Privacy policy

This policy applies to kardzapp.com and the Kardz mobile app (Android and iOS). It explains what personal data is processed, why, and what your rights are. The French version prevails.

1. Data controller

ABERLENC ADRIEN, sole trader, 4 RUE DES CHANTEREINES, 95620 PARMAIN, SIRET 82857577900016. For any question about your data: adrien.aberlenc@hotmail.fr.

2. What Kardz does

Kardz compares trading card listings (Pokémon, sports) published on eBay in several countries to estimate a price and spot listings selling below it. The mobile app offers the same features as the website, plus a scanner that uses the phone's camera.

3. Data processed

Data	When	Why
Username, e-mail address, password (stored hashed, never in clear)	Account creation	Open and secure your account, contact you about the service
ID and e-mail sent by Google	"Continue with Google" sign-in	Create or find your account without a password
Apple ID, e-mail (possibly hidden by Apple) and first name sent by Apple, sign-in token	"Continue with Apple" sign-in	Create or find your account without a password; the token is revoked with Apple when you delete your account
Anonymous subscriber ID (kz_…), product bought, start and end dates, store (App Store or Google Play), store receipts	Subscribing in the mobile app	Unlock the paid modules and link them to your account. Kardz never sees or stores your payment details: payment is processed by Apple or Google.
Card photos	Using the scanner	Identify the card and estimate its price. The photo is sent to our servers and then to eBay's image search; it is not kept after processing.
E-mail address	When one of your price alerts triggers	Send you the alert by e-mail (1 e-mail every 6 hours at most), can be turned off in one click from the e-mail or My account
E-mail address, date and answer to the "news" box	Only if you tick "Get Kardz news by e-mail"	Send you Kardz news (2 e-mails a month at most), one-click unsubscribe
Technical cookie kz_libre, hashed IP address	Scanning a card without an account	Limit free scans without an account (3 per device per 24 h). The photo is not kept.
Collection, favorites, price alerts, preferences (market, currency, language), searches	Using the service	Provide the features you ask for
Notification token (Web Push, Firebase Cloud Messaging or Apple Push)	If you turn notifications on	Tell you about a price drop, a deal or the deal of the day
Billing data (via Stripe)	Subscribing on the website	Collect and manage the subscription. Kardz never sees or stores your card number.
Browsing data: pages viewed, visit source, clicks and scrolling, device type, country derived from the IP address	Browsing the website	In-house audience statistics and site improvement. The IP address is not kept for these statistics: it is only used to compute a hashed identifier that changes every day, and the country.
IP address and requests in server logs	Every request	Security, abuse prevention
TikTok and OpenAI pixels, ad click IDs, hashed e-mail and account ID	Only if you accept advertising in the cookie banner	Measure how well our ads on TikTok and in ChatGPT work
Name, e-mail, content of the request	Contact, withdrawal or complaint	Handle your request

4. Legal bases

• Performance of the contract: account, scanner, collection, alerts (including by e-mail), subscription, withdrawal.
• Legitimate interest: service security, limit on scans without an account, in-house audience statistics (you can object from "Cookie settings"), abuse prevention.
• Consent: push notifications (revocable in your device or browser settings); news e-mails (tick box, one-click unsubscribe); TikTok and ChatGPT advertising on the website (revocable from "Cookie settings").
• Legal obligation: keeping accounting records for subscriptions.

5. Recipients and processors

Your data is never sold or rented. It is processed by our providers, only for the purposes described:

• OVHcloud (France) — server and database hosting.
• eBay — market data and image search (the scanned photo goes through this service). When you click an eBay affiliate link, eBay receives information about that click under its own policy.
• Stripe — payment and management of subscriptions taken out on the website.
• Apple (App Store, "Sign in with Apple") and Google (Google Play) — sale and management of subscriptions bought in the app, Apple sign-in.
• RevenueCat, Inc. (United States) — validation of in-app purchases and subscription tracking; receives the anonymous subscriber ID and store receipts, never your e-mail or payment details.
• Google — "Continue with Google" sign-in; Firebase Cloud Messaging and Apple Push Notification service — mobile notification delivery; your browser's push service for web notifications.
• TikTok — measuring our ads on the website, only with your consent (never in the mobile app).
• OpenAI (OpenAI Ireland Limited; possible transfer to the United States) — measuring our ads shown in ChatGPT, on the website, only with your consent (never in the mobile app).

Some providers are located outside the European Union (United States); transfers rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

6. Retention periods

• Account and related data: as long as the account exists, then deleted within 30 days of closure.
• Scanned photos: not kept after analysis.
• Notification tokens: until turned off or expired.
• Server logs and visit statistics: 13 months at most.
• Cookie banner choices: 6 months.
• Withdrawal requests: as long as needed to handle and prove them (5 years).
• Billing records: 10 years (accounting obligation).

7. Your rights

You have the right to access, correct, erase, restrict, object to and port your data, to withdraw your consent at any time, and to give instructions about your data after your death. You can:

• delete your account yourself from the My account page (website and app) — this erases your account, collection, alerts and favorites and cancels a subscription bought on the website (an App Store or Google Play subscription is cancelled in the store settings);
• change your e-mail and password from the same page;
• change your cookie choices at any time: Cookie settings;
• write to adrien.aberlenc@hotmail.fr for any other request. We answer within one month.

You can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.

8. Cookies and audience measurement

See the cookie page. Audience statistics are produced by our own servers, with no third-party analytics tool.

9. Mobile app permissions

• Camera: only when you launch the scanner, to photograph a card.
• Notifications: only if you turn them on.

None of these permissions is used in the background. The app does not access your contacts, location or files other than the photo you choose.

10. Security

Encrypted connections (HTTPS), hashed passwords, restricted server access, regular backups. No system is foolproof: we would inform you without delay of any breach likely to affect you.

11. Minors

Kardz is intended for adults and for minors over 15 with their parents' consent. We do not knowingly collect data from children under 15.

12. Changes

This policy may change as the service evolves. The date at the top shows the latest version; you will be told about any significant change in the app or by e-mail.