This policy explains what happens to information when you use the Rarex iOS app (the app) and this website (the site), both operated by Rarex (we, us). It is written to be read, not to be survived — if anything in it is unclear, email support@rarex.app and we will explain it.
The short version
- There is no account, no sign-up and no password. We do not know who you are.
- Your collection is stored in the app's own storage on your device. We never receive a copy.
- Camera frames are processed on the device by Apple's Vision framework. Photos of your cards are not uploaded to us or to anyone else.
- To identify a card and price it, the app queries a third-party card database over the internet. Those requests carry the text read off the card and, like any internet request, your IP address.
- There are no advertising SDKs, no analytics SDKs and no third-party trackers in the app.
What is processed, and where it lives
| Information | Where it is stored | Why |
|---|---|---|
| Camera frames and any photo you choose to import | In memory on your device while a scan runs; a card image you save is kept in the app's storage on the device | To detect, straighten and read the card in front of the camera |
| Your collection: cards, quantities, conditions, notes, purchase details and observed price history | The app's local database on your device, included in your encrypted device or iCloud backup if you have backups enabled | To show your collection and what it is worth |
| App preferences, such as the games you follow and whether onboarding is complete | Local app settings on your device | To keep the app configured the way you left it |
| Card lookups: the name, collector number and set text read off a card, plus your IP address as the sender of the request | Sent to the Pokémon TCG API; not stored by us | To identify the exact printing and retrieve its market price |
| Website request logs: IP address, browser user agent, page requested, timestamp | Held briefly by our hosting provider | To keep the site online, secure and working |
| Anything you write to us by email | Our mailbox | To answer you |
What we do not collect
The app does not ask for and does not collect your name, email address, phone number, postal address, date of birth, precise location, contacts, health data, advertising identifiers or device fingerprints. We do not build a profile of you, we do not track you across apps or websites, and we never sell or rent personal information — there is nothing to sell. This is why the App Store privacy label for Rarex reports that no data is collected from the app.
Camera and photo library
The app asks for camera access the first time you open the scanner. Frames from the camera are analysed on the device — card detection, perspective correction and text recognition all run locally using Apple's on-device Vision framework — and are discarded as soon as the analysis is done. The app never starts a capture by itself; a picture is only kept when you press the shutter.
Photo library access is optional and only requested if you choose to identify a card from an existing photo. The app reads the image you pick and nothing else in your library. You can revoke either permission at any time in Settings → Rarex on your iPhone; the rest of the app keeps working, but scanning needs the camera.
Notifications
If you allow notifications, they are scheduled on your device — there is no push server and no device token is sent to us. Declining costs you nothing else in the app, and you can change your mind in iOS Settings.
Third parties
Pokémon TCG API
Card data and market prices come from pokemontcg.io. When the app looks up a card, it sends the text signals read off that card. It does not send your photo, your collection or any identifier of you or your device. As with any internet request, the service can see the IP address the request came from. Its own privacy practices are governed by its policies, not ours.
Apple
The app is distributed through the App Store. Apple provides us with anonymous, aggregated download and usage statistics, and — only if you opted in to sharing diagnostics with developers in iOS Settings — anonymised crash reports. Any future in-app purchase would be handled entirely by Apple; we would receive no payment card details at any point.
Website hosting
This site is served by a hosting provider that keeps short-lived request logs for security and reliability. The site loads a web font and no third-party analytics, advertising or social widgets. The only cookie it may set is the strictly necessary session cookie issued by the web framework; it carries no identity, is not used for tracking, and expires on its own.
Keeping and deleting your data
- Individual cards can be deleted from the collection at any time.
- Everything at once can be cleared from the data management section in the app's Settings.
- Deleting the app removes its local database, cached card images and preferences from your device.
Because the data never reaches us, there is no copy on our side to delete. If you have an encrypted device or iCloud backup that includes the app, restoring it will restore the collection — deleting those backups is managed by you in iOS Settings. Email correspondence is kept only as long as needed to deal with your query.
Security
Network requests use HTTPS. Data on your device is protected by iOS file protection and your device passcode, and the app stores no credentials because it has none. No system is perfectly secure, but keeping your collection off the internet removes the risk that a breach of ours could expose it — a server that does not exist cannot be breached.
Children
Trading cards are popular with children, and Rarex is designed with that in mind: it collects no personal information from anyone, of any age. It is not directed at children under 13 and we do not knowingly gather data from them. If you believe a child has sent us personal information by email, write to support@rarex.app and we will delete it.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to or port your personal data, and to complain to a supervisory authority. In practice your collection is already entirely in your hands: you hold it, you can edit it, and you can erase it without asking us.
Where we do process limited personal data — server logs and email correspondence — we rely on our legitimate interest in operating a secure service and in answering people who contact us. To exercise a right, email support@rarex.app. We will respond within the time your law allows, and we may ask for enough detail to locate the relevant records.
If you are a California resident: we do not sell or share personal information as those terms are used in the CCPA/CPRA, and we do not use personal information for cross-context behavioural advertising. You will never be discriminated against for exercising a privacy right.
International transfers
The card database and our hosting provider may be located outside your country, including in the United States. Where personal data such as an IP address is transferred, it is done under appropriate safeguards and only to the extent necessary to serve your request.
Changes to this policy
If this policy changes in a way that matters, the date at the top of the page changes with it, and a material change affecting how the app handles your information will be flagged in the app or the release notes. Continuing to use Rarex after a change means you accept the updated policy.
Contact
Privacy questions, requests and complaints: support@rarex.app.
Questions about this document?
Write to support@rarex.app and you will get a reply from a person.