When you create an account, we collect the information you provide directly: email address (via email/password, Google sign-in, or Sign in with Apple — if you choose Apple's Hide My Email option, we receive only Apple's private relay address), username, and date of birth (collected when you first set up your profile, to verify you meet our minimum age requirement — see Children's Privacy below); your country (needed to complete your profile — you can let the App detect it from your device's location, or simply choose it from a list); and, only if you choose to add them, your first/last name and a profile picture. When you use the Scan feature, photos you capture of your cards are processed on your device and, if you save a card to your Collection or list it on the Market Place, the resulting card image, card data (name, set, condition, self-assigned grade, price), and a compact numerical fingerprint of the image (used only to help match future scans to the same card) are stored in our database. Separately, on every scan attempt — whether or not you go on to save a card — we record technical diagnostic data tied to your account: numerical confidence and similarity scores our card-identification system computed, and, where applicable, which catalog entry it matched against. This diagnostic data does not include the scan photo itself; we use it only to monitor and improve scan accuracy. We also retain a history of timestamped price snapshots for each card you save, so the App's price-history charts can show how a card's price — and your overall portfolio's value — has changed over time. If you use the Market Place or Friends features, we store your listings, friend connections, messages you send to other Users — including any photos or files you choose to attach to a message — and blocks or reports you create. If you choose to add Contact Methods to your profile (email, WhatsApp, Telegram, and/or Instagram), we store the values you enter and, where you complete our verification flow for email or Telegram, whether that method has been verified. If you subscribe to U.C.M Ultra, our payment processor (Apple, Google, or RevenueCat) shares subscription status and purchase metadata with us — we never receive or store your full payment card number. If the App crashes or hits an error, we may also receive a technical error report (the error message, App version, device platform, and your account ID) so we can find and fix the problem, and to protect sign-up from abuse we briefly process the IP address of sign-up requests to limit how many can be made in a short time.
The App requests camera access to let you scan physical trading cards, and photo library access to let you attach an existing photo instead of taking a new one, and to save a generated Share Card image back to your device. Camera frames are processed on-device for card detection and are not uploaded anywhere unless you explicitly capture, save, or share a card.
The App requests location access for one optional, User-initiated purpose only: to auto-detect the country shown on your profile from your device's approximate location. Location access is never required: if you decline the permission, or prefer not to share your location, you can choose your country from a list instead and every feature of the App works the same. Location is never read automatically or in the background — only at the moment you tap to detect your profile country, and only the resulting country name is kept. The App does not let you send your location to other Users. We do not track, log, or store a history of your location over time.
We use the information we collect to: operate your account and Collection; power the Market Place (showing your listings to other Users, and other Users' listings to you); look up pricing for your cards and products from third-party pricing services (see Third-Party Service Providers below) using only the item's name, set, and identifying number, not your personal data; enable Friends and Messages between Users, including any Contact Methods you choose to share; process and validate subscription purchases; enforce your accepted Terms of Use; send local, on-device notifications you've enabled (such as a daily scan-streak reminder); and improve the App's reliability and card-identification accuracy. We do not sell your personal information to third parties.
If you add a Contact Method (email, WhatsApp, Telegram, or Instagram) to your profile, that value is private by default — it is not shown on your public profile or to Users browsing the Market Place. It becomes visible only to a User with whom you have an active message thread, so the two of you can move a transaction to your preferred channel outside the App. Verifying an email or Telegram Contact Method (via a code we send to that email address, or via our Telegram bot) confirms only that you control that address or handle at the time of verification — it is not an identity check, and a "Verified" badge does not mean we have confirmed who you are. Once you share a Contact Method with another User, or receive one from them, any further communication conducted through that channel takes place entirely outside the App and is not monitored, stored, moderated, or controlled by us — see the Terms of Use for the corresponding disclaimer.
Your username, profile picture, country, and any cards you list on the Market Place are visible to other Users of the App. Messages you send — including any photos or files you attach — are visible to the recipient. Your Contact Methods are shared only as described in Contact Methods and Sharing With Sellers above. Friend requests, friendships, and blocks reflect your own choices and are only visible to the Users involved.
Each week, the App calculates four rankings from your account's aggregate activity that week — cards added to your Collection, items listed on the Market Place, your portfolio's percentage gain, and the highest single card value you've added — and shows the Global top 3 performers in each category to every signed-in User, by username and profile picture only. No individual card, listing, price, or other personal or financial detail is shown as part of a ranking — only your relative placement. A Global top-3 placement is permanently recorded as a "medal" and continues to be shown on your own Profile and on your Market Place listings after the week it was earned, so other Users can see it when considering a purchase from you.
