When you create an account, we collect the information you provide directly: email address (via email/password or Google sign-in), username, and date of birth (collected at sign-up to verify you meet our minimum age requirement — see Children's Privacy below); and, if you choose to add them later, your first/last name, country, and an optional profile picture. When you use the Scan feature, photos you capture of your cards are processed on your device and, if you save a card to your Collection or list it on the Market Place, the resulting card image, card data (name, set, condition, self-assigned grade, price), and a compact numerical fingerprint of the image (used only to help match future scans to the same card) are stored in our database. If you use the Market Place or Friends features, we store your listings, friend connections, messages you send to other Users — including any photos, files, or location you choose to attach to a message — and blocks or reports you create. If you choose to add Contact Methods to your profile (email, WhatsApp, Telegram, and/or Instagram), we store the values you enter and, where you complete our verification flow for email or Telegram, whether that method has been verified. If you subscribe to U.C.M Ultra, our payment processor (Apple, Google, or RevenueCat) shares subscription status and purchase metadata with us — we never receive or store your full payment card number.
The App requests camera access to let you scan physical trading cards, and photo library access to let you attach an existing photo instead of taking a new one, and to save a generated Share Card image back to your device. Camera frames are processed on-device for card detection and are not uploaded anywhere unless you explicitly capture, save, or share a card.
The App requests location access for two optional, User-initiated purposes only: (a) to attach your current location to a message you choose to send to another User, so a buyer and seller can arrange where to meet; and (b) to auto-detect and verify the country shown on your profile against your device's actual location. Neither use happens automatically or in the background — your location is only read at the moment you tap to share it in a message, or the moment you attempt to set or change your profile country. We do not track, log, or store a history of your location over time.
We use the information we collect to: operate your account and Collection; power the Market Place (showing your listings to other Users, and other Users' listings to you); look up pricing for your cards and products from third-party pricing services (see Third-Party Service Providers below) using only the item's name, set, and identifying number, not your personal data; enable Friends and Messages between Users, including any Contact Methods you choose to share; process and validate subscription purchases; enforce your accepted Terms of Use; send local, on-device notifications you've enabled (such as a daily scan-streak reminder); and improve the App's reliability and card-identification accuracy. We do not sell your personal information to third parties.
If you add a Contact Method (email, WhatsApp, Telegram, or Instagram) to your profile, that value is private by default — it is not shown on your public profile or to Users browsing the Market Place. It becomes visible only to a User with whom you have an active message thread, so the two of you can move a transaction to your preferred channel outside the App. Verifying an email or Telegram Contact Method (via a code we send to that email address, or via our Telegram bot) confirms only that you control that address or handle at the time of verification — it is not an identity check, and a "Verified" badge does not mean we have confirmed who you are. Once you share a Contact Method with another User, or receive one from them, any further communication conducted through that channel takes place entirely outside the App and is not monitored, stored, moderated, or controlled by us — see the Terms of Use for the corresponding disclaimer.
Your username, profile picture, country, and any cards you list on the Market Place are visible to other Users of the App. Messages you send — including any photos, files, or location you attach — are visible to the recipient. Your Contact Methods are shared only as described in Contact Methods and Sharing With Sellers above. Friend requests, friendships, and blocks reflect your own choices and are only visible to the Users involved.
We use the following third-party services to operate the App, each of which processes a limited slice of your data under its own privacy policy: Supabase (account authentication, database storage, and Market Place/Friends/Messages data, including message attachments); Google (Google Sign-In, if you choose that sign-in method); RevenueCat, Apple App Store, and Google Play (subscription purchase processing and entitlement validation); PriceCharting (card and product pricing — receives the item's name, set, and identifying number, not your personal account data); free card-database APIs (Pokémon TCG, YGOPRODeck, Scryfall, optcgapi.com, tcgcsv.com) that receive only the card name/set text you search for; Resend (delivery of account emails, such as email-verification codes and password-reset codes, to the email address you provide); and Telegram (if you choose to link a Telegram Contact Method, Telegram's Bot API is used to verify you control the handle you enter).
We retain your account data for as long as your account remains active. You may delete individual cards, listings, friendships, conversations, or Contact Methods at any time from within the App. To delete your entire account and all associated data, use Profile > Delete Account in the App, which deletes your profile, collection, listings, messages, Contact Methods, and friendship data immediately, except where retention is required to comply with legal obligations or resolve disputes. Verification codes sent for email or Telegram Contact Methods expire automatically shortly after they're issued and are not retained beyond that window. You can also request deletion by contacting us using the email address below.
The App asks for your date of birth when you create an account and blocks account creation if you do not meet the minimum age of 13 (or a higher minimum age required by your country of residence). The App is not directed to children under that age, and we do not knowingly collect personal information from them. If you believe a child has circumvented this age check or otherwise provided us with personal information, contact us using the email address below and we will delete the associated account and data.
If you encounter a listing, message, or User that violates our Terms of Use or applicable law, you can report it directly within the App, or by emailing us at the address in Contact Us below. We review reports and, where warranted, remove the reported content or restrict the reported account. See the Terms of Use's Prohibited Conduct and User Content sections for more detail, including our process for copyright (DMCA) complaints.
We use industry-standard security measures, including encrypted transport (HTTPS) and row-level access controls on our database, to protect your information. No method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, contact us using the email address below.
We may update this Privacy Policy from time to time. Continued use of the App after any such update constitutes acceptance of the revised policy.
For any privacy question, data access or deletion request, content report, or copyright (DMCA) complaint, contact us at support@ucm-app.app.