Privacy policy

Information you give us

• Your account: your email address, the display name you choose (optional), and when you joined.
• Your collection: your lists and their settings, the cards you mark as owned and any details or notes you add (including what you paid), the card you choose to display for each Pokémon, your wishlist with its priorities and notes, and a history of when you added or removed each card.
• Sharing: the links you create, the email addresses of people you invite or who save your shared lists, and access records such as when a shared list was last viewed.
• Messages: what you send through the contact form (your email address, topic and message, and your account reference if you are signed in). Messages are delivered to our inbox by email and are not stored in the Gumdex database. To limit abuse, we keep scrambled (hashed) copies of the sender’s email and IP address for one day.
• Feedback: what you send with the Feedback button in the app (your message and optional rating), with the page and list you were on and your browser type. It is stored with your account so we can follow up, and a copy is emailed to us.
• Card photos: photos you send for cards with no image, with the card, the credit name you choose (or none), when you agreed to the contributor terms, and our review decision. An approved photo is shown publicly as the card’s image, with your chosen credit.

Information collected automatically

• Log and device data: our hosting and sign-in providers keep records of requests, sign-in activity and errors. These can include your IP address, browser and operating system, the pages you requested and when.
• Cookies: a few cookies to keep you signed in, remember your last list and remember your cookie choice, plus analytics cookies if you accept them. See the cookie policy.
• Usage and performance data: our hosting provider measures page visits and page speed without cookies and without identifying you (the page address, referring site, country, browser and device type). If you accept analytics cookies, Google Analytics also records which kinds of page you visit, how you use them, and your approximate location and device, linked to a random identifier stored in your browser. It sees only the kind of page (for example “a list’s sets”), never your list names, list addresses or page titles. Secret-link addresses are never sent to either.

You do not need to give us your real name or postal address. We do not add advertising trackers to Gumdex, and we do not buy data about you from other companies.

• to sign you in by emailing sign-in codes to your email address;
• to store and display your collection, and provide the sharing features you use;
• to manage your level, including Ultra earned by contributing card photos;
• to keep the service secure, prevent abuse and fix problems;
• to understand how Gumdex is used and how fast it loads, so we can improve it;
• to answer you when you contact us;
• to send service messages, such as notice of important changes;
• to meet our legal obligations.

We do not sell your data, use it for advertising, or send you marketing emails. We do not use your data to make automated decisions that have legal or similarly significant effects on you.

Other users cannot view your collection unless you share a list. When you do:

• A secret link lets anyone who has it see that one list read-only: its Dex grid, your owned cards and, if you allow it, your wishlist. Anyone who receives a forwarded link can also use it.
• An email invite lets someone who signs in with that email address see the same read-only view. We send that address one email from Gumdex saying you shared the list; it names you and the list, and replies go to your email address.
• Signed-in viewers can save the shared list to their account. Their email address then appears under People on your Share page. They keep access if you turn off or replace the link. To end someone’s access, turn off any secret link they have and remove them under People.
• Viewers see your display name. If you have not set one, a signed-in invitee sees your email address and a link viewer sees the part before the @. You can set a display name on your Account page.
• Viewers cannot see your card notes, condition, quantities, what you paid, wishlist notes, or any list you did not share.

These providers process data for us, only to run Gumdex and under our instructions:

• Supabase hosts the database, handles sign-in and serves Pokémon sprites and set marks.
• Vercel hosts and serves the website, and measures visits and page speed without cookies.
• Google provides Google Analytics, only if you accept analytics cookies. We do not share this data with Google for advertising.
• Cloudflare stores card photos you send, privately until they are approved, and serves card images.
• Resend delivers sign-in emails, contact-form messages and feedback notifications.

Data storage location: the United States for our database, website and email. Card images and the photos you send are stored with Cloudflare in eastern North America, and card images are served from its global network.

Your browser loads some card images from external image hosts. Those hosts receive your IP address, browser details and requests identifying the images you view.

We may also disclose data if the law requires it, to protect the rights, safety or property of our users, the public or us, or with your consent.