We use the following third-party services to operate the App, each of which processes a limited slice of your data under its own privacy policy: Supabase (account authentication, database storage, and Market Place/Friends/Messages data, including message attachments); Google (Google Sign-In, if you choose that sign-in method); Apple (Sign in with Apple, if you choose that sign-in method); RevenueCat, Apple App Store, and Google Play (subscription purchase processing and entitlement validation); PriceCharting (card and product pricing — receives the item's name, set, and identifying number, not your personal account data); free card-database APIs (Pokémon TCG, TCGdex, YGOPRODeck, Scryfall, optcgapi.com, tcgcsv.com) that receive only the card name/set text you search for; Resend (delivery of account emails, such as email-verification codes and password-reset codes, to the email address you provide); Telegram (if you choose to link a Telegram Contact Method, Telegram's Bot API is used to verify you control the handle you enter); Google Play Integrity (Android only — confirms that sign-in and listing requests come from a genuine copy of the App; it returns a pass/fail device verdict and receives no personal content); Expo (delivery of App updates — when the App checks for an update, Expo's servers receive standard technical request data such as your IP address, device platform, and App version, but no account information); Google Firebase (Android only — part of the system notification framework; it may create a random app-installation identifier and receives no personal content); Cloudflare (hosting and security for our website, including this Privacy Policy and the account-deletion page, which involves standard web-request data such as IP addresses); and Anthropic (AI service, used server-side (a) to write and translate U.C.M's own weekly market news from our own price data for the Weekly tab's News feed, which involves none of your personal data, and (b) if you agree when you add a profile picture, to automatically check it for objectionable content, which sends only the picture itself — never your name, email, or other account information). We share with each provider only the data it needs to perform its service, and each is bound by its own terms and privacy policy to protect that data, so your data receives the same or equal protection as described in this Privacy Policy.
We retain your account data for as long as your account remains active. You may delete individual cards, listings, friendships, conversations, or Contact Methods at any time from within the App. To delete your entire account, use Profile > Delete Account in the App: this immediately hides your profile, listings, and leaderboard presence from other users and schedules your account for deletion, and signs you out. If you sign back in within 30 days, your account is fully restored exactly as it was. If you do not sign back in, your profile, collection, listings, messages, Contact Methods, and friendship data are permanently erased 30 days after you requested deletion, except where retention is required to comply with legal obligations or resolve disputes. Verification codes sent for email or Telegram Contact Methods expire automatically shortly after they're issued and are not retained beyond that window. Past Weekly Leaderboard medal placements are retained as part of your Profile's history even after account data is otherwise updated, until your account is permanently deleted. If you signed in with Apple, deleting your account also revokes U.C.M's access to your Apple ID sign-in. Deleting your account does not cancel an App Store or Google Play subscription — cancel it in your Apple ID or Google Play account settings. You can also request deletion by contacting us using the email address below.
The App asks for your date of birth when you first set up your profile; if you are under the minimum age of 13, the account is not allowed and is deleted. The App is not directed to children under that age, and we do not knowingly collect personal information from them. If you believe a child has circumvented this age check or otherwise provided us with personal information, contact us using the email address below and we will delete the associated account and data.
If you encounter a listing, message, or User that violates our Terms of Use or applicable law, you can report it directly within the App, or by emailing us at the address in Contact Us below. We review reports and, where warranted, remove the reported content or restrict the reported account. To keep objectionable content out of the App, usernames and first/last names are automatically checked against a list of offensive terms and rejected if they match, and new profile pictures are automatically checked once you agree to it when adding one (see Anthropic in Third-Party Service Providers above) and removed if they contain nudity, sexual, violent, hateful, or otherwise objectionable content. You can also block any User at any time. We have zero tolerance for objectionable content or abusive Users. See the Terms of Use's Prohibited Conduct and User Content sections for more detail, including our process for copyright (DMCA) complaints.
We use industry-standard security measures, including encrypted transport (HTTPS) and row-level access controls on our database, to protect your information. No method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, contact us using the email address below.
We may update this Privacy Policy from time to time. Continued use of the App after any such update constitutes acceptance of the revised policy.
For any privacy question, data access or deletion request, content report, or copyright (DMCA) complaint, contact us at [email protected]. You can also delete your account directly from Profile > Delete Account, which schedules your profile, collection, listings, messages, Contact Methods, and friendships for permanent deletion 30 days later — signing back in before then fully restores your account.