Privacy Policy

Last updated: October 20, 2026

Eric Sabaté operates CARDEX and gocardex.com and is responsible for the processing described here. Privacy contact: hello@gocardex.com.

1. Information We Collect

  • Account data: registration requires your email address, username, display name and password to create and protect your account. Your display name can be an alias; a legal name is not required. Passwords are stored as hashes.
  • Collection data: Cards, sealed products, purchase prices, quantities, and conditions you add to your collection.
  • Mobile product-usage data: The iOS and Android apps collect screen templates visited, time per screen, session lifecycle, successful feature actions, app version, platform, operating-system and device properties, locale, time zone, an anonymous device identifier, and standard network data such as IP address.
  • Analytics exclusions: We do not send the analytics provider usernames, email addresses, message content, photos, raw searches, card or listing identifiers, or purchase prices.
  • Subscription data: If you use Cardex PRO, the purchase flow uses RevenueCat and the relevant app store. RevenueCat receives an opaque Cardex user ID to associate subscription access with your account. RevenueCat and the app stores may process store receipts and transaction metadata needed to validate, restore, and manage access.
  • Device preferences: Settings such as language, currency, and colour scheme may be stored locally on your device.
  • Profile and content: you may edit your display name and add a biography, avatar and country, save decks and searches, publish posts and listings, send messages and join the community. We process this content to provide the requested features; material you publish or send is visible to its audience or recipients.
  • Photos and AI: photos you select for scanning or AI condition estimates are sent to the CARDEX API and OpenAI through the Replit integration. Structured results are saved in your history; listing photos are stored in App Storage and avatars in your profile. We do not promise that providers process images without retention.
  • Marketplace and location: you may provide a city and approximate location for nearby listings. We also process listing prices, offers, acquisition costs and collection values. CARDEX does not collect payment-card numbers or payment credentials.
  • Notifications: if enabled, we process a device push token and your preferences; Expo Push receives the token and content needed to deliver notifications. You can disable them in app or system settings.
  • Technical data: infrastructure processes IP addresses and request/error logs to operate and secure the service. PostHog may infer approximate location from IP. Operational logs are separate from optional product-analytics events.

2. How We Use Your Information

  • Authentication: Account data is used to create your account and verify your identity when you sign in.
  • App functionality: Collection data is stored on our servers so the Service can save and retrieve your inventory.
  • Service improvement: Technical logs and mobile product-usage data help us understand adoption, funnels and retention, prioritize improvements, and fix performance problems.
  • Processing purposes and basis: data needed for requested features, accounts and subscriptions is processed to provide the service. Optional analytics and advertising measurement use consent where applicable. Security logs and legally required records support service protection and applicable legal obligations.

3. Data Sharing

  • We do not sell your personal data. We share information with the providers described below to operate the Service and, if you allow it, measure advertising.
  • Database and hosting providers: We use infrastructure providers to store your account and collection data.
  • Analytics providers: PostHog may be used optionally for the mobile product-usage data described above. You can opt out of product-usage analytics in the app settings. Billing-analytics events that CARDEX sends to PostHog use only the limited, allow-listed metadata described in the app's subscription flow; they do not include your email, Cardex user ID, receipts, payment details, or free-form content.
  • Authentication providers: We use secure third-party services to handle sign-in emails and session tokens.
  • Subscriptions: Apple and Google process store purchases and recurring billing. RevenueCat supports subscription entitlement and restore flows using your CARDEX account identifier and purchase and transaction records. Cardex does not receive or store your payment card details.
  • Law enforcement: We may disclose data if legally required by valid requests from public authorities.
  • Other operational providers: Replit hosting, database and App Storage; OpenAI through Replit for scan/grading images; Resend for transactional email; Expo Push for notifications; PostHog for analytics; RevenueCat and the stores for purchases. Providers may process data in other countries under their applicable terms and safeguards. Operational processing is distinct from selling data or using it for third-party advertising.

