Privacy Policy

Last updated: 30 July 2026

This policy explains what data Pikrmint (“we”, “us”) collects when you use the Pikrmint mobile and web apps and this website, how we use it, who we share it with and the choices you have. Questions or requests: support@pikrmint.com.

1. Data we collect

• Account data. Email address, username, an optional display name and a password (stored hashed, never in plain text). If you sign in with Google, we receive your email and basic profile from Google instead of a password.
• Scan photos. The photos you take of cards and slabs (front, back and detail shots). These are the core of the service — we store them so your collection has real images and results.
• Collection data. The cards you catalogue, values, the purchase prices you record, favorites, wishlist entries and portfolio history.
• Activity data. XP, achievements, challenges, streaks, follows and likes — the gamification and social features you use.
• Payment data. Web payments are processed by Stripe, Android purchases by Google Play, and iOS purchases by the Apple App Store. We never see or store your full card number; we keep provider transaction references, subscription status and the plan needed to run your account.
• Support messages. Emails you send to our support address.
• Technical data. Standard server logs (IP address, timestamps, requests) used for security and troubleshooting. This website sets no analytics or advertising cookies.

2. How we use your data

• To provide the service: identify cards, estimate market value, and keep your collection in sync across devices.
• To process payments and manage your plan's entitlements.
• To send transactional email, such as one-time password-reset codes.
• To keep the service safe: rate limiting, abuse prevention and debugging.
• To improve our AI — only if you opt in. Contributing scans to our recognition training data is controlled by an explicit, revocable consent toggle in the app. Without your consent, your scans are not used for training.

3. Who we share data with

We share data only with processors needed to run the service:

• Stripe — payment processing.
• Google Play and Apple App Store — in-app purchase processing and entitlement verification.
• Card-recognition partners (e.g. Ximilar). When our own pipeline can't confidently identify a card, the card photo may be sent to a specialist recognition API. Only the image is sent — never your name, email or account identity.
• Infrastructure providers — hosting, storage and email delivery.

Market pricing providers (such as Cardmarket and TCGplayer data sources) receive no personal data at all — price lookups are keyed by card, not by user. We do not sell your personal data.

4. What's public — and only if you choose

• Profile. Whether other collectors can find your profile is a toggle in Account Settings.
• Activity feed. Whether your milestones appear to followers is a toggle. Feed items never include the value of your cards.
• Leaderboards. Strictly opt-in. If you join, only your username and the board's metric are shown — never your full name or email.
• Shares. If you share a result card, that specific card's page is publicly reachable by its link. Sharing is always your action.

5. Retention and deletion

We keep account data while your account exists. Deleting your account (Account Settings → Delete account) immediately disables login, revokes sessions, removes direct profile identifiers and starts deletion of your uploaded media. Failed media deletion is retained as restricted cleanup work and retried instead of being reported as complete. Some non-public relational records may remain against the disabled internal record for integrity, fraud prevention or legal retention while we minimize them. Billing and tax records may be retained for the period required by law. Data can remain in encrypted backups until those backups expire.

Withdrawing AI-improvement consent or deleting the account removes traceable crowdsource contributions, feature objects and shared-index vectors. Each new derived vector carries a deletion source; legacy vectors without such a source are rejected and purged. How withdrawal applies to an already-trained model version is handled through our model-governance process.

6. Your rights

Depending on where you live (including under the GDPR), you have the right to access, correct, export and erase your personal data, and to object to or restrict certain processing. Most of this is self-service in the app (profile editing, data export, account deletion); for anything else email support@pikrmint.com and we'll respond within 30 days.

7. Security

Data is encrypted in transit (TLS everywhere), passwords are stored hashed, and access to production systems is restricted. No system is perfectly secure — if we learn of a breach affecting your data we will notify you as required by law.

8. Children

Pikrmint is not directed at children under 13, and where local law sets a higher age of digital consent (up to 16 in parts of the EU), that higher age applies. We do not knowingly collect data from children below these ages.

9. Changes to this policy

We'll post any changes here and update the date at the top. Material changes will be announced in the app.

10. Contact

Pikrmint — support@pikrmint.com