Privacy Policy

DongHyuck Yang ("we," "us," or "our") respects your privacy and is committed to protecting your personal data in compliance with applicable data protection laws, including the Korean Personal Information Protection Act (PIPA).

1. Information We Collect

[Required Information]

• Social login identifier: unique ID from your Google, Apple, or Kakao account
• Device identifier: a UUID generated by the app
• Platform information: operating system (Android/iOS)

[Optional Information]

• Push notification token (when you enable notifications)
• Card images (sent to our server and kept temporarily for recognition, automatically deleted within 1 hour)
• AI image analysis: card images you capture or select, sent to Google Gemini API for automatic identification of card information such as player or character name, publisher, set, parallel, and grade (Google does not use these images to train its AI models; to improve recognition accuracy, the same image is also used to search eBay for listings of similar cards)
• Language preference (when changed in app settings)
• Feedback content and contact info (when you submit feedback)

[Automatically Collected]

• Access logs: login/logout timestamps, IP address, device info (retained for 3 months per the Protection of Communications Secrets Act)
• Error diagnostic logs: error messages, stack traces, OS version, app version, screen info
• Scan failure logs: OCR method, confidence score, duration (collected only on failure)
• App analytics: usage events, session info, and device info via Google Firebase Analytics
• Advertising data: advertising ID, device info, and ad interaction data via Google AdMob (non-personalized ads only)
• IP address: automatically collected by server infrastructure when submitting feedback

2. How We Use Your Information

• Account creation, authentication, and management
• Providing card image recognition (OCR) and automatic card identification
• Sending watchlist price-change alerts and other push notifications
• Error detection and service stability
• Service improvement through analytics
• Displaying advertisements (non-personalized)
• Responding to support inquiries

3. Data Retention

• We delete all server-side personal data immediately upon account deletion. Linked social login (Google, Apple, Kakao) app connections are also revoked.
• Feedback data is retained for 1 year from submission, then deleted.
• Error diagnostic logs and scan failure logs are retained for 6 months from collection, then automatically deleted.
• Access logs (login/logout timestamps, IP address, device info) are retained for 3 months as required by the Protection of Communications Secrets Act, then automatically deleted. Access logs are retained for the full 3-month period even after account deletion.

4. Third-Party Sharing

• We do NOT sell your personal information.
• We do NOT share your data with third parties except when you give explicit consent, when required by law or legal process, or with service providers (see Section 5).

5. Service Providers (Data Processing Delegation)

We delegate personal data processing to the following service providers to operate CardScanner:

• Supabase (USA): Database hosting — Data delegated: user account info, consent records, access logs / Retention: deleted immediately upon account deletion (access logs retained 3 months)
• Cloudflare (USA): Server infrastructure — Data delegated: authentication session tokens, card image recognition requests / Retention: card images automatically deleted within 1 hour; sessions deleted on expiry or sign-out
• Expo (USA): Push notification delivery — Data delegated: push tokens, device identifiers / Retention: previous tokens deleted upon renewal
• Google / Apple / Kakao: Social login authentication — Data delegated: OAuth authentication tokens / Retention: app connection revoked upon account deletion
• Google Firebase (USA): App usage analytics — Data delegated: app events, session info, device info / Retention: per Google's data retention policy
• Google AdMob (USA): Advertisement delivery — Data delegated: advertising ID, device info (non-personalized ads only) / Retention: per Google's data retention policy
• Google Gemini (USA): Image OCR — Data delegated: card images / Retention: processed only temporarily to provide the service under Google's data processing terms; not used for AI training
• eBay (USA): Card price data lookup and similar-listing search — Data delegated: card search keywords (non-identifying information such as player name or publisher), card images (with AI image analysis consent) / Retention: deleted on cache expiry; images are processed only for the search under eBay's policies

All service providers are supervised to process personal data securely in accordance with applicable data protection laws. We have executed Data Processing Addendums (DPAs) with each provider, and Google Cloud Data Processing Addendum applies to all Google services. For overseas data transfers, users are notified herein, and the above providers maintain appropriate technical and organizational security measures.

6. Cross-border Data Transfer

Pursuant to Article 28-8 of the Korean Personal Information Protection Act (PIPA), we transfer personal data overseas as follows for the provision of our Service:

We implement the following safeguards for cross-border data transfers:

• All data is encrypted in transit using HTTPS/TLS.
• Google Cloud Data Processing Addendum (CDPA) applies, ensuring transferred data is not used for AI model training.
• Data Processing Agreements (DPAs) have been executed with each recipient.
• You may refuse consent to cross-border transfers; however, refusal may limit access to certain features such as AI image analysis.

7. Data Destruction

Personal data whose purpose of collection has been achieved shall be destroyed without delay.

• Electronic files are deleted using methods that make recovery impossible.
• Card images sent for recognition are kept temporarily for follow-up steps in the same scan (finding the card area, re-recognition, image search) and are automatically deleted within 1 hour. We do not store them separately or use them for any other purpose.

8. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Request restriction of processing
• Withdraw consent at any time

Exercise these rights via Settings > Account in the app.

9. Data Security

• Encryption of sensitive data at rest and in transit (TLS/HTTPS)
• Minimal access controls with admin API access logging
• Biometric data processed locally on-device only (never sent to servers)

10. Children's Privacy

The Service is not directed at children under 14. We do not knowingly collect personal information from children under 14. If we become aware that personal information of a user under 14 has been collected, we will promptly delete it.

11. Cookies

As a mobile application, CardScanner does not use web cookies.

12. Data Protection Officer

For privacy inquiries, please use the in-app feedback feature.

• Officer: DongHyuck Yang
• Email: n016yoyo@gmail.com

13. Remedies for Rights Infringement

For privacy complaints in Korea, you may contact the following organizations:

• KISA Privacy Center (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301)
• National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

14. Changes to This Policy

We may update this Policy and will notify you through the app before changes take effect.

KakaoTalk Sharing and Privacy

When you tap "Share," the share image created by the app (card photo, card name, price, or collection summary) and the message text are sent to Kakao Corp.'s KakaoTalk sharing servers and delivered to the chats you choose in KakaoTalk. This transfer happens only when you tap the button, and we do not store the share image or recipient information on our servers. Retention and deletion of share images uploaded to Kakao follow Kakao's operating policy and privacy policy.

Affiliate Marketing and Privacy

To display Coupang Partners affiliate products, the Service sends only search keywords such as card names to the Coupang Open API, and does not send personally identifiable information such as your name, email or device identifiers. Personal data processing after you tap an affiliate link and move to Coupang is governed by Coupang's privacy policy (privacy.coupang.com). For other affiliate networks such as LinkPrice and for the eBay Partner Network, outbound links include only the operator's affiliate identifier and none of your personal information is transmitted; processing after you leave the Service is governed by each partner's or seller's privacy policy.

On trading card (Pokémon) price screens used in Korean, the app may look up KREAM's (KREAM Corp., kream.co.kr) public product pages directly from your device to show completed sale prices and asking prices. In doing so, search keywords such as the card name and your device's IP address are sent to KREAM. This lookup does not go through the operator's servers. However, to calculate prices, a daily summary of completed sale prices for the looked-up product (median, lowest, highest price and count per grade) is stored on the operator's servers in a form that does not identify you, and is also used to show prices to other users. Individual sale records are not stored, and summaries are deleted after one year. The operator is not affiliated with KREAM, and after you move to a KREAM page, your personal information is handled under KREAM's privacy policy.