Privacy Policy · Last updated 8 November 2026
Almost nothing, and none of it is kept. CardCapture has no accounts on a server and keeps no record of you. From version 1.1 it runs one small server, a price relay, which passes price lookups on and writes no log. No analytics, no tracking, no advertising identifier, and no third-party SDK that phones home. This page explains exactly what the app stores, what it sends, and where it goes.
Your collection, your scan history, your recorded price history, your saved price alerts and your purchase entitlements are all stored in the app's own container on your device. Scanning a card, a stack or a binder page is free and is not counted.
Two things also go into the iOS keychain: how many of the free condition gradings have been used, so deleting and reinstalling the app does not silently hand out new ones, and any marketplace API keys you choose to enter. Keychain items are readable only by this app on this device.
From version 1.2, the count of free gradings used is also agreed with CardCapture's price relay, so that erasing the phone does not reset it either. The app asks iOS for a DeviceCheck token — a one-time, opaque value Apple issues for the device, which says nothing about you, your Apple Account or your cards — and sends it to the relay with the count. The relay passes it to Apple, which keeps two bits per device for CardCapture: that is the whole record, and it holds only the count. The relay stores and logs nothing, and the count is never tied to an account, a name or an address. Apple's own description of this service is in its developer documentation for DeviceCheck.
CardCapture offers to sign you in on first launch, and lets you carry on without an account if you would rather. There are two ways to sign in, and neither of them creates an account on a server, because CardCapture has no account server. What is stored is kept in the iOS keychain on your device, and you can sign in or out later from Settings › Account.
Apple gives the app a stable identifier for you, and — on the first authorisation only — your name if you allow it. Both are kept in the keychain and are used to show who is signed in. CardCapture does not request your email address. If you revoke access in Settings → your name → Sign in with Apple, the app notices and signs you out locally.
This one creates a profile on this iPhone only. The address you type and a cryptographic hash of your password (PBKDF2-HMAC-SHA256, 210,000 iterations, with a random salt) go into the keychain. The password itself is never stored, and neither the address nor the password is sent anywhere — CardCapture has no account server to send them to, and for the same reason there is no password reset and no way to recover the account if you forget it. The app says so on the screen where you choose this option.
Signing out keeps your collection and, for the email option, keeps the stored credential so you can sign back in.
From version 1.1, Settings › Account › Delete account deletes the account and everything kept under it: its cards, scans, scan photos, condition records and backups on this iPhone, its copy in your private iCloud, and, for the email option, the stored credential. It cannot be undone. A subscription belongs to your Apple Account and is cancelled in the Settings app; for Sign in with Apple, you can also stop CardCapture using your Apple Account in Settings → your name → Sign in with Apple. Without an account, deleting the app deletes everything it kept on the device.
When you sign in, your collection is written to your own private CloudKit database, under your Apple Account, in Apple's iCloud, so your cards come back when you sign in again — after reinstalling, or on another device signed into the same iCloud. Without an account this happens only if you turn it on. That is your storage, not ours. The developer of CardCapture has no access to it, and neither does any other CardCapture user. You can turn it off in Settings › Account; turning it off stops further writes, and deleting the app or signing out of iCloud removes the app's access.
The app also keeps a copy of your collection on your device for each of the last seven days, and before anything removes more than half of it, so a mistake can be undone from Settings › Account › Backups. These copies never leave the device.
Every request below identifies a card. None carries an account, a device identifier, or anything about you. These providers see an ordinary web request and its IP address, and their own logging applies.
| When | Where it goes |
|---|---|
| You download a card database | Scryfall (Magic), YGOPRODeck (Yu-Gi-Oh), OnePieceJSON on GitHub (One Piece), digimoncard.io (Digimon), gcg-api on GitHub (Gundam), the ApiTCG data repositories on GitHub (Dragon Ball, Union Arena, and One Piece or Digimon when their first source cannot be reached), LorcanaJSON (Lorcana), the-fab-cube on GitHub (Flesh and Blood), and TCGdex (Japanese Pokémon). Pokémon in English ships inside the app and downloads nothing. A downloaded database is fetched again about once a week, on Wi-Fi, so new sets arrive. |
| You price a card | The Pokémon TCG API, TCGdex (Japanese Pokémon, and from version 1.1 Cardmarket prices for English
Pokémon), Scryfall or YGOPRODeck, depending on the game.
