Privacy policy
Last updated
Card Orb is a tool for keeping track of a Pokémon card collection. This policy explains what it stores, why, who else sees it, and what you can do about it. It covers both the website at cardorb.com and the Card Orb app for iPhone and iPad — they are one service, sharing one account and one database. Where the two genuinely differ, it says so.
Who is responsible
Card Orb is operated by BADU Ventures B.V., Voorhaven 27C, 3025 HC Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce under KVK number 76480801. BADU Ventures B.V. is the data controller for everything described here.
For anything in this policy, including a request about your own data, write to hello@bartdunweg.com.
What is collected
Your account
An email address and a password. The password is never stored by Card Orb in a readable form — authentication is handled by Supabase, and Card Orb only ever sees a session token.
Your collection
Every card you add, and what you record about it: quantity, condition, grade, purchase price, purchase date, notes, whether it is a favourite, and whether you have excluded it from your collection’s total value.
Your profile
A display name if you set one, a profile photo if you upload one, and whether you have switched your collection to public.
Analytics and crash reports
The two surfaces differ here, so both are stated plainly.
- The website uses Vercel Web Analytics, which counts page views. It sets no cookies, does not follow you to other websites, and produces aggregate figures — which pages are read, roughly where in the world from, on what kind of device — rather than a profile of you. It is not connected to your account.
- The iOS app has no analytics at all. If it crashes or hangs, a diagnostic report is sent to Sentry, an error-tracking service. Those reports carry technical information — the kind of crash, the device model, the operating system version, the app version — and deliberately not your email address, your access token, or anything you typed into the app’s search.
Cookies
One cookie, and it is the one that signs you in: a session token issued by Supabase. Without it you would have to enter your password on every page. There are no advertising or tracking cookies here, so there is nothing to consent to and no banner asking you to. Your light-or-dark preference is kept in your browser’s local storage and never sent to the server.
What is not collected
There is no advertising, no tracking across other apps or websites, and nothing is sold or shared for marketing. When you scan a card with the camera, the text is recognised on your device; no photograph is uploaded or stored.
Why, and on what legal basis
Only to run the service: to sign you in, to store and show your collection, to show a public collection page if you switch that on, and to fix crashes. There is no other purpose.
Under the GDPR, your account and your collection are processed to perform a contract — you asked for an account, and this is what the account does. Crash reports and the website’s aggregate page counts rest on a legitimate interest in the software working and in knowing which pages are read.
Who else sees it
- Supabase hosts the database and handles authentication. The database is hosted in the European Union, in Ireland, and your data is not transferred outside it.
- Vercel hosts the website and provides the page-view analytics described above.
- Sentry receives crash reports from the iOS app, and nothing from the website.
- pokemontcg.io and TCGdex supply card and set data, and Cardmarket supplies prices. These are asked by Card Orb’s own servers, never by your browser or your phone, so they receive nothing identifying you — not your address, not your account, not what you searched for. Opening a “Buy on Cardmarket” link is an ordinary visit to their website and is governed by their policy, not this one.
Nobody else. Your collection is private unless you switch on the public setting yourself, and even a public collection never shows prices, purchase details or your email address.
How long it is kept
Until you delete it. Deleting your account in Settings removes your profile and your entire collection immediately and permanently, in one operation — there is no grace period, no archived copy, and no way to undo it.
Crash reports are kept by Sentry under its standard retention period for errors, 90 days, and then discarded.
Your rights
If you are in the EU or the UK you can ask for a copy of your data, ask for it to be corrected or deleted, object to it being processed, or complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens. Deleting your account in Settings does the erasure part instantly and without asking anyone; for anything else, write to hello@bartdunweg.com.
Children
Card Orb is not aimed at children under 16, and an account should not be created by one without a parent’s involvement.
Changes to this policy
If this policy changes in a way that matters, you will be told before the change takes effect. The date at the top of this page always reflects the version you are reading.