CARD SCAN LAB
Privacy & your photos
Photos and recognition
With your consent, Card Scan Lab sends the photo to pokemontcgapi.com Vision for identification. The browser resizes it and removes metadata first. Images are processed in memory, not saved as files, and discarded after processing. RareBit receives card identifiers for catalog and price lookup, not the photo. Do not include faces or personal documents.
Guest usage and cookies
A signed first-party browser identifier lasts up to 365 days and remembers your five guest results with a price. This is a total allowance for that browser identity, not a daily limit or a promise of five results per person. Clearing browser data can remove it. Logging out or deleting an account does not reset the existing guest allowance.
Email accounts
When email sign-in is enabled, we use your email address to send a one-time code and create a separate Card Scan Lab account. No password is required. Your email is used for sign-in, not marketing. Our application store keeps a protected derivative of the address and a masked display address, not the full email. The delivery provider receives the address to send the code. Codes expire after 10 minutes, allow at most five verification attempts and cannot be reused; another code can be requested after at least 60 seconds. Login sessions last up to 30 days; the account stays until you delete it.
Retention and statistics
Scan metadata and candidate card identifiers expire after two hours; rate-limit counters expire after 24 hours. Anonymous aggregate event totals are kept for up to 90 days. They contain no photo, email or cross-site user identifier. Browser Do Not Track and Global Privacy Control preferences stop optional analytics delivery. Operational logs can include request times, status and technical connection data.
Your choices and contact
You can withdraw photo-processing consent from the footer and delete your account with its controls. To request access, correction or deletion, contact Riccardo De Romeri at de.romeri.k@gmail.com. Withdrawal stops future photo uploads and does not undo completed processing.
Purposes and legal bases
Photo identification is based on your consent. Browser identifiers, email verification and account sessions are necessary to provide the service you request. Technical anti-abuse controls protect our legitimate interest in maintaining a secure and available service. Optional event statistics are anonymous aggregates; they do not build a profile of you.
Your data rights
Where applicable, you can request access, correction, erasure, restriction, objection and data portability, and withdraw consent. You may lodge a complaint with the competent data-protection supervisory authority. Contact the controller, Riccardo De Romeri, at de.romeri.k@gmail.com.
Coarse referral categories
Optional event totals include only a broad source category, such as search engines, AI assistants, social networks, referring sites, other or direct/unknown. Your browser keeps that category in sessionStorage for navigation within the tab. Raw referrer URLs, campaign values and identifiers are not stored or sent with these events. Do Not Track, Global Privacy Control and internal-test exclusion stop optional event delivery. The category may be direct/unknown when storage or referrer information is unavailable.
Resend · Privacy ↗
pokemontcgapi.com · Privacy ↗