4. Optional Ad Measurement (Meta)

  • On iOS, starting with CARDEX 1.0.6, optional ad measurement uses the Meta SDK only after you allow it. Meta receives app activation and session events and technical app, device and connection data, such as app version, operating system, permitted device identifiers and standard network data. The SDK can also process diagnostic data. This helps measure the effectiveness of CARDEX campaigns; data may be associated with device identifiers and combined with other data by Meta for advertising measurement.
  • On iPhone, access to the advertising identifier (IDFA) also requires permission through Apple App Tracking Transparency. Declining measurement does not block CARDEX features. You can change your choice in Settings > Privacy & Visibility > Ad measurement. Turning measurement off stops future activations from this integration; it does not itself delete information Meta has already received.
  • This integration does not send Meta your email address, card photos, messages or purchase amounts. Automatic purchase logging, event suggestions and advanced matching are disabled. Product-usage analytics with PostHog and subscription processing with RevenueCat are separate from this optional integration.
  • Meta processes information under its applicable privacy policy and business-tool terms. For more information, see https://www.facebook.com/privacy/policy/. Contact hello@gocardex.com for privacy questions or requests.
  • Android build 1.0.6 (4) does not include this native Meta integration. An ad linking to App Store does not itself add a Meta SDK to Android.

5. Your Rights

  • You can access the data we hold about you by viewing your account and collection within the app.
  • You can request account deletion in Settings or at https://gocardex.com/delete-account. This covers your profile, collection, decks, alerts, scan/grading history, listings, photos and associated messages, not other people's independent contributions. Listing-photo deletion uses a retry queue; we do not promise instantaneous deletion of every object.
  • On Android 1.0.6 (4), PostHog product analytics is off by default and your choice can be changed in Settings. Older versions may behave differently; update to obtain this control. Stopping future collection does not delete data a provider already received; you can request deletion by email.
  • Deleting your Cardex account does not cancel an Apple App Store or Google Play recurring subscription. Cancel or manage the subscription through the relevant store before deleting your account.

6. Website analytics and cookies

  • Only after you accept website analytics, Google Analytics receives page categories, general referral origin, technical browser and connection data, and App Store button clicks. Query strings, form fields, raw searches, photos, account details and private sharing routes are excluded. App Store clicks are not installations. Advertising signals and personalized advertising are disabled for this integration.
  • Google Analytics uses first-party _ga cookies to distinguish browser visits; we configure a maximum lifetime of 180 days. We store your consent choice locally for up to 180 days. Before acceptance, or after declining, the Analytics script is not loaded. The Cookies control lets you change your choice or withdraw consent; withdrawal stops future collection and removes this site's Analytics cookies but does not itself erase data already received by Google.
  • Google processes data under its privacy policy: https://policies.google.com/privacy. Google may process data outside your country, including the United States, subject to applicable safeguards. For visitors in the EU, Switzerland and the UK, Google states that Analytics does not log or store individual IP addresses. Outside those regions, Google uses IP addresses for basic service functions. Technical network data are processed to deliver the service. Analytics is optional and based on consent. You may contact hello@gocardex.com to exercise access, deletion or other applicable data-protection rights, or complain to your supervisory authority.
  • Download links include Apple's provider and campaign tokens so App Store Connect can report aggregate downloads attributed to the website, subject to Apple's attribution windows, delays and privacy thresholds. This is separate from Google Analytics and from Meta advertising. Necessary language preferences and hosting security logs remain separate from optional analytics.

7. Retention and requests

  • Account data and content are kept to provide the service while your account remains active or until you request deletion. Apple, Google and RevenueCat purchase records are managed separately and may need to remain for restoration, fraud prevention or legal obligations. Account deletion does not cancel PRO.
  • Retention of analytics, AI-processed images, backups and technical logs depends on each provider's effective settings and terms. We have not established one universal 90-day period or a zero-retention guarantee. When handling a request we will explain applicable exceptions and the relevant period. Contact hello@gocardex.com for access, correction, deletion or consent withdrawal; you may also complain to your data-protection authority.

8. Contact

  • If you have questions about this Privacy Policy, please contact us at hello@gocardex.com.