Privacy policy
Last updated: September 23, 2026
This policy applies to kardzapp.com and the Kardz mobile app (Android and iOS). It explains what personal data is processed, why, and what your rights are. The French version prevails.
1. Data controller
being updated, sole trader, being updated, SIRET being updated. For any question about your data: contact@kardzapp.com.
2. What Kardz does
Kardz compares trading card listings (Pokémon, sports) published on eBay in several countries to estimate a price and spot listings selling below it. The mobile app offers the same features as the website, plus a scanner that uses the phone's camera.
3. Data processed
| Data | When | Why |
|---|---|---|
| Username, e-mail address, password (stored hashed, never in clear) | Account creation | Open and secure your account, contact you about the service |
| ID and e-mail sent by Google | "Continue with Google" sign-in | Create or find your account without a password |
| Card photos | Using the scanner | Identify the card and estimate its price. The photo is sent to our servers and then to eBay's image search; it is not kept after processing. |
| Collection, favorites, price alerts, preferences (market, currency, language), searches | Using the service | Provide the features you ask for |
| Notification token (Web Push, Firebase Cloud Messaging or Apple Push) | If you turn notifications on | Tell you about a price drop, a deal or the deal of the day |
| Billing data (via Stripe) | Subscribing on the website | Collect and manage the subscription. Kardz never sees or stores your card number. |
| Browsing data: pages viewed, visit source, clicks and scrolling, device type, country derived from the IP address | Browsing the website | In-house audience statistics and site improvement. The IP address is not kept for these statistics: it is only used to compute a hashed identifier that changes every day, and the country. |
| IP address and requests in server logs | Every request | Security, abuse prevention |
| TikTok pixel, ad click ID, hashed e-mail and account ID | Only if you accept advertising in the cookie banner | Measure how well our TikTok ads work |
| Name, e-mail, content of the request | Contact, withdrawal or complaint | Handle your request |
4. Legal bases
- Performance of the contract: account, scanner, collection, alerts, subscription, withdrawal.
- Legitimate interest: service security, in-house audience statistics (you can object from "Cookie settings"), abuse prevention.
- Consent: push notifications (revocable in your device or browser settings); TikTok advertising on the website (revocable from "Cookie settings").
- Legal obligation: keeping accounting records for subscriptions.
5. Recipients and processors
Your data is never sold or rented. It is processed by our providers, only for the purposes described:
- OVHcloud (France) — server and database hosting.
- eBay — market data and image search (the scanned photo goes through this service). When you click an eBay affiliate link, eBay receives information about that click under its own policy.
- Stripe — payment and management of subscriptions taken out on the website.
- Google — "Continue with Google" sign-in; Firebase Cloud Messaging and Apple Push Notification service — mobile notification delivery; your browser's push service for web notifications.
- TikTok — measuring our ads on the website, only with your consent (never in the mobile app).
Some providers are located outside the European Union (United States); transfers rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.
6. Retention periods
- Account and related data: as long as the account exists, then deleted within 30 days of closure.
- Scanned photos: not kept after analysis.
- Notification tokens: until turned off or expired.
- Server logs and visit statistics: 13 months at most.
- Cookie banner choices: 6 months.
- Withdrawal requests: as long as needed to handle and prove them (5 years).
- Billing records: 10 years (accounting obligation).
7. Your rights
You have the right to access, correct, erase, restrict, object to and port your data, to withdraw your consent at any time, and to give instructions about your data after your death. You can:
- delete your account yourself from the My account page (website and app) — this erases your account, collection, alerts and favorites and cancels any active subscription;
- change your e-mail and password from the same page;
- change your cookie choices at any time: Cookie settings;
- write to contact@kardzapp.com for any other request. We answer within one month.
You can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.
8. Cookies and audience measurement
See the cookie page. Audience statistics are produced by our own servers, with no third-party analytics tool.
9. Mobile app permissions
- Camera: only when you launch the scanner, to photograph a card.
- Notifications: only if you turn them on.
None of these permissions is used in the background. The app does not access your contacts, location or files other than the photo you choose.
10. Security
Encrypted connections (HTTPS), hashed passwords, restricted server access, regular backups. No system is foolproof: we would inform you without delay of any breach likely to affect you.
11. Minors
Kardz is intended for adults and for minors over 15 with their parents' consent. We do not knowingly collect data from children under 15.
12. Changes
This policy may change as the service evolves. The date at the top shows the latest version; you will be told about any significant change in the app or by e-mail.