PokeSniper Privacy Policy
Draft — not legal advice; review before launch.
This policy explains what information the PokeSniper app and services ("PokeSniper", "we", "us") collect, how we use it, who we share it with and your choices. PokeSniper was formerly called CardFlow.
1. Who can use PokeSniper
PokeSniper is for adults only. You must be 18 or older, and creating an account requires confirming that you are. We don't knowingly collect information from anyone under 18. If we learn that someone under 18 is using PokeSniper, we close their access and delete their information. If you think a minor has given us information, email support@pokesniper.app.
2. Information we collect
Account
- Email and password: your email address and a securely hashed password. We send a code to verify your email.
- Sign in with Apple: Apple gives us a user identifier and an email address (which may be an Apple private relay address).
- Sign in with Google: Google gives us a user identifier and your email address.
- Your 18+ confirmation, your Terms acceptance (version and time), your CardSight choice and your app settings.
What you add in the app
- Cards in MyDEX and your Watchlist, purchase details, sales, listing drafts, Max Buy rules and pre-grade estimate results.
Photos
Scan and grade photos are not stored beyond the time needed to process them. They're used temporarily to identify or grade the card and deleted right after use. A safety cleanup removes anything left within 24 hours. Grade results are kept; the photos aren't.
Optional training data: By accepting our Terms of Service, you consent to our use of scan photos to improve our card-recognition model (on by default, opt out anytime in Settings > Use my scans to improve recognition). We keep only scan photos that help training—like when you correct our identification, when we had low confidence, or when we couldn't identify a card. We crop the image to the card and remove location and EXIF data. Kept for up to 180 days or until used in a training run (whichever first), then deleted. Deleted within 30 days of opting out or account deletion (and from backups within 14 days). We never keep photos from CardSight or Live Scan/livestream sessions. Training images are stored separately with restricted access, encryption, and access logging. Not sold or used for ads—only to improve PokeSniper's card recognition.
Live Scan
Live Scan is optional and you start it yourself. While you watch a livestream in PokeSniper's in-app browser, the stream plays on your phone and frames are processed in memory and discarded. To identify a card, a small cropped image of the card (and, when the card finder is turned on, the full frame) is sent to PokeSniper's servers, processed in memory and discarded. It is not saved, and it is not sent to CardSight. We don't record, save or redistribute stream video or audio, and we never read or store your Whatnot password. PokeSniper isn't affiliated with Whatnot.
Technical information
- Server logs with IP address, device and app version, used for security and debugging.
- Crash and error reports (see Sentry below). IP address storage is turned off.
- Usage analytics only if you turn on Settings > Usage analytics (off by default). These are event names and counts with a random install ID, never photos, card names, prices or anything you type.
What we don't collect
We don't access your contacts, collect precise location, use an advertising ID, track you across other apps or collect payment card numbers.
3. How we use information
To run PokeSniper (sign-in, card identification, pre-grade estimates, prices and MyDEX), keep accounts secure and prevent abuse, provide support, fix bugs and, if you opt in, understand how the app is used. We don't use your photos for advertising, and we don't sell your personal information or share it for cross-context behavioral advertising.
4. CardSight (third-party card identification)
PokeSniper can use CardSight, a third-party AI card-recognition provider, to identify cards from your photos and to crop and straighten grade photos. CardSight is used only if you've confirmed you're 18 or older and you allow it; we ask before the first photo is sent. If you allow it, your card photos are sent to CardSight. CardSight's terms let it keep these images and use them to train its AI models. Turning this off in Settings stops new uploads but doesn't remove photos CardSight already has, and we don't control how CardSight keeps or uses them. If you don't allow it, PokeSniper identifies cards on its own servers, or you can search manually.
5. Service providers
| Provider | What it does | What it receives |
|---|---|---|
| Railway | Hosting for our servers and database (US) | All data the service stores and processes |
| Sentry | Error monitoring | Crash and error details with personal data scrubbed; IP storage off |
| Resend | Email delivery | Your email address and the message (for example a verification code) |
| PostHog | Product analytics, opt-in only | Event names, counts and a random install ID |
| CardSight | Card identification, only with your consent | Card photos (see section 4) |
| Apple and Google | Sign in with Apple and Sign in with Google | The sign-in you start with them; their own privacy policies apply |
We also share information when the law requires it, to protect the safety and rights of users and PokeSniper, or as part of a merger or sale of the business under this policy.
6. Prices and TCGplayer data
This product uses TCGplayer data but is not endorsed or certified by TCGplayer. To look up a price we send a card identifier, not your personal information. Prices are for information only and may be delayed or wrong. Pre-grade estimates are estimate only. Not an official grade.
7. How long we keep information
- Account and app data: while your account is open, deleted when you delete your account.
- Scan and grade photos: deleted right after use, within 24 hours at most.
- Live Scan images: processed in memory and discarded, never saved.
- Database backups: kept for at most 14 days, so deleted data can remain in a backup until it expires.
8. Deleting your account and your choices
- In the app: Settings > Delete account deletes your account and its data right away.
- On the web or by email: follow the steps at pokesniper.app/delete-account or email support@pokesniper.app from your account email. We delete within 7 days of confirming.
- If you use Sign in with Apple, deleting your account also revokes PokeSniper's access to it.
- You can turn off CardSight and usage analytics in Settings, and camera or photo access in your device settings.
- Depending on where you live, you may have rights to access, correct, delete or get a copy of your data. Email us to use them.
9. Security
Data is encrypted in transit (HTTPS), passwords are hashed and access to our systems is limited. No system is perfectly secure.
10. Changes
We may update this policy. For material changes we'll let you know in the app before they take effect.