Privacy policy
In force since 1 September 2026.
The short version
Zukan has no account to create, shows no advertising, embeds no analytics or tracking SDK, and never uploads the photos you scan. Your collection lives in a database on your own phone. The only personal data that reaches anyone is your purchase status, which Apple or Google tells us so the app knows whether you are subscribed.
Who is responsible
Zukan (the "app") is published and operated by [LEGAL NAME AND POSTAL ADDRESS OF THE PUBLISHER — to be completed before publication], the data controller for the purposes of the GDPR. You can reach us at support@getzukan.com.
What stays on your device
Everything that makes up your collection is stored locally, in a database on your phone:
- the cards you own, their quantities, conditions, and the price you paid;
- your scan history and any scan that failed to identify a card;
- your settings — language, currency, display preferences;
- the local backups the app writes for you, and any CSV you export.
None of it is sent anywhere unless a section below says otherwise. Settings → Data → Erase all data deletes it, and deleting the app deletes it too.
Your camera and your photos
Zukan asks for camera access for one purpose: reading the text printed on a card. The recognition runs on your device, using the text-recognition engine built into iOS and Android. The image is analysed in memory and discarded — it is not saved to your photo library, not sent to us, and not sent to any third party.
A cloud-assisted recognition fallback exists in the source code for development builds only; it is disabled at compile time in every build distributed through the App Store or Google Play, and no image can reach it.
What leaves your device
Card data and prices
To identify a card and price it, the app queries card catalogues and price sources (currently TCGdex and pokemontcg.io) and Zukan's own backend. These requests carry the card reference being looked up. They carry no identifier of you, and no content of your collection.
Backup and sync
When cloud backup is active in your build of the app, Zukan creates an anonymous account on our backend (hosted on Supabase, in the European Union) the first time it runs. Anonymous means literally that: a random identifier is generated on the device, and no email address, no name, no password and no phone number is asked for or stored. That account holds a mirror of your collection, your daily scan counter, and whether you are subscribed — nothing else. It exists so a reinstall does not cost you your collection.
Purchases
Subscriptions are sold and billed by Apple or Google, and managed through RevenueCat. We never see, receive or store your payment method, your card number or your billing address — the stores do not give them to us. What we receive is whether a subscription is active, and until when. Under the App Store privacy labels this is Purchase History, collected, not linked to your identity and not used for tracking.
If you write to us
If you email support, or use the app's "Report a missing card" button, we receive your email address and whatever you write. We use it to answer you, and we keep the exchange no longer than we need to.
What Zukan never does
-
No advertising, anywhere in the app, and no advertising identifier — the Android
AD_IDpermission is stripped from the build. - No analytics SDK, no crash-reporting SDK, no third-party tracker.
- No sale of data, no sharing of data with advertisers or brokers. There is nothing to sell.
- No cross-app or cross-site tracking, and therefore no App Tracking Transparency prompt.
- No profiling and no automated decision-making with legal effects.
Legal basis and retention
| Data | Why | Kept for |
|---|---|---|
| Collection, scans, settings | Performance of the service you asked for | Until you erase it or delete the app |
| Anonymous backup mirror | Performance of the contract | Until deletion is requested; inactive accounts are purged |
| Purchase status | Performance of the contract — knowing what you paid for | Duration of the subscription plus the legal accounting period |
| Support emails | Legitimate interest in answering you | Up to 12 months after the exchange ends |
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to its processing. Most of it you can exercise yourself, immediately, without asking anyone: Settings → Data → Export collection (CSV) is portability, and Settings → Data → Erase all data is erasure.
For the server-side backup mirror, write to support@getzukan.com from the device concerned and we will delete it. Because the account is anonymous, we have no way to find your data from an email address alone — we will tell you what we need. You may also lodge a complaint with your national supervisory authority; in France, the CNIL.
Children
Zukan is a general-audience app. It asks for no personal information from anyone, of any age, and creates no profile. We do not knowingly collect personal data from children, and there is no mechanism in the app by which a child could supply any.
Transfers outside the EU
The backup backend is hosted in the European Union. Apple, Google and RevenueCat are United States companies and process purchase data under their own terms and the European Commission's standard contractual clauses.
Changes
If this policy changes, the date at the top changes with it. A change that materially affects what we collect will be announced in the app before it takes effect.