Legal
Privacy Policy
Last updated:
This Privacy Policy explains what personal data PokeTrade AI collects, why we collect it, who we share it with, and the rights you have. The team behind PokeTrade AI is based in Greece, so this policy is written to comply with the EU General Data Protection Regulation (GDPR) and Greek data-protection law.
1. Who we are
PokeTrade AI (“PokeTrade AI”, “we”, “us”, or “our”) operates the PokeTrade AI mobile application and this website (together, the “Service”). PokeTrade AI is a local-first marketplace where collectors can list Pokémon trading cards for sale or card-for-card trade and arrange to meet and complete the deal in person.
PokeTrade AI is currently operated by its founders while we complete the formation of a company. For the purposes of the GDPR, the founders operating PokeTrade AI are the data controller for the personal data described in this policy. You can reach us about anything in this document, or to exercise your privacy rights, at poketrade@tuta.com.
PokeTrade AI is an independent service. It is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, or The Pokémon Company.
2. The data we collect
We try to collect only what we need to run the Service. The table below summarises the categories of personal data we process, with examples.
| Category | Examples |
|---|---|
| Account data | Your email address and a securely hashed password. If you sign in with Apple or Google (coming soon), the basic identifier and email those providers return to us. |
| Profile data | Display name, optional avatar, and preferences you set during onboarding (such as your preferred language). |
| Approximate location | An approximate, city-level location used to show listings near you, calculate distances, and place an approximate marker on a map. We do not need or store your precise GPS coordinates for this. |
| Listings & photos | Cards and lots (bundles) you list, including titles, descriptions, condition, grading details, asking price or wanted cards, and the photos you upload. |
| Collection & wishlist | The cards you save to your personal binder and the cards on your wishlist. |
| Card scan images | Photos you capture using the AI scan feature, which are sent to a third-party AI provider to identify the card and estimate its price (see Section 4). |
| Chat content & metadata | Messages you exchange with other users are end-to-end encrypted, so we cannot read their content. We do process related metadata such as who is in a conversation, timestamps, delivery status, and — if you use voice or video calls — connection information needed to set up the call. |
| Device & push tokens | A push-notification token for your device so we can deliver alerts (for example, a new message or an offer), and basic device information needed to operate the app. |
| Purchase & subscription data | If you subscribe to Premium, we receive a subscription status and transaction identifiers from our subscription processor (RevenueCat) and the app stores. We never receive or store your full card number — payments are handled by Apple or Google. |
| Analytics & diagnostics | Basic, aggregated usage analytics and crash/diagnostic logs that help us keep the Service stable and improve it. Error and diagnostic logs are processed using self-hosted error-tracking on our own infrastructure in the EU (we do not send them to a third-party analytics vendor). |
We do not intentionally collect special categories of data (such as health, religious, or political information). Please do not include such information in listings, profiles, or messages.
3. Why we use your data and our legal basis
Under the GDPR we must have a lawful basis for each use of your personal data. The table below sets out what we do and why.
| Purpose | Legal basis |
|---|---|
| Create and manage your account, authenticate you, and provide the core marketplace, binder, and wishlist features. | Performance of our contract with you (Article 6(1)(b) GDPR). |
| Show listings near you and calculate distances using your approximate location. | Performance of our contract with you, and your consent where the device asks for a location permission (Article 6(1)(a)–(b)). |
| Enable encrypted chat, calls, and push notifications between users. | Performance of our contract with you (Article 6(1)(b)). |
| Identify a card and estimate its price when you use AI scan. | Performance of our contract with you / your request to use the feature (Article 6(1)(b)). |
| Process and manage Premium subscriptions, including renewals and entitlements. | Performance of our contract with you (Article 6(1)(b)). |
| Keep the Service secure, prevent fraud and abuse, moderate content, and handle reports and blocks. | Our legitimate interests in operating a safe platform, and compliance with legal obligations (Article 6(1)(f) and (c)). |
| Understand usage through basic analytics and fix bugs using diagnostics. | Our legitimate interests in improving and maintaining the Service (Article 6(1)(f)). |
| Communicate with you about the Service, including service notices and responses to your requests. | Performance of our contract and our legitimate interests (Article 6(1)(b) and (f)). |
4. AI card scanning
When you use the AI scan feature, the photo you capture is sent to one or more third-party artificial-intelligence and card-data providers that identify the card and return an estimated price. These providers act as our processors and only handle the image on our behalf to return a result.