From version 1.1, graded prices, and prices for One Piece, Lorcana, Digimon, Dragon Ball, Union Arena and Flesh and Blood, come through CardCapture's price relay: a Cloudflare Worker that asks JustTCG with CardCapture's own key. It is sent the card's game and its name or printed code, and for a graded price the grader and the grade — nothing else. Like any server on the internet it sees the IP address a request comes from; it uses it for at most a minute, to stop any one address flooding it, and never stores or logs it. Answers are kept by card for up to a week, so the next lookup of the same card is answered without asking JustTCG again; they say nothing about who asked. Cloudflare runs the relay and handles the connection as it does for any website. If you have supplied your own eBay or JustTCG keys, that provider too — using your keys, for that one lookup, straight from your device. |
| You check a slab's certificate, or its sold prices | The grader's own site (PSA, CGC, Beckett, SGC or TAG) opens with the certificate number read from the label, or eBay's sold listings or PriceCharting's price guide open with the card and its grade. Nothing about you is sent. |
| You tap Find it for sale | The store you picked — eBay or Cardmarket — opens in its own app or your browser, with the card's name, set and number in the address. Nothing about you is sent, and nothing is sent at all until you tap. What you do on the store's site is between you and the store, under its own privacy policy. |
| You open Market | From version 1.2, CardCapture's price relay asks JustTCG for the most valuable cards of a fixed list of popular sets and their last 30 days of sales. The request names a set, never you or your cards, and is the same for everyone who opens Market; the answer is kept on your device for six hours, and the relay keeps it by set and writes no log, as above. |
| You open Shop | From version 1.2, CardCapture's price relay asks JustTCG for the newest sets of the game you pick and what their sealed products and most traded cards sell for, and asks eBay for the cheapest Buy It Now listings of those products and cards that ship to the country set on your phone. The requests name products, cards and a country, never you; the relay keeps the answers for up to six hours and writes no log, as above. Listing photos load from eBay's image servers, and tapping one opens it on eBay, under eBay's own privacy policy. |
| You open a card, a scan or a wish, and it shows what is on eBay now | From version 1.2, CardCapture's price relay asks eBay for that card's Buy It Now listings. It sends eBay the card's name and printed number (and its grade, for a slab), the eBay site for your phone's region, and the country set on your phone, so postage is worked out to it and only listings that ship there come back. eBay is asked by the relay, not by your phone, and is told nothing about you; the relay keeps the answer by card for up to six hours and writes no log, as above. The listings' photos load from eBay's image servers, which, like any image on the web, see the IP address that asks for them. Tapping a listing opens it on eBay, in its app or your browser, under eBay's own privacy policy. |
| A price alert checks in | The same price providers, and the price relay for the cards it prices, from your device, in the background. No server is told which cards you watch: the watching happens on your phone, and a lookup for a watched card looks like any other. |
| You buy a subscription or gradings | Apple, through StoreKit. CardCapture is told only whether a purchase is active. It never sees your payment details. |
Before the app is on the App Store, the website offers to send you one message when it is. The app itself has no waitlist and sends nothing to it.
What is kept: the email address you type, the language of the page you typed it on (English or Danish), and the day you joined. Not your IP address, your browser, or anything else about you. Why: to send one email on the day CardCapture is released — nothing else, and not to anyone else. Where: in a store run by Cloudflare, the company that also runs CardCapture's price relay, under CardCapture's own account. Like any server on the internet it sees the address your request comes from; it uses it for at most a minute, to stop one address from flooding the list, and does not store or log it. The page asks for nothing else, sets no cookies and has no analytics.
How long: until that one message has been sent, and then the list is deleted. Your choices: ask on the support page and your address is deleted; you will get no message. The legal basis is your consent, given by submitting the form, which you can withdraw at any time the same way.
The camera is used to scan cards and, if you ask for it, to capture the tilt and edge photographs the verification checks need. All of that processing happens on your device. CardCapture does not request access to your photo library.
If you turn on Keep a photo of each scan in Settings › Scan log, a photo of each scanned card is kept on your device — the newest 300 — and included when you export the scan log yourself. It is off unless you turn it on, and the photos are never sent anywhere by the app.
Price alerts are local notifications, created on your device by your device. CardCapture does not use push notifications and has no ability to send you one.
The CardCapture widgets on your Home Screen, Lock Screen and in Control Center either open the scanner or show your collection's value, card count and when it was last valued. The app writes those few figures to a container on your device that only CardCapture and its own widgets can read; nothing is sent anywhere for them.
CardCapture is for collectors of any age and does not knowingly collect personal information from anyone, children included.
CardCapture's App Store page says Data Not Collected, and the app ships a
PrivacyInfo.xcprivacy manifest declaring no tracking and no collected data. That
follows Apple's own definition: data counts as collected when it leaves your device somewhere
the developer or a partner can reach it, and nothing about you does. What you sign in with
stays in your device's keychain; your collection stays in the app and, when you sign in or turn
it on, in your own private iCloud. This page is the readable version of that declaration.
If this policy changes, the date at the top changes with it. Material changes will be described in the App Store release notes for the version that introduces them.
Questions about this policy, or a request about your data, can be sent through the support link on the CardCapture App Store listing, which reaches the developer directly.