1. Who we are
CardAtlas is an independent web app for Pokémon TCG collectors, operated from the Netherlands. Contact: support@cardatlas.nl.
2. What personal data we collect
• Account information: email address, display name, password hash and authentication tokens. • Collection data: the cards, binders, quantities, conditions and prices you add. • Scan data: images you upload to the AI scanner, plus the extracted text and card matches. • Usage data: pages visited, features used and basic device information (browser, language). • Communications: messages you send us via feedback or email.
3. AI image scanning
When you use the scanner, your card image is sent securely to Google's Gemini AI to identify the card. Images are used only to recognise the card and are not used to train third-party models by us. See Google's Gemini API terms for their processing.
4. Cookies and local storage
We use strictly necessary cookies and local storage to keep you signed in, remember your language and theme, and cache pricing data. We do not use advertising cookies.
5. Analytics
We use privacy-friendly analytics to understand which features are used and where the app breaks. We do not build advertising profiles, and we do not sell your data.
6. Third-party services
We share the minimum data needed with: • Supabase (EU) — database, authentication and storage. • Pokémon TCG API and TCGdex — card catalogue and pricing metadata. • Cardmarket and TCGplayer — public price data (no personal data sent). • Google Gemini — AI card recognition. • Resend — transactional email delivery. • Cloudflare — hosting, CDN and DDoS protection.
7. Data retention
We keep your account and collection data for as long as your account exists. Scanned images are stored only briefly and then discarded. You can delete your account at any time — this permanently removes your personal data within 30 days, except where we must keep records for legal reasons.
8. Your rights (GDPR)
You have the right to access, correct, export or delete your personal data, to restrict or object to processing, and to lodge a complaint with your national data protection authority. Email support@cardatlas.nl and we will respond within 30 days.
9. Security
Data is transmitted over HTTPS, stored in EU data centres and protected by row-level security rules. No system is perfectly secure — please use a strong, unique password.
10. Contact
Questions or requests? Email support@cardatlas.nl and we will get back to you.