Last updated: 28 July 2026
This policy explains how the Card Codex Scanner mobile app (for Android and iOS, “the app”) handles your information. It covers the app specifically. Our general website privacy policy is separate.
The app is provided by Card Codex Ltd (“we”, “us”), a company registered in England and Wales, company number 17331405, registered office 5 Vaudrey Drive, Hazel Grove, Stockport, England, SK7 5PB. Questions about privacy: [email protected].
Card Codex Ltd is the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner’s Office.
The app is available to users in the UK, Ireland, the United States, Canada, Australia, New Zealand and elsewhere. This policy applies wherever you are; the “Your rights where you live” section below explains the specific rights that apply in your country or state.
The short version
The app identifies your cards on your phone. It has no login and no account, and it never uploads your photos. To do its job it does make a few ordinary internet requests (to show live prices, exchange rates and card pictures), and like any internet request those reveal your device’s IP address to the server involved. We don’t use them to build a profile of you.
If — and only if — you choose to, you can send your list of scanned cards to your Card Codex website account. That is explained in “Saving your cards to a Card Codex account” below, and it never happens unless you tap the button.
What the app accesses on your device
- Camera — required, so the app can see the card you point it at. Camera frames are processed live on your device to identify the card. They are never saved and never uploaded.
- Local storage — the app stores, on your device only: your settings (language, currency, sound), your current scanned-card session, a note of which cards you have already sent to your collection (so they aren’t sent twice), and a cached copy of the daily price and exchange-rate data so it works offline.
The app requests one permission: the camera. Nothing else — no microphone, no location, no contacts, no phone identifiers.
Internet connections the app makes
Even though scanning is on-device, the app contacts these services. Each receives your device’s IP address as part of a normal web request:
- cardcodex.com (our own site) — to download the daily card price file, to load card images when they’re shown to you, and — only if you tap “Save my collection” — to send your scanned card list (see the next section).
- Frankfurter (api.frankfurter.dev), a third-party exchange-rate service — once a day, to fetch currency exchange rates so prices can be shown in your chosen currency. We send no personal data in this request; the service simply receives the request (and therefore your IP) like any website.
- When you tap a link: the app opens your browser to eBay or TCGplayer (shopping links — see Affiliate links below), to cardcodex.com (e.g. “view card details”), or to the Google Play Store or Apple App Store (if you choose to leave a review).
These connections happen so the app can function; they are not analytics or advertising, and the app contains no third-party analytics or advertising tracking software.
Saving your cards to a Card Codex account
The app has an optional feature that lets you copy the cards you’ve scanned into a collection on our website, cardcodex.com. It only ever runs when you tap “Save my collection.”
When you tap it:
- The app sends us only your card list — for each card, its catalogue reference, the version you selected, and how many copies. No photographs are sent. No name, email, account or device identifier is sent — the app has no login and attaches nothing that identifies you.
- We store that list temporarily against a random one-off code and send the code back to the app, which opens a page on cardcodex.com in your browser.
- The list is held for 30 minutes and then expires. If you don’t complete the next step, it is discarded.
- On that web page you log in or create a Card Codex account and confirm the import. Only at that point is the list attached to an account. Creating and using a website account is covered by our website privacy policy, which is separate from this one.
If you never tap the button, none of this happens and no card list ever leaves your phone.
Affiliate links
The app contains shopping links to eBay and TCGplayer. If you buy something after tapping one, we may earn a commission, at no extra cost to you. Tapping a link opens that retailer in your browser, and from that point the retailer’s own privacy policy applies. This is disclosed in the app.
What we do NOT collect
- No account, name, email or password — the app has no login.
- No photographs — camera frames never leave your device.
- No advertising identifiers, and no third-party advertising or analytics tracking software in the app.
- No location, microphone, or contacts data.
- No payment information — the app takes no payments and is free.
Legal basis (UK & EU / Ireland GDPR)
For users in the UK and the EU (including Ireland), we rely on:
- Legitimate interests (Art. 6(1)(f)) for the ordinary requests that make the app work — downloading prices and exchange rates, and loading card images you asked to see.
- Performance of a service you have requested (Art. 6(1)(b)) for sending your card list when you tap “Save my collection”. You control this entirely: it happens only on that tap, and not sending is the default.
We do not sell your data
We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined under US state privacy laws (including the California Consumer Privacy Act). The app has no advertising-tracking software and no login, so there is no profile to sell.
How long we keep data
- In normal use of the app, we hold no personal data about you at all.
- A card list sent with “Save my collection” is held for 30 minutes and then expires. If you complete the import, the cards become part of your website account and are kept under our website privacy policy until you delete them or close the account.
- Standard web-server logs (including IP addresses) from the requests above are kept for up to 30 days, after which they are automatically deleted. They are used only for security and troubleshooting.
Who we share data with
We do not sell your data. Where data is processed, it is handled by us and by the following service providers acting on our behalf:
- Clook Internet (a trading style of Sub 6 Limited, registered in England and Wales, company no. 4439133) — hosting for cardcodex.com. Our server is located in the United Kingdom.
- Cloudflare — content-delivery and security network sitting in front of cardcodex.com, through which requests for card images and the price file pass.
- Our web development partner, who maintains the website and its server on our behalf.
We may disclose data if required by law.
Your rights where you live
Wherever you are, you can contact us at [email protected] to ask about the data we hold. Because the app has no login, please include enough detail for us to locate any relevant records. Your specific rights include:
- UK & EU / Ireland (UK GDPR / EU GDPR): access, correct, delete, restrict or object to processing, data portability, and withdraw consent. You may complain to your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in Ireland, the Data Protection Commission (dataprotection.ie).
- United States (California and other states): the right to know what personal information we hold, to request its deletion, and to not be discriminated against for exercising these rights. We do not sell or share your personal information (see above).
- Canada (PIPEDA): access to, and correction of, your personal information; you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
- Australia (Privacy Act / Australian Privacy Principles): access and correction rights; you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
- New Zealand (Privacy Act 2020): access and correction rights; you may complain to the Office of the Privacy Commissioner (privacy.org.nz).
International transfers
We are based in the United Kingdom, and the server that stores our data is in the United Kingdom — hosted by Clook Internet in Manchester-based facilities.
cardcodex.com is served through Cloudflare, a content-delivery and security network which operates servers worldwide. Requests from the app — for card images and the daily price file — are routed through the Cloudflare location nearest to you, which may be outside the UK, before reaching our UK server. Cloudflare therefore processes the technical details of that request, including your IP address.
Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
Children
The app is intended for collectors and is not directed at children under 13. We do not knowingly collect data from children under 13.
Changes
We may update this policy; the “Last updated” date above will change, and we will note material changes in the app where practical.
Not affiliated with Nintendo / The Pokémon Company
Card Codex Scanner is an independent tool and is not affiliated with, endorsed by, or sponsored by Nintendo, The Pokémon Company International, or Game Freak. “Pokémon” is a trademark of its respective owners and is used only to describe the cards the app is compatible with.
