Privacy Policy – Scan2Deck
Last updated: 23 October 2026 · Deutsche Fassung (the German version is authoritative)
1. Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Enrico Willenbücher
Fritz-Thurm-Weg 43
10318 Berlin, Germany
Private, non-commercial software development.
Email: [email protected]
Support: [email protected]
Further provider details: Impressum / Kontakt & Anbieter.
2. Privacy contact
Privacy requests: [email protected]
3. Summary
- Scan2Deck works without an account. Without one, your collection, decks and binders stay on your device.
- Text recognition when scanning runs on your device. Only the recognised text, never the photo, goes to our server (section 6).
- With an account, your collection data is stored on our server and synced between your devices.
- Card images, where shown, are loaded directly by your device from TCGdex and pokemontcg.io, which receive your IP address (section 9).
- The app contains no advertising and no analytics, tracking or advertising SDKs. Data is not sold.
- You can delete your account in the app at any time (section 13).
4. Using the app without an account (guest mode)
Without signing in, the app stores your collection, wishlist, favourites, binders, decks and settings only on your device. None of it is sent to our server, except the card text recognised when scanning (section 6) and requests for public catalogue and price data, which contain nothing about you.
5. Account and sign-in
An account is optional. It backs up your collection, syncs it across devices and enables "Friends" and "Trading". You can sign in with:
- Email and password. We store the email address and a hash of the password (Argon2id), never the password itself.
- Sign in with Apple. Apple gives us a permanent anonymous Apple identifier and, the first time and only if you agree, your name and email address, which may be an Apple private-relay address.
- Sign in with Google. Google gives us a permanent Google identifier, your email address and possibly your name.
Signing in with Apple or Google happens at that provider under its own responsibility (Apple, Google). We never receive the password of those accounts.
Sessions. You stay signed in through a short-lived access token (30 minutes) and a refresh token (30 days). The refresh token is stored on the server only as a hash, together with a coarse device label ("iPhone" or "Android"), the app's user agent and timestamps. On the device it is kept in the operating system's keychain or secure storage.
Moving a guest collection. If you sign in on a device where you collected as a guest, that local collection is moved into your account and therefore transferred to the server.
6. Scanning cards
Scanning uses the camera or a photo you choose from your library. Text recognition (OCR) runs on your device with Google ML Kit. Only the recognised text is sent to our server – with the position of the lines on the card and the chosen card language – so it can match the card in the catalogue. The photo, a crop of it or any other image data does not leave your device when scanning. If no text is recognised in a photo, the app sends nothing.
- Without an account the text is only processed for matching and not stored; no scan record is created.
- With an account the recognised text, the result and the time are stored as scan history until you delete your account. No image is stored.
Older app versions also sent a photo of the card. Since 23 October 2026 our server disregards such a photo: it is not read, checked or stored, and is discarded when the request ends. The scan photos stored for signed-in users until then were deleted completely on 23 October 2026; copies in our backups are removed automatically as those backups expire, by 8 November 2026 at the latest.
On your device the app keeps the last twelve captures in its temporary storage. If you turn on keeping failed scans under More → Advanced → Scanner diagnostics (off by default), up to 20 such images are also kept locally. These images do not leave the device.
7. Collection, binders and decks
With an account we store what you create in the app: your cards with quantity, language, condition and variant, wishlist, favourites, marks and notes, your binders and which pocket holds which card, and your decks. This data is synced between your devices.
8. Friends and trading
- With an account you get a collector code (e.g. "S2D-XXXX-XXXX"). Anyone who knows your code can see your display name, initials and optional short bio. There is no search by name or email, and your email address is never shown to others.
- Your collection is private by default. If you choose, your friends can see it.
- We store friend requests and friendships, and trade offers with the cards offered and an optional message (up to 280 characters). Both sides of a trade see them.
- For accountability and security we log friend and trade actions (what happened and when, with internal identifiers). The log contains no email addresses, passwords or tokens.
9. Card images, card data and prices
Card images and set logos, where shown, are loaded directly by your device from:
- the TCGdex image service (
assets.tcgdex.net), and - for some cards without an image at TCGdex, pokemontcg.io (
images.pokemontcg.io).
As with any image loaded from the internet, these services receive your IP address, the address of the image and details of the app software. We do not send them any account data or identifiers. Their own policies apply to these requests. Our server can switch image display off centrally; the app then loads no images from these services.
