Privacy Policy

Effective date: October 16, 2026

This policy explains what information TCGScan: Trading Card Scanner (the "App") collects, why it collects it, and who receives it. The App is provided by Marcana B.V., a company registered in the Netherlands ("we", "us"). You can reach us at contact@marcana.app.

1. Information the App collects

Information that stays on your device

Your saved collections, the prices stored with them and your list of recent searches are kept only on your iPhone, and deleting the App deletes them. Some of what you type or open still leaves your device, as the sections on searches and usage below explain.

You do not need an account to use the App. It never asks for your name, email address or age.

Card scans

When you scan a card, the App crops the photo to the card outline on your screen and sends it through our server to OpenAI, which reads the card's name, HP and number. Anything else inside the outline goes along with the card. OpenAI keeps the request, photo included, for at least 30 days. Under OpenAI's API terms, it does not use this data to train its models unless the developer opts in. We keep no other copy of the photo.

Searches

When you search for a card, the text you type goes to our server, which runs on Google Cloud as part of Google Firebase. Our server logs keep the search text for a limited time so we can find and fix problems.

Usage and diagnostic information

We use Amplitude and Google Firebase Analytics to see how people use the App. These services collect your device model, iOS version, language, app version and approximate region, which they derive from your IP address. They also record events inside the App, for example a scan, a search with its search text, a screen you open, or the name of a collection you open. Each service gives your device its own identifier.

Firebase Crashlytics sends us a report when the App crashes. Firebase Remote Config downloads App settings from Google and collects basic diagnostic information while it does so.

Purchases

Apple processes all purchases and subscriptions, and we never see your payment details. RevenueCat manages your subscription status for us. It receives your App Store receipt, a random user ID it creates for your device, and your device's Firebase identifier. RevenueCat also reports each purchase, renewal and trial conversion, with its price and currency, to Google Firebase Analytics.

Tracking and ad measurement

We advertise the App with Google Ads and Apple Ads.

For Google Ads, Firebase Analytics records the first time you open the App and each purchase you make, with its product, price and currency. Google uses these events to show us which of our ads bring people to the App.

When you open the App for the first time, iOS asks whether the App may track your activity across other companies' apps and websites. If you allow it, Firebase Analytics collects your device's advertising identifier (IDFA). Google can then match your first open and your purchases to our ads you saw or tapped, for example on Google Search, YouTube or in other apps. If you decline, the App does not collect the advertising identifier, and Google receives these events without it. Section 8 explains how to change your answer.

For Apple Ads, the App asks Apple when it opens whether it was installed from one of our Apple Ads campaigns. Apple answers with the campaign, ad group, keyword and country, without using your advertising identifier. We store that answer in Amplitude and Firebase Analytics. RevenueCat also receives the attribution token from the App and uses it to match purchases to our campaigns.

Emails to us

When you email us from the App, the subject line includes the app version, your RevenueCat user ID and the region set on your iPhone, so we can look up your purchase. We also receive whatever you choose to write.

2. How we use your information

We use the information described above to:

• identify cards, find cards and their prices, and unlock your subscription
• understand which features people use, and find and fix crashes and errors
• measure which of our ads work, as described in section 1
• answer you when you email us

The App shows no ads and we send no marketing emails. The App tracks you across other companies' apps and websites only if you allow it, and we use that tracking only to measure our own ads.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: your consent for tracking, the contract between us for scans, searches and subscriptions, our legitimate interest in understanding and improving the App and measuring our advertising, and legal obligations where the law requires us to keep records.

3. Who receives your information

These service providers process information for us:

• Apple, for purchases, subscriptions and Apple Ads attribution
• Google, for Firebase Analytics, Crashlytics, Remote Config, our server on Google Cloud, and Google Ads measurement
• Amplitude, for usage analytics
• RevenueCat, for subscription management
• OpenAI, for reading card photos from AI scans

Some of these providers process information in the United States and in other countries outside the European Economic Area.

The App also loads card pictures, set symbols and set logos directly from Scrydex (images.scrydex.com). Like any website, Scrydex receives your IP address and the images the App requests.

We do not sell your personal information. We may share information when the law requires it, to protect our rights or the safety of others, or as part of a merger, sale or other transfer of our business.

4. Links to other websites

Card pages link to TCGplayer, Cardmarket and eBay so you can check prices there. Some of these links come with our card data and carry another company's referral or tracking code. We do not earn a commission from these links. The App sends these sites no information about you, and once a link opens, that site's own privacy policy applies.

5. How long we keep information

OpenAI keeps photos from AI scans for at least 30 days, and we keep no other copy. Server logs, analytics and crash reports are kept only as long as we need them for the purposes in section 2, and are then deleted or anonymized. Information on your device stays there until you delete it or the App.

6. Security

We protect information with technical and organizational measures. No transfer over the internet and no storage system is completely secure, so we cannot guarantee absolute security.

7. Your privacy rights

If you are in the European Economic Area or the United Kingdom, you can ask us for a copy of your information, or ask us to correct, delete or restrict it, to stop processing it, or to send it to you in a portable format. You can withdraw your consent at any time. You can also complain to a data protection authority, such as the Dutch Autoriteit Persoonsgegevens or the authority where you live. Residents of Switzerland can contact the Federal Data Protection and Information Commissioner.

The App has no accounts, so there is no account to delete. To ask for access to, or deletion of, the analytics data linked to your device, email contact@marcana.app. We answer within one month. The law may require us to keep some records.

8. Your tracking choice

You can change your tracking answer at any time in the iOS Settings app, under Privacy & Security, then Tracking. When tracking is off, the App does not collect the advertising identifier. Section 1 explains what is still sent without it.

9. California residents

In the last 12 months the App collected these categories of personal information: identifiers (device and app identifiers, and the advertising identifier if you allow tracking), commercial information (purchases), internet or other electronic network activity (in-app events and search text), approximate location (region derived from your IP address), and user content (card photos from AI scans).

We do not sell personal information for money. The App sends your first open and your purchases to Google, which uses them to measure our ads. If you allow tracking, the App also sends your advertising identifier, so Google can link these events to the ads you saw or tapped. California law may treat this as sharing personal information. Turning tracking off in the iOS Settings app stops the advertising identifier from being shared, while the first open and purchase events are still sent without it.

You have the right to know what personal information we collect, use and share, the right to ask us to correct or delete it, the right to opt out of sharing your advertising identifier by turning off tracking (section 8), and the right not to be treated differently for using these rights. We verify a request with information you already gave us, and we may ask for more to protect your data. We do not disclose personal information to third parties for their own direct marketing.

10. Children

The App does not ask for anyone's age, name or email address. If you believe a child has sent us personal information, email contact@marcana.app and we will delete it.

11. Changes to this policy

We may update this policy. When we do, we change the date at the top of this page.

12. Contact

Marcana B.V.
contact@marcana.app

Disclaimer

Pokémon, the Poké Ball and Pokémon Trading Cards are registered trademarks of Nintendo, Creatures Inc. and GAME FREAK inc. All rights belong to their respective copyright holders. TCGScan is not affiliated with, sponsored by or endorsed by The Pokémon Company International, Nintendo, Creatures Inc. or GAME FREAK inc.

TCGScan is not affiliated with TCGplayer, Cardmarket or eBay. The links to these platforms are there for your convenience, so you can view and buy cards.