Privacy policy

1. Who processes your data

Pokeback is published by GABEM SAS, a French simplified joint-stock company (société par actions simplifiée) with a share capital of €500, registered office 11 avenue Ernest Lairolle, 06100 Nice, France, registered with the Nice Trade and Companies Register under number 105 578 355 ("we"). We are the controller of the data described here. For any question about your data: privacy@pokeback.app.

Pokeback is a management tool for trading card collectors and resellers: collection, purchases and costs, sales, trades, listings, margins and indicative tax tracking. Pokeback is not a marketplace: we buy and sell nothing on your behalf and we take no part in any transaction.

This policy covers the Pokeback iOS app (iPhone and iPad, with its widgets, its share extension and its App Clip), the Pokeback web app and this site.

2. Data we process

We never ask for an identity document, a tax number, an IBAN or third-party marketplace credentials (Vinted, Cardmarket, eBay, Leboncoin…). We never know the password of a third-party service.

3. What stays on your device

• Card scanning: the card’s text is read on your device by Apple’s text recognition, which also computes a digital fingerprint of the image. To recognise the card, the app sends this text and this fingerprint to our server. When online, it also sends the crop of the card (a reduced image of about 40 KB): our server computes a fingerprint from it, compares it with the catalogue’s artwork and does not keep the image. Offline, recognition runs entirely on the device. The photo is kept on our server only if you save it as the photo of your copy.
• Improving recognition (scanner setting, on by default, signed in): when you confirm a scanned card, the app sends the digital fingerprint of your photo (about 1 KB, which does not contain the image) together with the card you chose; averaged across users, it helps recognise that card for everyone. If the scan was not sure of that card, the app also sends its crop, once: our server computes a fingerprint from it, keeps the fingerprint with the card you chose and erases the image at once. That fingerprint helps recognise the card for you, then for everyone once a second user has confirmed it, or straight away for a card the catalogue has no image of (it is then suggested, never added without your gesture). We keep the fingerprint, never the photo. These fingerprints are kept for as long as the account exists; turning the setting off, in the scanner menu, erases what you have sent, and so does deleting the account.
• "Say it" (dictation): your voice is transcribed by Apple’s speech recognition, on the device when it allows it, otherwise by Apple’s service. The recording is not kept. Only the transcribed sentence is sent to our server, which understands it with its own rules and suggests an action that you approve. When those rules are not enough, the sentence alone may be handed to an artificial intelligence model (section 5).
• Screenshots and photos: if you turn on sale detection in your screenshots, the app reads your screenshots on the device and sends only the useful fields (item, price, date). Drop photos are saved to an album in your photo library, without sending anything.
• Clipboard: it is read only when you tap "Paste".
• Local network: in show mode, your own phones exchange what is sold directly, without going through our servers.
• Spotlight, widgets, shortcuts and Live Activities: the app indexes your collection in iPhone search (strongest device protection, erased on sign-out) and shares with its widgets, through a space of its own, the figures they show. This data does not leave the device.
• Face ID or Touch ID: the app lock is handled by iOS; we receive no biometric data.

4. Why, and on what legal basis

We do not sell your data, we do not run targeted advertising, we do not track you across apps or sites and we do not use your data to train artificial intelligence models.

Tax estimates (contributions, thresholds, DAC7 counters) are indicative: Pokeback files nothing on your behalf and sends nothing to the tax authorities.

This site

This site sets no cookie, uses no tracker or audience measurement tool and loads no third-party resource: typefaces are served with the site. It has no form and collects no data. Its static pages are served by Cloudflare, Inc. (section 7), which, like any web host, keeps technical logs (IP address, date, requested page, browser) for security; they are kept for a limited period, then deleted. The service’s data never goes through this site: it stays on our dedicated server at Hetzner Online GmbH.

5. Scouts, eBay and other services

Scouts. If you turn them on, scouts visit the public seller page you point us to (for example your Vinted profile) to spot your sales and your listings. They never sign in to your account, never ask for credentials and never act in your account. We keep only your own listings, never the identity of buyers or of people who add them to their favourites. The visits are carried out for us by Apify (section 7). A spotted sale is suggested to you and recorded only once you confirm it. You can remove a followed page at any time.

eBay. If you connect your eBay account (Seller+ plan), you authorise Pokeback through eBay’s official procedure to read your paid orders and selling settings, and to publish or withdraw the listings you launch from Drop. Your eBay tokens are encrypted. You can disconnect eBay at any time.

