Privacy Policy

• Account: you sign up with Sign in with Apple, Sign in with Google, or an email address and password. Depending on the method, we receive an identifier and email address from Apple or Google, or the email address and password you set (your password is stored securely by our authentication provider, never in plain text). You set a display name and an @handle, and may add a bio and avatar.
• Age: a date of birth, used only to confirm you meet the minimum age to use Cube. It is not shown to other users.
• Your collection: the cards you scan or add, their condition and quantity, any cost basis you enter, and the photos you capture. Card images are processed to identify the card.
• Subscriptions: if you buy Cube Pro, the purchase is handled by Apple; we store whether your subscription is active, not your payment details.
• Device and technical data: a device identifier, IP address, and (if you enable notifications) a push token, used to operate, secure, and deliver the service.
• Usage and diagnostics: app analytics and crash reports that help us find bugs and improve Cube.

Under UK and EU data protection law we rely on the following bases:

• To provide Cube (identify and price cards, track your collection, sync across your devices, manage your account and subscription): performance of our contract with you.
• The value leaderboard and your public profile: your consent, given when you opt in. You can withdraw it at any time.
• Notifications you enable: your consent.
• Analytics, crash reporting, security, and preventing abuse: our legitimate interests in keeping Cube working, safe, and improving.
• Age verification and meeting our legal obligations: compliance with a legal obligation and our legitimate interests.

Your collection is private by default. Nothing about your collection value or cards is public unless you opt into the leaderboard. That opt-in is the consent that makes your value, unique-card count, and top cards visible to others, in the app and on your public profile page at cubepod.app/u/your-handle. Your @handle, display name, bio, and avatar are identity fields, shown on your profile when you make it public. If you do not opt into the leaderboard, your public profile page shows no collection value or card data.

We do not sell your personal data. We share it only with providers who process it on our behalf to run the service:

• Apple, for Sign in with Apple, subscriptions, and push notifications.
• Google, for Sign in with Google.
• Supabase, for our database, authentication, and file storage (hosted in the EU).
• Card identification and pricing partners, including JustTCG and a third-party card-recognition service used as a fallback matcher on card images.
• RevenueCat, for managing subscription entitlements.
• OneSignal, for delivering push notifications.
• Analytics and crash-reporting providers (such as PostHog and Sentry).

Card catalog data is provided by Scryfall, TCGdex, YGOPRODeck, and Lorcast. We may also disclose data where required by law.

Your data is stored in the EU. Some of our providers are based outside the UK and EEA (for example in the United States). Where data is transferred internationally, we rely on an appropriate safeguard such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision.

We keep your personal data while your account is active. If you delete your account, we delete your personal data, except where we must keep limited records for legal, security, tax, or accounting reasons, for as long as those reasons apply.

You have the right to:

• access a copy of your personal data;
• correct inaccurate data, or complete incomplete data;
• delete your data (you can delete your account in the app);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing before withdrawal.

To exercise any of these, email privacy@cubepod.app. You also have the right to complain to a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is your local supervisory authority.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. To make a request, email privacy@cubepod.app.

We protect your data with encryption in transit, access controls, and reputable hosting. No online service can be completely secure, but we take reasonable steps to protect your information and to respond to incidents.

Cube is not intended for children under 13 (or the minimum age of digital consent in your country, which can be higher). We do not knowingly collect personal data from children under that age, and we ask for a date of birth to help prevent it. If you believe a child has provided us data, contact us and we will delete it.

The cubepod.app website does not use advertising or cross-site tracking cookies. The Cube app uses the device identifiers and analytics described above to operate and improve the service, and does not track you across other companies' apps or websites for advertising.

We may update this policy from time to time. We will change the date above and, for material changes, provide a more prominent notice.

Nick Davies, [registered contact address]. privacy@cubepod.app.