Please avoid including faces, documents, or other personal information in the frame when scanning a card. If you would rather not share images with an AI provider, you can list a card manually instead of using AI scan.
5. Who we share data with (processors and recipients)
PokeTrade AI is a venue for trades between users; we are never a party to a sale or trade and we never process payments for trades. We do not sell your personal data. We share data with the service providers below, who act as our processors under contract and only handle data on our instructions, and with other users where you choose to interact with them.
| Provider | Purpose |
|---|---|
| Apple | App distribution, optional Sign in with Apple, and processing of in-app subscription payments on iOS. |
| App distribution, optional Google sign-in, and processing of in-app subscription payments on Android. | |
| RevenueCat | Managing subscription status and entitlements across the app stores. |
| AI & card-data providers | Identifying cards and estimating prices from the photos you submit to AI scan. |
| Expo | Delivering push notifications to your device. |
| Mapbox | Rendering maps and showing the approximate location of listings. |
| Our hosting provider (VPS / host) | Running our servers and storing application data (such as accounts, listings, and photos) in the EU. |
We may also disclose data where we are legally required to do so (for example, in response to a lawful request from a competent authority), or to protect the rights, safety, and property of PokeTrade AI, our users, or the public.
6. International transfers
We aim to store core application data within the European Union. Some of our processors (for example, certain AI, payment, push, or mapping providers) may process data outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR — such as the European Commission’s Standard Contractual Clauses or an adequacy decision — to protect your data. You can ask us for more detail about a specific transfer.
7. How long we keep your data
We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In general:
- Account, profile, binder, and wishlist data are kept while your account is active. If you delete your account, we delete or anonymise this data within a reasonable period, except where we must retain something to meet a legal obligation or resolve a dispute.
- Listings are kept while they are live and for a limited period afterwards so that recent activity and conversations remain coherent.
- Chat content is end-to-end encrypted and stored only as needed to deliver messages between participants; related metadata is kept for a limited period.
- Card scan images are processed to return a result and are not retained longer than needed for that purpose and for diagnostics.
- Purchase and subscription records may be kept for longer where required for accounting, tax, or audit purposes.
- Diagnostics and security logs are kept for a short, rolling period.
8. Your rights
If the GDPR applies to you, you have the following rights in relation to your personal data:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data (the “right to be forgotten”), subject to legal exceptions.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Portability — receive certain data in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
- Objection — object to processing based on our legitimate interests, including any profiling.
- Withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, email us at poketrade@tuta.com. We will respond within the timeframes required by law (normally one month). We may need to verify your identity first. Exercising your rights is free in most cases.
You also have the right to lodge a complaint with a supervisory authority. In Greece this is the Hellenic Data Protection Authority (HDPA). You may also contact the authority in your country of residence within the EEA.
9. Children
PokeTrade AI is intended for users aged 13 and over. If you are under the age of digital consent in your country (which is 16 in Greece, though some EU countries set it lower, down to 13), you may only use the Service with the consent and involvement of a parent or legal guardian. We do not knowingly collect personal data from children below the applicable age without appropriate consent. If you believe a child has provided us with personal data without the necessary consent, please contact us at poketrade@tuta.com and we will take steps to delete it.
10. How we protect your data
We take security seriously and use technical and organisational measures appropriate to the risk, including encryption in transit, end-to-end encryption for chat content, hashed passwords, access controls, and storing core data with reputable hosting providers. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any issues we become aware of.
11. Changes to this policy
We may update this Privacy Policy from time to time — for example, if we add features or change a processor. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Please review this page periodically.
12. Contact us
For any questions, requests, or complaints about your privacy or this policy, contact us at poketrade@tuta.com.
Questions about this document? Email us at poketrade@tuta.com.