Privacy Policy

• Account and sign-in: your email address, and authentication tokens issued when you sign in with email, Google or Apple.
• Content you create: collection, binders, decks, wishlists, sell queue and listings, price alerts, saved combos, and your settings and profile.
• Card images and scanning: when you scan a card, ScanEd first uses device-side image preparation and may use OCR or catalogue matching. When AI recognition is needed, the card area is cropped and downscaled and a still image, or compact derived card crops, is sent to the configured recognition provider. No continuous camera video is transmitted and ScanEd does not store the scan image after the request. We store the matched card data and limited recognition telemetry linked to your account, including provider and model, game, confidence, latency, outcome, candidate count, payload mode and printed set or collector identifiers where available. This is used to measure speed and recognition quality.
• AI insights: the card, deck or collection details you submit to ScanEd Intelligence features, plus the generated result, which we may cache against your account so repeated requests can be served consistently without unnecessary processing.
• Diagnostics and bug reports: crash details, the message you write, the route you were on, your user agent and app version.
• Device storage: preferences, offline cache, queued scans and dismissal flags kept in your browser's local storage on your device.
• Payments and subscriptions: your plan, credit balance, subscription status, store/provider, product identifier, order or transaction reference, and purchase token where required for verification. Payment-card details are handled by Paddle on the web, Apple for iOS App Store purchases, or Google Play for Android purchases and do not reach ScanEd's servers.
• Social, friends and trades: your public handle and profile fields, who you follow, and the contents and history of trade proposals you send or receive. Collections, decks and binders are private unless you switch sharing on in your profile.

We process this data to perform our contract with you (providing the app), on the basis of our legitimate interests (diagnostics, security, product improvement), and to comply with legal obligations where they apply.

• Provide multi-game scanning, exact-printing matching, collections, binders, deck tools, trading, selling and market features.
• Sync your data across your devices when signed in.
• Identify cards, resolve printings and generate AI insights you request.
• Process and verify purchases, credits and subscriptions.
• Measure scanner latency, diagnose failures and improve recognition accuracy.

We do not sell your personal data, and we do not use it for advertising.

• Paddle.com Market Limited — Merchant of Record and payment processor for eligible purchases made on the ScanEd website.
• Apple — App Store billing, subscription management and transaction verification for digital purchases made in the iOS app.
• Google — Google Play billing and purchase-token verification for Android purchases, and Google Cloud Vertex AI when it is the configured scanner-recognition provider.
• Supabase / ScanEd cloud services — hosting, database, authentication and account-synced app data.
• Groq and Mistral — card-image recognition when one of those providers is selected for the scanner. The same cropped/downscaled still-image approach applies.
• Lovable AI Gateway — certain separate ScanEd Intelligence features may use this service when configured. It is not the scanner's required recognition route.
• Card and market-data providers, including Scryfall, EDHREC, Pokémon TCG API, Cardmarket, TCGplayer and eBay — card data and pricing lookups. These receive card identifiers and search terms, not your account data.
• Professional advisers and authorities where required by law.

Some of these providers — including our AI, payment and card-data providers — operate outside the UK and EEA. Where personal data is transferred internationally, those transfers rely on the providers' applicable safeguards, such as standard contractual clauses or an adequacy decision.

We keep your account data for as long as your account exists, and remove it when you delete your account, subject to records we must retain for legal, fraud-prevention or transaction-accounting purposes. Scanned card images are not retained by us. Recognition telemetry is retained as diagnostic product data unless deleted with the underlying account where applicable. Data in transit is encrypted, and access is controlled through row-level security so other users cannot read your private data. You can export your collection as CSV, clear scan history and offline cache from Settings, and delete your account and its data from Settings — see our account deletion page.

You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is based on consent. If you are in the UK/EEA you may lodge a complaint with your local data protection authority. We aim to respond within one month.

ScanEd uses two categories of browser storage. Essential storage keeps you signed in and remembers app settings; it is always on because the app cannot work without it. Analytics cookies (Google Analytics 4) are optional and set only if you accept them in the cookie banner.

We use Google Consent Mode v2. Until you choose, analytics storage, ad storage, ad user data and ad personalisation are all set to denied, so Google receives only cookieless pings. Accepting grants analytics storage only — we run no advertising or remarketing tags, so those signals stay denied permanently.

You can change or withdraw your choice at any time from "Cookie settings" in Settings or in the site footer, which reopens the banner.

Questions or deletion requests: hello@scaned.co.uk