Privacy policy
What Cardorb stores about you, why, who else sees it, and what you can do about it. One policy for the website and the iOS app.
Cardorb is a tool for keeping track of a Pokémon card collection. The website at cardorb.com and the Cardorb app for iPhone and iPad are one service, sharing one account and one database. Where the two genuinely differ, this policy says so.
Who is responsible
Cardorb is operated by BADU Ventures B.V., Voorhaven 27C, 3025 HC Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce under KVK number 76480801. BADU Ventures B.V. is the data controller for everything described here.
For anything in this policy, including a request about your own data, write to hello@bartdunweg.com.
What is collected
Your account
An email address and a password. The password is never stored by Cardorb in a readable form. Authentication is handled by Supabase, and Cardorb only ever sees a session token.
Your collection
Every card you add, and what you record about it: quantity, condition, grade, purchase price, purchase date, notes, which collections you have sorted it into, whether it is a favourite, and whether it is on your wishlist rather than owned.
Your profile
A username, a display name if you set one, a profile photo if you upload one, and whether you have switched your collection to public.
Analytics and crash reports
- The website has no analytics and sets no tracking of any kind. Vercel, which hosts it, keeps ordinary server logs for a short time to run the service.
- The iOS app has no analytics either. If it crashes or hangs, a diagnostic report is sent to Sentry, an error-tracking service. Those reports carry technical information, such as the kind of crash, the device model, the operating system version and the app version, and deliberately not your email address, your access token, or anything you typed into the app’s search.
Cookies
One cookie, and it is the one that signs you in: a session token issued by Supabase. Without it you would have to enter your password on every page. There are no advertising or tracking cookies here, so there is nothing to consent to and no banner asking you to. Your light-or-dark preference is kept in your browser’s local storage and never sent to the server.
What is not collected
There is no advertising, no tracking across other apps or websites, and nothing is sold or shared for marketing. When you scan a card with the camera in the iOS app, the text is recognised on your device; no photograph is uploaded or stored.
Why, and on what legal basis
Only to run the service: to sign you in, to store and show your collection, to show a public collection page if you switch that on, and to fix crashes. There is no other purpose.
Under the GDPR, your account and your collection are processed to perform a contract: you asked for an account, and this is what the account does. Crash reports rest on a legitimate interest in the software working.
Who else sees it
- Supabase hosts the database and handles authentication. The database is hosted in the European Union, in Ireland, and your data is not transferred outside it.
- Vercel hosts the website.
- Sentry receives crash reports from the iOS app, and nothing from the website.
- Public card catalogues and price sources supply card and set data, pictures and prices. Cardorb’s own servers ask them and keep a copy, never your browser or your phone, so they receive nothing identifying you: not your address, not your account, not what you searched for. Opening a link to a shop is an ordinary visit to their website and is governed by their policy, not this one.
Nobody else. Your collection is private unless you switch on the public setting yourself, and even a public collection never shows prices, purchase details, notes or your email address.
How long it is kept
Until you delete it. Deleting your account in the iOS app’s Settings removes your profile and your entire collection immediately and permanently, in one operation: there is no grace period, no archived copy, and no way to undo it. If you only use the website, write to hello@bartdunweg.com and the same happens by hand.
Crash reports are kept by Sentry under its standard retention period for errors, 90 days, and then discarded.
Your rights
If you are in the EU or the UK you can ask for a copy of your data, ask for it to be corrected or deleted, object to it being processed, or complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. For any of these, write to hello@bartdunweg.com.
Children
Cardorb is not aimed at children under 16, and an account should not be created by one without a parent’s involvement.
Changes to this policy
If this policy changes in a way that matters, you will be told before the change takes effect. The date at the top of this page always reflects the version you are reading.