Cimela is a Pokémon card collection tracker. This is the short, honest version of what we collect and why.
By default your collection lives on your device. If you never make an account, your cards are not sent to our servers. Your Nearby location (a ZIP code, a city, or “use my location”) is saved on your device only and is never part of your cloud backup.
If you sign up or sign in (username & password, or Sign in with Apple/Google) we store your username, display name, an auto-generated friend code, and your synced collection (your cards, want list, binders, what you paid or sold cards for, and your settings) so you can back it up and use it across devices. Passwords are kept only as a salted hash, never in plain text. With Apple/Google we store the sign-in identifier they give us and your email. If you add an email, we use it only to identify your account and to send password-reset codes. If you turn on notifications, we store your device’s push token and which alerts you want.
When you scan a card, the photo is sent to our recognition provider (CardSight) to identify it. Photos of successful scans are not kept. If a scan fails, we keep that photo for up to 48 hours so we can see what went wrong and improve the scanner, then it is deleted automatically. For failed scans we also keep a short note of what the scanner saw (no photo), tied to your account or a random app ID.
Photos you choose to add (a profile picture, store photos, vendor table or stock photos, show flyers, table maps) are stored on our servers and shown where you added them, which may be public. Photos are resized on your phone before upload, which also removes hidden location data.
If you claim a store, we store the details you give us (name, address, contact email and phone, website, social links, hours) and an optional verification photo that only we see. Approved store details are shown publicly in the app.
If you sell at a show, your vendor profile (name, Instagram handle, what you sell, payment types you accept), your stock list with prices and photos, and your table are public to collectors. Your sales log is private to you. Show organizers see who joined their show, table numbers, how many items each vendor lists and when stock was last updated.
If you apply as an organizer, we use the details you send (name, Instagram, contact details, shows) only to verify you and set up your account.
When you type a ZIP code or city, our server looks it up with OpenStreetMap; the lookup is cached without anything that identifies you. If you choose “use my location”, distances are worked out on your phone and your location is not sent to us.
Card details, images and prices come from third parties (Pokémon TCG API, TCGdex, PokemonPriceTracker, TCGCSV, Scrydex). Looking up a card sends its name or number to those services, never your personal data.
We record which features you use (for example scanning, saving a show or opening a set) and when you last opened the app, tied to your account or a random app ID. We use this to see what works, fix problems, and, if you have notifications on, to send an occasional check-in when you haven’t opened Cimela in a while (you can switch these off in Settings). Our servers also briefly process your IP address to prevent abuse and rate-limit requests.
When you send a bug report or report a problem with a card, we store your message with your username so we can follow up.
If you add friends or make your collection public, what you choose to share (display name, cards marked for trade, a rounded value band) becomes visible to them. Your exact total is hidden from others by default, and you can turn public sharing off any time.
Some links (e.g. eBay) are affiliate links; we may earn a commission at no extra cost to you. The link carries our campaign ID, not anything about you. Those sites have their own privacy policies.
We don’t sell your personal information, show third-party ads, or track you across other apps and websites.
You can delete your account in Settings. That permanently removes your account, synced collection, friends and trades, vendor profile, stock, photos, sales log, store claims, saved shows, and your usage and scan records from our servers. Bug and card reports you sent are kept without your name. Deleting the app clears the data on your phone.
Cimela isn’t directed to children under 13 and we don’t knowingly collect their information.
Cloudflare (hosting & database), CardSight (card recognition), Pokémon TCG API / TCGdex / PokemonPriceTracker / TCGCSV / Scrydex (card data, images & prices), OpenStreetMap Nominatim (ZIP & city lookups), Apple/Google (optional sign-in), Apple Push Notification service (notifications), eBay Partner Network (affiliate links).
We may update this policy; we’ll change the date above when we do.
Questions? Email benderei24@gmail.com.