Privacy Policy
This Privacy Policy explains what personal data ICXCNIKA OÜ collects through PokeTrade AI, why, who we share it with, how long we keep it, and the rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR).
最後更新：
本文件僅提供英文版。
本頁內容
1. Who we are
PokeTrade AI (“PokeTrade AI”, “we”, “us”, or “our”) is the PokeTrade AI mobile app and this website (together, the “Service”): a place where collectors list Pokémon trading cards for sale or card-for-card trade, post about their collection, chat, and meet to complete a deal in person.
The Service is operated by ICXCNIKA OÜ, a private limited company registered in Estonia, which is the data controller for the personal data described in this policy. You can reach us about anything in this document, or to exercise your privacy rights, at support@poketrade.ai.
PokeTrade AI is an independent service. It is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, or The Pokémon Company.
2. The data we collect
| Category | What it is |
|---|---|
| Account data | Your email address and a securely hashed password, or, if you sign in with Apple or Google, the account identifier and email address they return to us. When you sign in with Apple we may also keep the token Apple issues, so that deleting your account revokes PokeTrade AI’s access at Apple. |
| Profile data | Your username, display name, optional avatar and bio, and the preferences you set (language, currency, market, notifications, chat privacy). |
| Approximate location | The town or area you choose, stored as the coordinates of that area, used to show listings, people, shops and events near you and to place an approximate marker on maps. If you tap “Use my location” or the map’s locate button, your phone’s position is sent to our map provider (Mapbox) only to find the name of your area; we do not store your precise GPS position. Location is used only while the app is open. |
| Your content | Listings and lots (titles, descriptions, condition, grading, prices, wanted cards) and their photos; posts, photos, comments, reactions and the cards you tag; reviews; follows; your binders, collection and wishlist; and anything you send us through feedback or support (including a screenshot if you attach one). |
| Card scan images | The photo or camera frame you scan to identify a card (see Section 4). |
| Messages | One-to-one chats and private groups are end-to-end encrypted: we store and relay encrypted messages we cannot read, and the metadata needed to deliver them (who is in a chat, when a message was sent and delivered). Messages, photos and the name, description and rules of a public group are not end-to-end encrypted, because anyone can join it: we can read them and check them for abuse (Section 5). If you report a message, the copy you attach is sent to us in readable form. Messages to our in-app assistant, PikaAI, are not encrypted and are processed by an AI provider (Section 5). |
| Identity verification | To chat or to sell above a certain value, you verify your identity with Stripe Identity: you show an identity document and take a selfie on a page run by Stripe. Stripe checks them and tells us only whether you are verified; we store that result and a reference to the check, not your document or selfie. |
| Purchases | If you subscribe to Premium or Pro, the store (Apple or Google) handles the payment. We receive the plan, its status, renewal dates, the price and the transaction identifiers, through RevenueCat. We never see your card details. |
| Device data | Your device’s push-notification token, the encryption keys that let your devices read your chats (public keys only) with a device name, the app version, operating system and platform, and, for each sign-in session, the IP address and browser or app identifier. When you accept our terms we record the time, app version, language and IP address as proof. |
| Usage data | Which screens you open and which features you use (for example, app opened, screen viewed, a post viewed, a listing saved), with a random app-install identifier and, when you are signed in, your user ID, plus the country your connection comes from. We use it to run features such as post and listing view counts, your daily streak and to improve the Service. This is on by default; you can turn it off at any time in Settings → Privacy → Share usage data, and the app then stops sending usage events and its “I am here” signal. Features that work by counting visits keep working: a post or listing still counts you once a day among its viewers, and the days you opened the app still count towards your streak. |
| Website analytics | On poketrade.ai we count visits with Umami, an analytics tool we host on our own servers. It records the page you open (with links to private pages such as shared lists or profiles cut down to their type), the site that sent you, your country, your device and browser type, your language, price market, currency and theme settings, page speed, and clicks such as opening a marketplace link, searching or adding a card to a basket. It sets no cookies, does not store your IP address and cannot link your visits across months. Separately, the website keeps a random visitor id in your browser’s local storage, renewed every 13 months, to count how many people are on the site now and each day. Nothing is recorded when your browser sends Do Not Track or Global Privacy Control. |
| Maps on the website | Shop and card-show pages on poketrade.ai show a map. When a map is shown, your browser loads it from a map provider, which receives your IP address and browser details such as your browser type and language. |
| Crash and error data | Technical reports when the app crashes or hits an error, with your identifiers, query strings, and authorisation data removed. They are processed by our own error-tracking server, not a third party. |
We do not use your data for advertising tracking, we do not use the advertising identifier of your device, and we do not sell your personal data. The app shows a small number of ads booked by card shops and partners directly with us; they are chosen by where they appear in the app, not by who you are, and Premium and Pro members see none. We count how many times an ad was shown or tapped, without recording who saw it.
