Privacy Policy
Last updated: 11 October 2026
Poké keeps the data it needs to sync your collection and to connect you with other collectors, and nothing else. There are no ads, no analytics or tracking tools in the app, and we do not sell your data.
1. Who is responsible
The data controller is Andrei Dudar, Cyprus. For anything about your data, write to poke@poke.cy.
2. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Google account email, name, profile picture and account ID | Google, when you sign in | To create your account and keep it secure | Contract |
| Username, display name, picture, country | You; name and picture are first filled from Google | To show who you are to other collectors | Contract |
| Contact details you choose to add (a phone number, email or messenger handle) | You, optional | So another collector can reach you about a trade | Contract |
| Your collection: cards, variants, quantities, condition, language, notes, binders | You | To keep your collection and sync it between your devices | Contract |
| The last 100 changes to your collection | The app | So you can undo a change | Contract |
| Cards you are chasing | You | To track them, and to show other collectors what you are looking for | Legitimate interest in connecting collectors; you can switch the sharing off in Profile |
| Cards you mark for trade, with any condition, price or note | You | To show them to other collectors | Contract |
| Interest you show in another collector's card | You | To tell that collector someone wants the card | Contract |
| Completed trades: the two people, the cards, the date | The collector who records the trade | To keep a trade history and show that two people have traded before | Legitimate interest in a trustworthy community |
| Reports and blocks: who reported or blocked whom, the reason, any note | You | To keep users safe and act on abuse | Legitimate interest; legal obligation where one applies |
| IP address, device and app version, time of request | Automatically, in our hosting provider's server logs | To run and secure the service | Legitimate interest |
| Emails you send us | You | To answer you | Legitimate interest |
3. What we do not collect
- Camera images. The card scanner reads cards on your device. Camera frames are not uploaded or stored.
- Location, contacts, advertising identifiers. The app does not ask for them.
- Notification data. Release reminders are scheduled on your device and your reminder settings stay there.
- Usage tracking. There are no analytics, advertising or tracking tools in the app.
4. What other collectors can see
Signed-in collectors can see your display name, username, picture and country, the contact details you added, the cards you marked for trade, and the cards you are chasing unless you hid them in Profile. The owner of a card you showed interest in sees your name and contact details. A collector you traded with sees the record of that trade.
Nobody else sees your email address, how many copies of a card you own, the rest of your collection, your notes or your binders.
If you block someone, neither of you sees the other's cards, interest or profile.
5. Who we share data with
We do not sell your data and we do not share it for advertising. We use these services to run the app:
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database, sign-in sessions and file storage, hosted in the EU (Ireland) | Everything in section 2 |
| Sign-in | The fact that you signed in to Poké | |
| Apple | Distributes the app and delivers on-device reminders | What the App Store and iOS collect under Apple's own policy |
| Card image hosts: Scrydex, TCGdex, pokemontcg.io, Pokellector, Bulbagarden Archives | Serve card pictures straight to your device | Your IP address and the request for the image, as with any web page |
When you tap a contact button, the app opens WhatsApp, Telegram or your mail app. What happens there is covered by that service's policy.
We may disclose data where the law requires it, or where it is needed to protect a user from harm.
6. Where your data is stored
Your account data is stored on Supabase servers in the EU (Ireland). Some providers, including Google, process data outside the European Economic Area. Where that happens, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses.
The app also keeps a copy of your collection in a database on your device and your sign-in session in the device's secure storage, so it works offline.
7. How long we keep it
- Account, profile, collection, chases, listings, interest: until you delete your account. Deletion in Profile → Delete account is immediate and permanent.
- Completed trades: after you delete your account, the other person's record keeps the fact of the trade without your name.
- Reports about abuse: up to 12 months after the report is closed.
- Collection change history: the last 100 changes.
- Backups and server logs: removed on our hosting provider's normal cycle, within 30 days.
- Data on your device: removed when you sign out with everything synced, delete your account, or delete the app.
8. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to our use of it, and receive a copy of it. In the app, Profile lets you change your contact details, hide your chases, export your collection and delete your account. For anything else, write to poke@poke.cy and we will answer within one month.
You also have the right to complain to the data protection authority where you live. In Cyprus this is the Office of the Commissioner for Personal Data Protection.
9. Children
Poké is not for children under 16 and we do not knowingly collect their data. If you believe a child under 16 has an account, write to poke@poke.cy and we will delete it.
10. Security
Data travels over encrypted connections. Access rules in the database let each user read and change only what this policy says they can. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authority as the law requires.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The date at the top shows the current version.
12. Contact
poke@poke.cy