We protect your data with measures such as encrypted connections, access controls that keep each person’s lists separate in the database, and passwordless sign-in. No online service is completely secure, so we cannot guarantee that your data will never be accessed without permission. If a breach affects you, we will tell you and the relevant authorities as the law requires.

We keep your account and collection for as long as your account is open. When you close your account, we delete it from the live database straight away, as described below. Feedback is deleted after 12 months, or sooner with your account. Rejected and withdrawn card photos are deleted within about 30 days; approved ones are kept while they are in use, and all of your photos go with your account.

Backup and log retention: we do not keep database backups. Our hosting, database and email providers keep technical logs for a limited time, generally up to 30 days.

• Export: on Ultra, download the owned-card records for each list as a CSV file from your Account page. The file includes the details and card notes you added, but not your wishlist or list settings. On any level you can ask us for a copy of your data through the contact form, at no charge.
• Correct: edit your display name, lists, ownership details and wishlist in the app.
• Delete: close your account from the Account page to delete your account, lists, owned-card records and their history, wishlists, and the share links and invitations for your lists from the live database.

Closing your account does not delete invitations or saved-access records on other people’s lists. Those records can still contain your email address; ask us and we will remove them. Backups and technical logs may also keep information for a limited time after you close your account.

For any other request, use the contact form. We may need to confirm it is you before acting, and we will reply within the time the law requires (usually one month).

If you are in the United States and think we have mishandled your data, you can also contact the Federal Trade Commission or your state attorney general, though we would like the chance to help first.

Gumdex is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

If Gumdex is sold, merged or transferred, your data may be transferred to the new owner. They must keep using it only as this policy describes, unless you agree otherwise. We will tell you before that happens.

If we change this policy, we will update the effective date above. For significant changes we will also let you know on the site or by email before they take effect. The terms of use explain the agreement for using Gumdex.

These extra details apply under the EU and UK General Data Protection Regulation (GDPR). We are the controller of your data; our service providers act as processors.

Why we are allowed to use your data

• To provide the service you asked for (performing our contract with you): your account, collection, sharing, sign-in emails, and the card photos you send.
• Our legitimate interests: keeping Gumdex secure, preventing abuse, fixing errors, and answering your messages. We have weighed these against your rights, and you can object to them.
• Legal obligations: for example responding to lawful requests.
• Consent: for analytics cookies and Google Analytics. You choose in the cookie banner and can change your mind at any time with Cookie settings, at the foot of each public page or on your Account page.

Your rights

You have the right to:

• access the data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data, or object to uses based on our legitimate interests;
• receive your data in a portable, machine-readable format (data portability);
• withdraw consent at any time, where we rely on it.

To use these rights, use the contact form (topic: my account or privacy). You can also complain to the data protection authority where you live, though we would like the chance to help first.

International transfers

Gumdex is run from the United States, so your data is processed there, and some of our providers also store or process it in the United States. Where data leaves the EEA or UK, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework) or by standard contractual clauses approved by the European Commission and the UK, with extra safeguards where needed. Contact us for more detail.

These extra details apply under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

What we collected in the last 12 months

• Identifiers: email address, display name, IP address.
• Internet activity: log data about requests and sign-ins.
• Other content you provide: your lists, owned cards, notes and wishlist.

We collect these from you and your browser, for the purposes described under “How we use it”, and disclose them only to the service providers listed above, for business purposes. We keep them as described under “How long we keep it”. We do not collect sensitive personal information as defined by the CCPA.

We do not sell or share your data

We do not sell your personal information and do not share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16. Because there is nothing to opt out of, we treat Global Privacy Control and Do Not Track signals as already honoured.

Your rights

You have the right to know what personal information we collect, use and disclose; to have it deleted; to have it corrected; and not to be treated differently for using these rights. We do not offer financial incentives in exchange for your data.

To make a request, use the contact form. We will confirm it is you by checking that you control the email address on your account. You can use an authorised agent, who will need your written permission. We will respond within 45 days.

Questions or requests about your data: use the contact form or email gumdexapp@gmail.com.