We do not intentionally collect special categories of data (such as health, religious or political information). Please do not include such information in listings, profiles, posts or messages.
Shops and events from public sources. The directory of card shops and the list of card shows are built from public business information: a shop’s or organiser’s name, address, website and phone number as they publish them, and public event announcements. We did not receive this from you. To correct or remove a listing, write to support@poketrade.ai. If you object to a shop being listed, we take it off and do not add it again.
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, sign you in, and provide the marketplace, posts, binders, collection, wishlist, scanning, maps and chat. | Performance of our contract with you (Article 6(1)(b) GDPR). |
| Show what is near you using your approximate location. | Performance of our contract; your consent when the phone asks for location permission (Article 6(1)(a) and (b)). |
| Verify your identity before you chat or sell above a certain value. | Our legitimate interest in preventing fraud and scams between users (Article 6(1)(f)). Where Stripe processes your selfie to compare it with your document, it does so on the basis of your explicit consent, given on Stripe’s page (Article 9(2)(a)). |
| Process subscriptions, renewals and entitlements. | Performance of our contract (Article 6(1)(b)); keeping records required by tax law (Article 6(1)(c)). |
| Keep the Service safe: check posts, comments, public group messages and photos for abuse, handle reports and blocks, prevent fraud, and enforce our terms. | Our legitimate interest in a safe platform, and legal obligations (Article 6(1)(f) and (c)). |
| Improve card recognition with copies of scan photos kept without your account (Section 4). | Our legitimate interest in recognising cards more accurately (Article 6(1)(f)). |
| Understand how the Service is used and fix problems, using usage data and crash data. | Our legitimate interest in maintaining and improving the Service (Article 6(1)(f)). You can object at any time with the in-app switch, and on the website by turning on Do Not Track or Global Privacy Control in your browser. |
| Personalised recommendations: the “For you” order of listings, trade suggestions and trade matches, built from your wishlist, the sets you collect, the cards you offer for trade, your saved area and the suggestions you dismissed. | Performance of our contract (Article 6(1)(b)) and our legitimate interest in showing you relevant offers (Article 6(1)(f)). These do not use the usage events: you can turn trade suggestions off with Settings → Trading → Suggest trades to me. |
| Send you notifications and service messages, and answer your requests. | Performance of our contract and our legitimate interests (Article 6(1)(b) and (f)). |
What you must give us. To create an account we need your email address and a password (or your Apple or Google sign-in) and a username; we need them to run your account and to contract with you. Without them we cannot create an account. Everything else is optional, but some features need it: chatting needs identity verification, nearby listings need an area, and scanning needs access to your camera or a photo.
Automated decisions. We make no decision about you with a legal or similarly significant effect solely by automated means. Some content is checked automatically: text of posts, comments and public group messages is checked for abuse and scams, and text the check flags is hidden until a person looks at it; photos are checked before they are published, and one that fails is not published. If an account hides several texts within a day, it cannot post for a short time. Suspending or closing an account is decided by a person. If you think something of yours was wrongly hidden, write to support@poketrade.ai and a person will review it.
4. Card scanning and AI features
When you scan a card, the image is matched against our card catalog on our own servers and may be sent to an AI provider (through OpenRouter) to identify the card. The scan images tied to your scan are deleted after 7 days; we keep the result (which card it was) in your scan history. To improve card recognition we also keep a copy of the scan photo, the card crops and what we recognised, without your account: we store no account or scan identifier with them, only the day they were saved, and they are deleted after 12 months. Please keep faces, documents and other personal details out of the frame.
PikaAI, the in-app assistant, sends what you type to an AI provider to write its answer. Binder scenery pictures are generated by an AI provider from the prompt you choose.
5. Who we share data with
PokeTrade AI is a venue for trades between users. We are never a party to a sale or trade and we never process payments for trades. Other users see what you choose to make public (your profile, listings, posts, comments, reviews, approximate area) and the messages you send them. We share data with the providers below, who act as our processors under contract, only for the purposes listed. Some providers (Apple, Google, Stripe) are also independent controllers for their own services, such as your Apple or Google account, your store payment, or the identity check you do with Stripe.