Listing drafts. When you ask for a suggested listing text, we send Anthropic only the item’s characteristics (name, set, number, rarity, condition, grading, language, marketplace), without your name, your e-mail address or any identifier. Nothing is sent unless you ask.

"Say it". When our rules do not understand well enough a sentence you say or type in "Say it" (a price written in words, a card nickname, a typo), we send that sentence alone to a small artificial intelligence model, through OpenRouter, which passes it to the provider running the model (Nebius). Nothing else is sent: not your name, your e-mail address, any identifier or your collection. We ask OpenRouter to use only providers that do not keep the sentences and do not use them to train models; OpenRouter states that it does not train models on requests. The model only prepares the action: nothing is saved without your approval. Avoid dictating information about other people beyond a first name.

Parcel tracking. Tracking numbers you enter are sent to the carrier concerned (La Poste, Mondial Relay, DHL, UPS) to follow the delivery.

Assistants you connect. You can create access tokens to plug in your own assistant (MCP connector). A read token only reads the chosen scopes and cannot change anything. An assistant token (Seller+ plan) can prepare actions, which only run with your approval. Each token stops working as soon as you revoke it or it expires. Data read by your assistant is then processed by its publisher under its own policy.

Public pages you create. A public storefront or a recap link only exists if you create it; it shows what you choose to put there (you can hide the amounts of a recap) and you can remove it at any time.

Import by e-mail. Forwarding your sale e-mails to Pokeback is not offered today. If it is one day, this policy will be updated beforehand.

6. Third-party data you enter

If you enter the username of a buyer or seller or, at the counter, the identity of a person who sells you cards (police register), you process that data to run your own business and meet your obligations: enter only what is necessary. In the police register, the identity document is read on your device, its photo is not sent, and the identity fields are encrypted and readable by you only.

7. Who has access

• You, and the people you invite to your organisation, according to the role you give them: viewer (sees your management data, for example your accountant) or editor (sees and changes it). An organisation opens your space to your members, never a member’s space to the owner. You can change a role or remove a member at any time; a member can leave at any time.
• Our team, only for support you request, security, or handling "card not found" reports.
• Our processors, bound by contract (GDPR, art. 28):

The marketplaces you connect (eBay) and the carriers tracking your parcels then process that data on their own behalf, under their own policies.

8. How long

The receipts book and the purchase register that Pokeback helps you keep are your records: if you are a sole trader, you must keep a copy. Export them before deleting your account.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability (GDPR, art. 15 to 22), and the right to set instructions on what happens to your data after your death.

• Access and portability: in the app, Account then "Export my data": an open JSON file with your profile, your collection, your costs, sales, trades and the references of your photos. On the web, the Account page gives a full JSON export with one CSV file per data type.
• Rectification: directly in the app or on the web.
• Erasure: in the app, Account then "Delete my account"; deletion is immediate. On the web, you can also delay it by 7, 14 or 30 days and cancel it during that period. Full steps: Delete your account. Deletion erases your account, all your data and files, your organisation (your members lose access, their own data stays intact), your tokens and your log. We keep only an anonymous record (dates and volumes, with no identifier or e-mail). Deleting the account does not stop a subscription bought on the App Store: cancel it in your Apple ID settings.
• Objection: in the app, the "Usage statistics" setting (Account, Data section, Privacy) and "Share my sale prices". Notifications are turned off in the iPhone settings.

For any request: privacy@pokeback.app. We reply within one month. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or the authority of your country.

10. Security

• Data hosted on a dedicated server at Hetzner Online GmbH, in Germany (European Union); encrypted connections (TLS).
• Per-user isolation enforced by the database itself (row-level security), tested automatically: a user can neither read nor change another user’s data, including through a direct API call.
• Files in private spaces, reachable by their owner and the members of their organisation only.
• Secrets (access tokens, invitation links) stored as hashes; eBay tokens and police register identities encrypted.
• Encrypted backups; rate limiting per user and per action.
• Optional app lock with Face ID or Touch ID.

11. Minors

Pokeback is intended for people aged 15 and over. Subscribing requires legal capacity to contract or the consent of a legal guardian.

12. Changes

We inform you in the app of any significant change to this policy before it takes effect. The last update date is shown at the top of this page.