PokeScan privacy information Last updated: 27 October 2026 1. Controller and contact Normen Zimmermann, trading as TCGso Mittelstraße 40 53757 Sanket Augustin Privacy contact: [email protected] This notice covers visits to the website, accounts, card management, scanning, paid features, and declarations submitted through our cancellation and withdrawal forms. 2. Website delivery and security Connections involve an IP address, time, requested URL, response status, and browser/device information. The server and upstream infrastructure process these data to deliver the website, investigate faults and prevent attacks. The basis is Article 6(1)(f) GDPR: our legitimate interest in an available, secure service. Avoid unnecessary personal information in filenames and URLs. Never include passwords or payment credentials in support messages. The public website uses HTTPS. Cloudflare provides the upstream network service, including its tunnel and protection functions. Cloudflare, Inc., USA, and related companies may process IP addresses, request contents and security information; this is not limited to anonymous statistics. Provider information: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/ . Operational analytics count successful page loads by UTC day, selected page and audience (anonymous, customer or administrator). For signed-in accounts, daily account activity is retained for 365 days to count returning customers; deleting an account removes this activity association. Anonymous counts do not identify unique people. These analytics tables do not store IP addresses, query strings, referrers, browser identifiers or fingerprints, and add no analytics cookies. Authorised staff can view aggregated activity and payment-based customer rankings to understand service use and funding. Donation receipts may be entered or imported by an administrator with a payment reference and an optional customer association. Aggregate page counts and financial records follow their respective retention purposes described below. 3. Accounts and email We process a username, email address, salted password hash, chosen language and account status. Additional profile data can include name, address, company, further email addresses and profile picture. Required fields are identified on the registration form; optional profile details are not required for a free account. Billing details necessary for a purchase may be needed when buying. We store password hashes rather than readable passwords. Registration, authentication, contractual performance and communications you request use Article 6(1)(b) GDPR. Security and abuse prevention use Article 6(1)(f). Without essential account information we cannot provide a personal account. Verification, password-reset, contract and service emails are not newsletters. The configured email service is GMX (mail.gmx.net), which receives the recipient address and email contents. 4. Inventory, portfolio and collections We store the inventory and collections you create, card references, quantities, conditions, purchase/sale details, valuations, layout choices and smart collection rules. We use these data to provide your requested management and analysis features under Article 6(1)(b). When subscription entitlement ends, smart collections become normal collections; their rules remain associated with the account for possible reactivation. Ending a subscription does not automatically delete the account or collections. 5. Scans, images, devices and folders Card photographs and scans selected for recognition are uploaded to the PokeScan server and processed there using recognition and OCR models. Scan history, matches, crops and relevant device details are associated with the account. Avoid uploading people, identity documents or other unnecessary personal information. The reviewed recognition runs on the PokeScan server; it is not exclusively on your computer. For browser folder monitoring, explicitly granted directory handles are kept in the browser's IndexedDB. The server receives selected scan files and necessary status information, not unrestricted access to every file on your computer or NAS. A NAS share mounted in your operating system is treated as a selected local directory. Monitoring requires browser permission and an open Scan tab. The former automatic server-side NAS folder watcher has been removed. New folder monitoring runs in the selected desktop browser with explicit file-system permission and an open Scan tab, including a NAS share mounted in the operating system. Selected scans are uploaded for the workflow you request. Preparing the chosen folder may create TCGsingle/processed, TCGdouble/processed and recovery; files may be written, moved or cleaned according to the displayed workflow settings. This provides the requested feature under GDPR Article 6(1)(b). Stop monitoring and revoke browser file-system permission to end access. This does not delete files already uploaded. Regular server-side recognition and account-bound Business file storage are separate. Successfully generated merged front/back pictures are available to download for 14 days. Download-link expiry does not mean every original scan, downloaded copy or backup has also been erased after 14 days. 6. Cookies and browser storage PokeScan uses pokescan_session for authentication (a session cookie with HttpOnly, SameSite=Lax and Secure on HTTPS), and the session cookie pokescan_language for language choice. Logging out or deleting session cookies removes the login cookie; browser session-restoration features can retain session cookies longer. Local Storage holds requested interface, device and scanning preferences, scan recovery information, and acknowledgement of the storage notice. IndexedDB holds explicitly configured directory access per account and browser. Session Storage holds pending checkout references to prevent duplicate orders. Depending on the storage type, information remains until the tab closes, the feature is reset or you clear this website's browser data. Clearing data can remove folder connections and scan recovery information. Storage/access strictly necessary for a service you expressly request uses section 25(2)(2) TDDDG; subsequent personal-data processing uses the GDPR bases described in this notice. Merely continuing to browse is not consent. Payment buttons and their PayPal branding are served by PokeScan. No embedded PayPal scripts load on our purchase page. Clicking a payment button requests checkout and redirects you to PayPal; PayPal then processes the information needed for its payment service under its own privacy notice. 7. Payments, coins and subscriptions We store the package, price and currency, transaction/contract references, payment status, billing periods, coin credits and usage, unlocked titles and features. Bases are contractual performance under Article 6(1)(b), applicable statutory accounting duties under Article 6(1)(c), and our legitimate interest in reconcilable billing and fraud prevention under Article 6(1)(f). Payments use PayPal. PayPal receives necessary order/payment details and, when you follow checkout, connection and browser information. We do not store complete bank or card credentials. PayPal also acts as a controller for its own regulatory checks and fraud prevention. For EEA customers, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, is particularly relevant. PayPal explains its recipients, international transfers and your rights at https://www.paypal.com/de/legalhub/paypal/privacy-full . 