Privacy Policy – EasyCards

This policy describes how EasyCards (“the App”) processes users’ personal data, pursuant to EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

1. Data controller

Luca Drech, email: support@easycardsapp.com. For any request regarding your personal data you can contact us at this address.

2. Data we collect

Name (chosen by you, can be a pseudonym).
Email address.
Profile picture, only if you choose to upload one. It is stored in a public bucket, so anyone holding its address can view it: do not upload images you would not publish.
Data generated by your use of the app: cards and searches you choose to save, registration and last sign-in timestamps.
A notification token, if you turn on alerts for a saved search. It identifies the device, not you, and is deleted when you turn alerts off or delete your account.
Search data, as described in section 3.
No advertising data: the App shows no ads. See section 4.

You can browse and search without an account. Name, email and profile picture exist only if you choose to sign up.

3. Search data

To make card search more accurate, we record what each search does and how it went. Specifically:

The search text you typed, the filters you applied (language, grade, grading company, country) and the queries the app sent to eBay.
How the search performed: how many eBay listings came back, how many our filters kept, and which filter rule discarded the rest.
The listings shown to you and which one, if any, you opened or saved, so we can learn which results were actually the right ones.
The public titles of the eBay listings returned. These are seller-written product titles, not information about you: we study them to teach the app the vocabulary the card market really uses.

This data is pseudonymous. It is tied to a randomly generated installation identifier, not to your device, and never to an advertising ID. That identifier is regenerated when you sign out. If you are signed in, the data is also linked to your account, so deleting your account unlinks it.

Legal basis: our legitimate interest in improving the service (art. 6(1)(f) GDPR). We do not use this data to profile you, to make automated decisions about you, or for advertising, and we never sell it. You can object at any time by writing to support@easycardsapp.com. Search data is deleted automatically after 180 days; listing titles, which contain no personal data, are kept as a reference vocabulary.

4. Advertising

EasyCards shows no advertising. No ad is requested, no advertising SDK is started, and your device’s advertising identifier is never read, which is also why the App never asks for tracking permission.

If we ever introduce advertising, this policy will say so before the first ad appears: what the ad provider collects, on what legal basis, and how to refuse it. A version that shows ads will also ask for your choice where the law requires it (the EEA, the UK and regulated US states) through a consent form you can reopen at any time.

5. Purposes and legal basis

Data is processed to let you access your personal area and save cards/searches (performance of the requested service, art. 6(1)(b) GDPR) and to improve search quality (legitimate interest, art. 6(1)(f) GDPR). Within the App we do not process any data for advertising; for our website see section 12. Any marketing communications happen only with your prior, explicit consent, withdrawable at any time.

6. Passwordless authentication model

The App does not use passwords. To sign in we send a 6-digit OTP code to the email address you provided: this ensures only someone with actual access to the inbox can log into the account. The code has limited validity. The email is used solely to send sign-in codes and essential service communications.

Alternatively, you can sign in with your Google account. In that case Google confirms your identity and shares with us only your name, your email address and the fact that the email is verified: we use the name and email to create your profile and nothing else. We never receive your Google password, and we do not access your contacts, files or any other Google data. If you already have an EasyCards account with the same email, signing in with Google opens that same account.

On iPhone you can also use Sign in with Apple. Apple confirms your identity and shares with us your name (only the first time) and an email address: if you choose “Hide My Email”, it is a private relay address created by Apple that forwards to your inbox, and we never learn your real one. As with Google, we use them only to create your profile. We also keep a token issued by Apple for one purpose only: when you delete your account, we use it to revoke EasyCards’ access to your Apple ID, then it is deleted together with the account.

7. Retention

Account data is kept for the entire duration of the account. You can delete it at any time from Profile → Delete account, or by writing to support@easycardsapp.com. Search data is deleted after 180 days (section 3).

8. Recipients and transfers

We do not sell your data and we do not share it for anyone else’s marketing. We do rely on the following providers, each processing only what its job requires:

Supabase: hosting of the account database, the files you upload and our server functions. EU servers (eu-west-1).
Resend: delivery of sign-in code emails. Receives your email address.
Google: sign-in with your Google account, only if you choose it. Google tells us your name and email address; it does not learn what you do in the App.
Apple: Sign in with Apple, only if you choose it. Apple tells us your name and an email address (possibly a private relay address); it does not learn what you do in the App.
eBay: the marketplace we search. Your searches reach eBay through our servers, so your device is not exposed to it; the search text is sent, your identity is not. Listing images are then loaded by your device directly from eBay.
Expo, and Google (Firebase Cloud Messaging) or Apple (APNs): delivery of push notifications, if you turn them on.
Meta Platforms: only on our website, through the Meta Pixel described in section 12. Nothing from the App is sent to Meta.
Pokémon TCG API and Pokémon-API via RapidAPI: public card catalogue and graded price history. Your device requests card data from them; no account data is sent.
Cardmarket and TCGdex: European card prices and the card catalogue. Our servers download the price guide that Cardmarket publishes every day for anyone to use, and match it to our catalogue through TCGdex; your device asks our servers for those prices, so nothing about you reaches Cardmarket. Some card images are loaded by your device directly from TCGdex; no account data is sent.

Some of these providers are based outside the EU, mainly in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses or on the EU-US Data Privacy Framework, as applicable to each provider.

9. Your rights

You have the right to access, rectify and erase your data, restrict its processing, object, receive a copy in a readable format (portability) and lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). The rights to access/portability and erasure can be exercised directly from the personal area via the “Export my data” and “Delete account” buttons.

10. Children

The App is not directed to children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to support@easycardsapp.com and we will delete it.

11. Cookies and tracking

The App uses no cookies, no third-party analytics SDK and no advertising network. The only usage data we collect is the search data in section 3, which we process ourselves on our own infrastructure. Our website is a separate case, described in section 12.

12. Our website, the waitlist and the Pedestal

This section covers our website, easycardsapp.com, not the App.

Waitlist. If you join the waitlist we store your email address, the page or campaign that brought you to us (the referrer and any campaign tags in the link, such as utm_source), your browser’s user agent and the date. We use them to tell you when EasyCards launches, to recognise you as a waitlist member when you later create an account in the App with the same email (that is how the waitlist launch discount is applied), and to see which of our campaigns bring people to the waitlist. Legal basis: your request to join (art. 6(1)(b) GDPR). The data is stored on Supabase (EU servers) and kept until you ask us to remove it, and in any case no longer than 12 months after the App launches.
The Pedestal launch list. If you leave your email on our Pedestal pages (the home page easycardsapp.com, in Italian, and easycardsapp.com/en, in English) we store your email address, your language (chosen automatically from your device’s time zone and language, or by you with the EN/IT switch), the page or campaign that brought you to us, your browser’s user agent, a one-way hash of your IP address used only to stop abuse, and the date. We send you one message asking you to confirm the address, through Resend, our email provider. Whether or not you confirm, we may write to you about the Pedestal launch in that language: a reminder to confirm and the news of the campaign. Only after you confirm do we add you to the waitlist above, with your language. Legal basis: your consent, given when you leave your address on the page (art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us. An address that is never confirmed is deleted within 90 days; the others are kept until you ask us to remove them, and in any case no longer than 12 months after the Pedestal campaign ends.
The Day Zero coin reservation. If you reserve the coin with a 1 euro payment, the payment is handled by Stripe, which receives your email address and your card details under its own privacy policy. We never see your card number. We store whether you paid, the Stripe payment reference and the date, and we compare your email with the Kickstarter backer list to put the coin in your box. Legal basis: performing the reservation you asked for (art. 6(1)(b) GDPR) and, for payment records, our legal obligations (art. 6(1)(c) GDPR). Payment records are kept for as long as tax law requires.
Meta Pixel. To measure our own ads on Facebook and Instagram, some pages of our website load the Meta Pixel, a tool provided by Meta Platforms. It tells Meta that a visit or a step came from one of our ads: on the Pedestal pages, a page view, leaving an email, confirming it, starting and completing the coin reservation (with its 1 euro value) and following the campaign; on the waitlist confirmation page, a visit or a waitlist sign-up. Meta may use cookies and link this to your Meta account under its own privacy policy. We never give Meta your email address. If your browser sends a Global Privacy Control signal, the pixel is never loaded. If your device is set to a European time zone, the waitlist confirmation page does not load it, and the Pedestal pages load it only after you press Allow in the banner (art. 6(1)(a) GDPR). Pressing Decline keeps it off. To change your choice, clear this site’s data in your browser and you will be asked again.
Apart from the pixel, the website runs no analytics or advertising tools.

To have your email removed from the waitlist or the Pedestal list, or to withdraw your consent, write to support@easycardsapp.com.

13. Changes

We may update this policy; the current version is always the one shown here and at easycardsapp.com/privacy, with its date at the top.

Also read: Terms of Service · Delete your EasyCards account · EasyCards Support