hold is set out in Section 6, and uninstalling does not reach it

Not on our servers

✗ Card images (except briefly during OpenAI processing)
✗ Your name, email, or any account
✗ Your collection, scan history, or portfolio
✗ Payment data (handled by Apple)

What our server does hold is limited to cached analysis results and IP addresses, for the periods given in Section 6.

Security measures

HTTPS/TLS for API connections
No user accounts or passwords
No centralized user database
Use device lock screen to protect local data

6. How Long We Keep Things

On your device, for as long as you keep the app

Your cards, collections, scan history and portfolio snapshots. Nothing here expires; you can delete any of it at any time, and uninstalling removes all of it.
Card photos, kept in the app's own storage so your collection can display them.

On our server, briefly

Card images: discarded as soon as the analysis returns. Not stored, not logged.
Analysis results: cached up to 24 hours, then dropped. The cache is held in memory, so it is also cleared whenever the server restarts.
IP addresses: held in memory by the abuse limiter for the length of its rate-limiting window, and written to an error log if a request fails. Error logs are kept no longer than 30 days.

With our providers, under their own policies

OpenAI: may retain API inputs and outputs up to 30 days for abuse monitoring.
RevenueCat: keeps your subscription record for as long as you have an account with them through the app, so that a purchase can be restored.
Meta: retention is governed by Meta's policy.

Uninstalling the app clears everything on your device. It does not reach what our providers hold — to have that removed, write to us at the address in Section 7.

7. Your Privacy Rights

GDPR (EU/UK residents)

Right to Access: Get a copy of the data we hold
Right to Deletion: Permanently erase your UUID and any cached data associated with it
Right to Correction: Update inaccurate information
Right to Restrict Processing: Limit how we use your data
Right to Object: Object to processing on legitimate grounds
Right to Not Be Subject to Automated Decision-Making: CardIQ provides AI-powered grade estimates for informational purposes only. These are NOT official professional grades. For certified grading, submit your cards to PSA, BGS, or CGC. Actual grades may differ significantly from our estimates.

A note on access and portability: your cards, collections and scan history live only on your device — we hold no copy, so there is nothing for us to send you. Anything we do hold is listed in Section 3, and you can request it or its deletion at the address below.

CCPA (California)

Right to Know: What data we collect and how we use it
Right to Delete: Request deletion (except legally required data)
Right to Opt-Out of Sale or Sharing: We do not sell your data. The advertising sharing described in Section 4 happens only if you grant the ATT permission, and you can withdraw it at any time in iOS Settings → Privacy & Security → Tracking
Right to Non-Discrimination: No penalty for exercising your rights

UK GDPR & DPA 2018

Same rights as GDPR above. Supervised by: Information Commissioner's Office (ICO)

PIPEDA (Canada)

Access Information: Request all data we hold
Correct Information: Update inaccurate data
Request Deletion: Permanent removal of personal information
File a Complaint: Office of the Privacy Commissioner of Canada (www.priv.gc.ca)

Right to lodge a complaint (GDPR/UK GDPR)

You have the right to file a complaint with your local data protection authority if you believe your data is being processed unlawfully — e.g., the ICO (UK) at ico.org.uk, or your EU Member State's supervisory authority.

How to exercise your rights

Email: andressaumet@gmail.com
Subject: "[Right Name] + [Your Jurisdiction]"
Examples: "GDPR Data Access", "CCPA Right to Delete", "PIPEDA Access Request"

Response Timeline: 30 days or notification of extension

8. International Data Transfers

When using OpenAI

Your data transfers to USA servers
USA lacks GDPR-equivalent protections
Legal basis: Standard Contractual Clauses, under the Data Processing Addendum we have executed with OpenAI
Risk: USA government may access data under surveillance laws (FISA)

If you're an EU/UK resident and concerned

You can object to processing
You can request data deletion
You can decline to use OpenAI features

9. Children's Privacy

CardIQ is NOT intended for:

Users under 13 (USA — COPPA)
Users under 16 in the EU, or the higher applicable age where local law sets one

If a child uses CardIQ, parents/guardians may request deletion by emailing andressaumet@gmail.com with proof of parental consent.

10. Subscription & Free Tier

CardIQ operates on a freemium model. Free users receive the following one-time limits (not per month — one time, ever):

1 card scan (lifetime)
1 collection created (lifetime)
1 card added to a collection (lifetime)
1 market price refresh (lifetime)

Once any of these limits is reached, a CardIQ Pro subscription is required to continue using that feature. These limits are tracked locally on your device using Hive storage and are not reset unless the app is uninstalled.

CardIQ Pro (paid subscription)

Up to 25 card scans per day (resets at midnight); price refreshes count towards this limit; unlimited collections and card additions
Sold as weekly, monthly and annual subscriptions. Current prices are shown in the app before you purchase, in your local currency
Managed through RevenueCat and billed by the Apple App Store
RevenueCat may collect: anonymous device identifier, subscription status, purchase history
RevenueCat Privacy Policy: https://www.revenuecat.com/privacy

CardIQ does NOT have access to your payment details. All billing is handled exclusively by the Apple App Store.

11. Data Sharing & Disclosure

We share data with

OpenAI: Card images for analysis
eBay: Card names for pricing
Meta (Facebook): App events and IDFA, if you granted the ATT permission, for advertising attribution
RevenueCat: Subscription status, to manage your Pro access
Third parties: Only if legally required (subpoena, court order)

We do NOT share data with

✗ Data brokers
✗ Marketing companies unrelated to our advertising
✗ Analytics services beyond those listed above

Business transfers

If CardIQ is acquired or merged, your data transfers under the same privacy terms. We will notify you of material changes.

12. Changes to This Policy

We may update this policy to reflect:

Legal changes
New features or data practices
User feedback

Changes announced via:

In-app notification
Updated "Last Updated" date
New version of this policy

Continued use = acceptance of changes.

13. Disclaimer

This Privacy Policy does not constitute legal advice. While we strive for accuracy and compliance, CardIQ is provided "as-is". Andrés Felipe Saumet, trading as Alquimia Studio, assumes no liability for:

Device compromise or unauthorized access
Third-party service breaches (OpenAI, eBay)
User error or unintended data sharing
Changes to third-party privacy practices
PSA, BGS (Beckett Grading Services), and CGC are trademarks of their respective owners. CardIQ is not affiliated with, endorsed by, or sponsored by any grading company

For legal concerns, consult a privacy attorney in your jurisdiction.

Contact & Full Policy

CardIQ is operated by Andrés Felipe Saumet (Colombia), trading as Alquimia Studio, the data controller for the purposes of this policy.

Email: andressaumet@gmail.com

Last Updated: August 12, 2026