Legal
Privacy Policy
Chase scans Pokémon cards, prices them, and keeps your collection. This page explains exactly what that involves for your data. It describes what the app actually does — not a generic template.
Chase does not sell your data, does not show ads, and contains no analytics or tracking of any kind. There are no third-party scripts in the app.
What is stored about you
| Data | Why | Where |
|---|---|---|
| Email address | Signing in, and resetting a forgotten password | Supabase |
| Password | Signing in. Stored hashed — never in readable form, and never visible to us | Supabase |
| Handle and banner colour | Your display name in the app | Supabase |
| Your collection | The cards you have scanned, their quantities and condition, so the collection follows you to another device | Supabase |
| Number of scans used | Counting against the free allowance | Supabase |
| Subscription status | Knowing whether Pro is active | Supabase |
Card photos
When you scan a card, the photo is sent to Anthropic's API so the card can be read and identified. Chase never writes your photos to disk and does not keep them. The photo exists only for the moment it takes to identify the card, and then it is gone. Anthropic's handling of API data is governed by their own commercial terms.
Only the resulting card identity — name, set, number — is stored, as part of your collection.
Who else receives data
- Supabase — hosts the accounts database and your collection.
- Anthropic — reads the card from your photo, as described above.
- Scrydex — the card database and prices. Card identities are looked up here; nothing about you is sent.
- Apple — if you subscribe, Apple handles the payment. Chase never sees your card details. Apple tells us only that a subscription exists and when it renews.
- Frankfurter — public exchange rates for the currency switcher. No personal data is sent.
Your device
The app keeps a copy of your collection in your browser or device storage so it works
offline and feels instant. Signing out removes it. The app also stores a session cookie so
you stay signed in; it is marked HttpOnly and Secure, so it cannot
be read by scripts and is not sent over an unencrypted connection.
IP addresses
Your IP address is used briefly to limit how many scans can be run from one place, which stops the service being abused. It is held in memory only, for at most a day, and is never written to a database or linked to your account.
Deleting your account
You can delete your account from inside the app, under Profile. This is immediate and permanent: your account, your collection, and everything attached to it are removed. There is no soft delete and no recovery, so please be sure.
Children
Chase is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact us and it will be removed.
Changes
If this policy changes, the date at the top changes with it. Material changes will be announced in the app rather than made quietly.
Contact
Questions, or a request to see or delete your data: hello@chasecard.xyz