Privacy policy - InfinityCards

1. InfinityCards and contact

InfinityCards is a platform for card collectors. Contact the operator at support@infinitycards.app with questions about personal data or privacy requests.

2. Data and public identity

The data used depends on the features you choose.

• Account: email address, chosen username, password hash where applicable, language, avatar, profile settings and a profile address.
• Google sign-in: a verified Google account ID, email address and optional profile photo. Google may supply a name; new accounts first receive a neutral temporary name. You choose your username during initial onboarding.
• Collection and vendor features: cards, conditions, variants, notes, wishlists, binders, decks, inventory, prices, sales, teams and events.
• Social features: follows, friendships, reactions, messages and notifications. Support receives the information and attachments you submit.
• Technical and payment data: sessions, app tokens, device and push registrations, scan credits, subscription and payment status, IP and browser/app information, and error, security and administration logs.

3. Why we use data

Account features, collection management, scans, communication and vendor tools use data to provide the agreed service. Payments and administration support that contract and applicable legal obligations.

• Security, abuse prevention, moderation and troubleshooting serve the legitimate interest in a reliable service, taking the effects on users into account.
• New non-essential tracking requires separate, specific prior consent. The website currently has no optional analytics or marketing scripts.
• We do not sell personal data. Cookies and storage explains cookies, local preferences and the PWA cache.

4. Card scans in the Android app

The native Android app can upload a temporary card photo for recognition. Check the suggested result yourself; recognition is not an authenticity or condition assessment.

• Depending on the recognition settings, Google Cloud Vision or Gemini processes the image. Local text recognition may also be used.
• Scan processing cleans up temporary server files and crops after processing. The photo is not stored as a collection image. The app cleans up its temporary capture after processing.
• Results may remain in the recognition cache for 60 minutes. Technical scan logs may include account ID, method, dimensions, processing time and suggested matches.
• InfinityCards does not use these photos to train its own models. A recognition provider’s processing is subject to the terms and arrangements for that service.

5. Service providers and recipients

Hosting, email, Google authentication and recognition, Stripe payments and Firebase push notifications support the relevant features. They receive the data needed for those tasks. The recipients depend on your use.

• Google sign-in does not give us access to Gmail, Drive or your calendar. InfinityCards does not store a Google password or Google access/refresh tokens for those services.
• Stripe handles payment details on its checkout page. InfinityCards stores related customer, transaction and subscription references, not your full card number.
• Push registrations are tied to a login session. Android checks the recipient before displaying a notification; notification preferences are available in the app and device settings.
• Providers may process data outside the European Economic Area. You can request information about the locations and transfer safeguards used for your data through support.

6. What others can see

Public profiles and search results use your chosen username and profile address, not your email address. Incomplete profiles are not displayed publicly.

• Profile visibility, counts and public binders determine what public profile and feed features display. A private binder is not shared through the public binder view.
• Messages are intended for conversation participants. Authorised administrators may access data when needed for support, security or moderation. Private messages are not end-to-end encrypted.
• Information you put in a message, public profile or vendor page can be read and copied by recipients or visitors.
• We use access controls, password hashes and secure connections for the production service. No service can guarantee absolute security.

7. Retention and deletion

Account data and content remain available while you use the account and relevant features. Deleting an account and cancelling a subscription are different actions.

• Daily cleanup is configured for 90 days for technical scan logs and 30 days for API error records. Temporary recognition results expire after 60 minutes.
• A deleted chat message disappears from the conversation, but its original content may remain internally for moderation. Deleting a chat message does not automatically erase every stored copy.
• Support, moderation and security records are assessed for their necessity in resolving the relevant issue or dispute. Financial records may be needed longer for statutory administration. Account deletion does not automatically remove those records.
• Account deletion requires identity verification. For an active subscription, the self-service function first asks you to resolve the subscription. You can always send a privacy or deletion request to support; that request remains separate from subscription management.
• Backups and provider-held data have their own deletion processes. Successful account deletion does not mean that every backup is immediately overwritten.

8. Your privacy rights

You can request access, correction, deletion, restriction or transfer of your data and, where applicable, object or withdraw consent. Email support@infinitycards.app. A statutory privacy request does not require a paid plan.

• We may request information to verify that the account is yours. We normally respond within one month and inform you of any permitted extension.
• You can also complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl or the competent supervisory authority in your country.

9. Changes

This page states the date of its last substantive update. Updating the policy does not itself grant consent for new tracking or other uses requiring separate consent.