| Provider | What they do with it |
|---|---|
| Apple and Google | App distribution, Sign in with Apple and Google sign-in, in-app subscription payments, and delivering push notifications (Apple Push Notification service and Firebase Cloud Messaging). |
| RevenueCat | Managing subscription status across the app stores. |
| Stripe | Identity verification (Stripe Identity), and payments for shop advertising booked on the website. |
| Expo | Sending push notifications to your device and delivering app updates. |
| Resend | Sending the emails we send you: sign-up and verification messages, notices about your account and the other emails we send you. |
| Mapbox | Drawing maps, finding places you search for, and finding the name of your area from your phone’s position. The map’s own usage reporting is switched off. |
| OpenAI | Checking the text of posts, comments and public groups for abuse (moderation). OpenAI does not use this data to train its models. |
| OpenRouter (and the AI model providers it routes to) | Identifying cards in scan images; checking photos posted to the feed or listings for abuse; a second check of text that the moderation step flagged or that a new account wrote. |
| xAI | Answering PikaAI messages (what you type) and generating binder scenery pictures from the prompt you choose and the card artwork. |
| KLIPY | Searching GIFs in chat: your search words go straight from your phone to the GIF service, which sees your IP address. Nothing else is sent. |
| CrowdSec | Security: software that runs on our own servers and blocks abusive traffic and attacks. It reads the IP addresses of requests to our servers. |
| Our hosting providers (OVHcloud, Contabo) | Running our servers and storing the Service’s data (Section 6). |
We may also disclose data where the law requires it (for example, a lawful request from a competent authority), or to protect the rights, safety and property of PokeTrade AI, our users or the public.
6. Where your data is stored, and international transfers
Our application servers and main database run in Canada (Beauharnois, Quebec). Database replicas, backups and stored files (photos and images) are kept in the European Union (France and Poland). The European Commission has recognised Canada as providing an adequate level of data protection.
Several of the providers in Section 5 process data in the United States. Where data leaves the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) or the European Commission’s Standard Contractual Clauses. You can ask us for details of a specific transfer.
7. How long we keep your data
- Your account and content are kept while your account exists. When you delete your account, it is deleted at once with everything linked to it (profile, listings, posts, comments, collection, wishlist, devices, push tokens, sessions), except what is listed below.
- Messages waiting for a device to collect them are deleted once collected, and at the latest after about 30 days. Messages already on other people’s phones stay there. Encrypted messages of chats that are not yet on this newer system stay on our servers, still encrypted, for as long as the chat exists; if you delete your account they are no longer linked to it.
- Evidence attached to a chat report (the readable messages the reporter sent us) is kept for 180 days. The report itself and our decision stay.
- Scan images tied to your scan are deleted after 7 days. The copies kept without your account to improve card recognition are deleted after 12 months. Our backup copy of stored files follows a few days later.
- Website analytics records hold no identifier that lasts longer than a month and are kept as statistics.
- Usage events and server logs are kept for about 90 days. The days you opened the app are kept while your account exists (your streak). View counts of posts and listings are kept as daily totals, without who viewed them.
- Purchase records are kept as long as tax and accounting law requires. Apple, Google, RevenueCat and Stripe keep their own records of payments and identity checks under their own legal obligations.
- Reports you were the subject of are kept, without your account, to keep the platform safe. A one-way fingerprint of your email address is kept to prevent repeat free trials.
- Backups are overwritten on a rolling basis.
8. Deleting your account
You can delete your account at any time in the app: Settings → Account → Delete account. If you cannot use the app, see how to delete your PokeTrade AI account.
9. Your rights
If the GDPR applies to you, you have the right to:
- Access the personal data we hold about you and get a copy of it;
- Rectify inaccurate or incomplete data;
- Erase your data, which you can do yourself by deleting your account;
- Restrict how we use your data in certain circumstances;
- Portability: receive the data you gave us in a machine-readable format;
- Object to processing based on our legitimate interests, including usage analytics;
- Withdraw consent where we rely on it, without affecting what was done before.
To exercise any of these rights, email support@poketrade.ai. We answer within one month and may first need to confirm it is you. We have not appointed a data protection officer: write to the same address for anything you would send one. You can also complain to a supervisory authority: our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee, info@aki.ee), and you may also contact the authority in the EEA country where you live.
10. Age
PokeTrade AI is for people aged 18 and over: users chat with and meet people they do not know and verify their identity. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, tell us at support@poketrade.ai and we will delete it.
11. How we protect your data
All traffic between the app or website and our servers is encrypted in transit (HTTPS). Chats and private groups are end-to-end encrypted. Passwords are stored only as strong hashes, access to our systems is limited to the people who need it, and our servers are kept up to date. No system is completely secure; if a breach affects you, we will tell you and the authorities as the law requires.
12. Changes to this policy
When we change this policy in a way that matters, we update the date at the top and ask you to accept the new version in the app.
13. Contact us
For any question, request or complaint about your privacy or this policy, contact ICXCNIKA OÜ at support@poketrade.ai.
對本文件有疑問嗎？請寄信至 support@poketrade.ai.
所有法律文件