8. Optional marketplace connections and external artwork If you configure a connection, we process saved API credentials and imported sales data for Cardmarket or TCGplayer. Depending on the source records, this can include order references and customer information. Grant only necessary permissions. You can remove credentials in your account and revoke access at the provider. The connection you request uses Article 6(1)(b). You need your own lawful basis and, where applicable, notices for personal data of other people you upload or import. Card catalogues and prices also originate from external services. Cached images are served by PokeScan. Where an image uses an external URL, its provider receives connection information, including IP address and browser details, when it is fetched. Social-network links establish a connection to their destination when followed; the destination's own privacy notice applies. 9. Optional phone and browser notifications Push is configured only after activation and browser permission. We store the push endpoint, technical keys, account association and device/browser details. Delivery uses the push service chosen by your browser, for example Apple, Google or Mozilla. Providers receive delivery information and may process outside the EEA. Notifications can appear on a device's lock screen. The voluntary notification feature uses Article 6(1)(a). You can disable it in your account, unsubscribe a device and revoke browser permission. Disabling stops delivery; use device unsubscription or contact us to remove its saved subscription. 10. Support, cancellation and withdrawal Support records may include messages, attachments, technical information and handling notes. Access follows assigned permissions; staff support is restricted to administrators and authorised moderators. Cancellation/withdrawal records include submitted identity/contact details, contract reference, declaration contents, receipt time and confirmation-delivery status. Purposes are handling your request, statutory confirmation duties and evidence of receipt, under Article 6(1)(b) and (c); defending legal claims uses Article 6(1)(f). 11. Recipients and processing outside the EEA Access is limited to people requiring it for their assigned work, relevant technical/payment providers and legally authorised recipients. The Cloudflare, PayPal and browser-push services mentioned above can process outside the EEA. Transfers require a basis under Articles 44 onwards GDPR, such as an applicable adequacy decision or safeguards including EU standard contractual clauses. This notice does not certify that a provider processes exclusively in the EU. Ask the privacy contact for information about safeguards used in a specific case and a copy. 12. Retention and erasure Account details and saved card holdings are maintained for the account and requested features. Closing, blocking or archiving an account is not erasure. Use account deletion or contact us for full erasure; identity checks must be limited to necessary information. You control deletion of browser data and copies on your computer or NAS. Transaction, contract and accounting evidence is subject to the applicable statutory document category and the statutory start of its retention period. In Germany this can include eight years for accounting vouchers, ten for certain books and six for business correspondence; these are not blanket periods for every record. Further use must be restricted to the relevant retention purpose. Legal claims follow their applicable limitation periods. Security logs and backups may be retained only as needed for security investigation, recovery or a legal duty; final erasure must also account for backup rotation. An accounting duty does not justify indefinite retention of every scan or profile. 13. Your rights Subject to statutory conditions, you have rights to access, rectification, erasure, restriction, portability and objection. You can withdraw consent at any time for the future. For legitimate-interest processing you may object on grounds relating to your particular situation under Article 21 GDPR. We normally respond within one month and explain any lawful extension and its reason. You may complain to a data-protection authority, particularly where you live, work or believe an infringement occurred. For a provider in North Rhine-Westphalia, Germany, one contact is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen: https://www.ldi.nrw.de/ . You do not have to contact us first. Card classification and portfolio analysis are not decisions about individuals with legal or similarly significant effects under Article 22 GDPR. A future change to such processing would require additional information. Donation receipts linked to your account are also used to calculate lifetime supporter-tier progress and award milestone Coin gifts. Account links made by an administrator are recorded in the receipt audit history. The account stores purchased collection-slot licences and app-unlock transactions so permanent purchases can be restored. Monthly loyalty refills are recorded in the coin ledger separately from paid subscription receipts; they do not add payment income. Android app, widgets and display preferences: Adding a home-screen widget stores your chosen source, period, metrics and appearance on the device. Filters and sorting are stored locally per signed-in account. Language, display currency and preferred card-price source are synchronised with the account. The app encrypts its login session using Android Keystore; configurations and cached aggregates use private app storage. Android device backup is disabled for this app. This provides the app and widget service you request under GDPR Article 6(1)(b) and section 25(2)(2) TDDDG. It does not introduce an additional visitor identifier. Personal widgets show your inventory, collections or TCG Business data. Website and payment statistics in administrator widgets require administrator status and permission for the relevant report; these widgets contain no customer lists, names or payment references. Removing a widget removes its local configuration and aggregate cache. Sign-out and account changes clear cached widget aggregates; display preferences may remain until app data is cleared. Android or your selected launcher renders the widget on the home screen. Other people with access to that screen can see its figures. Remove sensitive widgets before sharing the device or using its screen publicly. Android may delay background updates; check the displayed update time. Successful refreshes replace cached aggregates; aggregates older than 24 hours are not displayed from cache at the next load. Views already drawn by the launcher and screenshots cannot thereby be remotely erased. The described data-minimised usage and payment-related operational reports rely on GDPR Article 6(1)(f). Our legitimate interest is to understand, check and improve reach, service usage and funding using recorded events. Anonymous page views are not a count of unique visitors. Registered accounts, signed-in visitors and paying accounts are distinct, partly overlapping groups. A customer ring divides existing registered accounts into accounts paying during the selected period and other accounts; page views are not added as extra people. Payments without an existing account link cannot be attributed to an individual. These reports do not make automated decisions with legal effects on data subjects. See Your rights for objections and other rights. Company Information Company: TCGso Owner: Normen Zimmermann Address: Mittelstraße 40 53757 Sanket Augustin Telephone: +49 (0)2241 232 77 42 Legal form: Einzelunternehmen, Kleingewerbe Service email: [email protected] Contact email: [email protected] Bug report email: [email protected]