Card data (names, sets, numbers) and market prices are fetched by our server from TCGdex, and exchange rates from the European Central Bank. These requests contain no data about you. Your device receives catalogue data and prices only from our server.
10. Text recognition with Google ML Kit
Text recognition uses Google ML Kit and runs on your device; the card photo is not sent to Google. ML Kit may, however, send Google technical usage and performance data (e.g. device model, operating system and app version, metrics about use and performance of the recognition feature). According to Google, this data is used to operate and improve ML Kit. We do not receive it.
On iOS, collector QR codes are read with Apple's on-device image recognition.
11. Hosting, Cloudflare and server logs
Our server is operated by a hosting provider in the European Union. The database and cache are not publicly reachable. Traffic to the app's API (api-scan2deck.willenbuecher.com) passes through Cloudflare, which processes your IP address and connection data (Cloudflare privacy policy).
Access logs. Our front web server logs requests to the app's API with time, requested address, status, the app's user agent, your device's IP address and the country determined by Cloudflare. The logs are size-limited (at most three files of 10 MB, shared by all services on the server) and continuously overwritten. There is therefore no fixed retention period; it follows from the volume.
Abuse protection. Sign-in attempts, guest scans and other public requests are rate-limited. Your IP address is held in a counter that expires after at most ten minutes.
Application error and operational messages contain no passwords, tokens or collection contents.
12. Retention and backups
| Data | Retention |
|---|---|
| Guest data | only on your device, until you delete it or remove the app |
| Account, collection, binders, decks, scan history (text and result), profile, friendships | until you delete your account |
| Sessions | refresh token valid for 30 days; revoked on sign-out, deleted with the account |
| Completed trades | remain visible to the other party; after your account is deleted, without any link to you |
| Log of friend and trade actions | kept; after your account is deleted, without your account identifier |
| Database backups | 14 days, then deleted automatically (daily run); older backups containing scan photos expire by 8 November 2026 at the latest |
| Access logs | size-limited, continuously overwritten (section 11) |
| Abuse-protection counters | at most 10 minutes |
13. Deleting your account
You can delete your account in the app at any time: More → Account & sign-in → Delete account (German interface: Mehr → Konto & Anmeldung → Konto löschen). This immediately and permanently deletes your account, collection, binders and decks, your scan history, your sessions, your collector profile, your friendships and the links to Apple, Google or your email sign-in. Open trade offers are cancelled. Copies in backups are removed within the 14 days stated in section 12.
Deleting your Scan2Deck account does not delete your Apple or Google account. You can remove Scan2Deck there yourself: for Apple in iOS Settings under your Apple Account, in the Sign in with Apple section, for Google at myaccount.google.com.
You can also request deletion by email to [email protected].
14. Legal bases and recipients
| Processing | Legal basis |
|---|---|
| Account, sign-in, sync, collection, binders, decks, friends, trading | Art. 6(1)(b) GDPR (providing the features you use) |
| Card recognition (recognised text) | Art. 6(1)(b) GDPR |
| Access logs, abuse protection, log of friend and trade actions, backups | Art. 6(1)(f) GDPR (legitimate interest in security and operation) |
| Loading card images from TCGdex and pokemontcg.io; Google ML Kit usage and performance data | Art. 6(1)(f) GDPR (legitimate interest in showing cards and in working text recognition) |
Recipients are our server's hosting provider and Cloudflare as technical service providers, Apple and Google for the sign-in you choose, Google for text recognition (section 10) and the image services in section 9. Data is not shared for advertising and not sold.
Transfers outside the EU. Cloudflare, Apple and Google are headquartered, or have their parent company, in the USA; data may be transferred to the USA. According to their own statements these companies are certified under the EU-US Data Privacy Framework. For TCGdex and pokemontcg.io, their own statements about their location apply.
15. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Much of this you can do directly in the app: your collection can be viewed and changed, and your account can be deleted. For anything else, write to [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live or where we are based.
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
16. This website (willenbuecher.com)
For visits to this website (not the app), the information on statistics with Plausible Analytics (self-hosted, no cookies) and on access logs in the Impressum / Kontakt & Anbieter applies. The app itself contains no statistics feature.
17. Changes
This policy is updated when the app's features or data processing change. The version published on this page applies; the date of the last change is shown at the top.