Privacy policy

Last updated 14 October 2026. See also our terms of use.

Hey Cardboard is an app for scanning, pricing and trading collectible cards. This page says what it collects, who else sees it, how long it is kept and how to get rid of it. Questions go to deon@oh8digital.co.za.

What we collect

• Your account. Your email address and a password. We store a hash of the password, never the password itself.
• Your profile. The display name, handle and bio you choose. Profiles are public by default, and you can make yours private in Settings. If you never set a display name, you appear as "Collector". Your email address is never shown to other people.
• Your collection. The cards, sealed products, wishlist, decks, price alerts and notes you add, and a daily record of what your collection is worth.
• What you post. Pulls, trades, captions, comments, likes and who you follow. Posts are visible to everyone using the app.
• Photos you choose to save. Condition photos you attach to a card, and the photo you take for a grade check.
• Your answers to the intro questions, such as what you collect and how big your collection is.
• Your subscription status, which plan you are on and when it renews. Apple handles payment; we never see your card details.
• A push notification token, if you allow notifications.
• Reports and blocks you make, including a copy of the reported text.

We do not use advertising identifiers, we do not track you across other apps or websites, and the app contains no analytics or advertising SDKs.

Scanning and photos

When you scan a Pokémon card, the camera image is read on your phone. Only the text read from the card, such as its name and number, is sent to our servers to find the matching card. The scan photo itself does not leave your phone.

Sports cards carry too little printed text to identify that way, so when you scan a sports card, the photo of the card is sent through our servers to an AI model that reads the player, year, set and card number. The photo is used only to identify the card and is not kept by us after the scan.

A grade check is different. The photo is uploaded so the corners and edges can be measured, and it is deleted when you leave the screen, with two exceptions:

• If you tap identify, the photo is sent to an AI model to recognise the card, the same way a sports card scan is.
• If you move the corner guides because we placed them wrongly, we keep that photo and the corrected corners to improve corner detection. It is not shown to anyone else. There is no switch for this in the app yet; email us to opt out and we will delete what we hold and stop keeping new ones.

Screen recordings you make in the app stay on your phone and are saved to your Photos. They are never uploaded.

Who else receives data

• Convex hosts our database and file storage, in the EU (Ireland).
• Apple and RevenueCat process subscriptions. RevenueCat receives an account id so it can tell us which plan you are on.
• Vercel AI Gateway passes the text read from a Pokémon scan to an AI model that picks the matching card, passes card names to price-checking models, and passes sports card photos (and grade-check photos when you tap identify) to an AI model that reads them. No account details are sent with any of these.
• The Card API supplies recent sold prices for sports cards. It receives card names and numbers, nothing about you.
• Resend sends the code when you reset your password. It receives your email address and nothing else.
• Expo delivers push notifications. A notification can include the name of the person who liked or commented and the text of the comment.
• Price sources such as TCGplayer, eBay, PriceCharting and the Pokémon TCG API receive card names and numbers. They receive nothing about you.

We do not sell your data and we do not share it for advertising.

How long we keep it

We keep your data while you have an account. Grade-check photos are deleted when you leave the screen unless one of the exceptions above applies.

Deleting your account

In the app, open Settings and tap Delete account. Your login and public profile are removed straight away, and your collection, photos, posts, comments, likes and follows are deleted shortly after. Two things stay: completed trades, because they are the other person's record as well as yours, and reports other people made about content you posted. Deleting your account does not cancel an App Store subscription; cancel that in the Settings app under your Apple ID.

You can also email deon@oh8digital.co.za to ask for a copy of your data, to correct it or to have it deleted.

Reporting and blocking

You can report any post, comment or profile, and block anyone. We review reports within 24 hours and remove content that breaks the rules. Blocking hides you and the other person from each other.

Children

Hey Cardboard is not meant for children under 13, and we do not knowingly collect data from them. If you think a child has an account, email us and we will delete it.

Changes

If this policy changes, the date at the top changes with it. If a change affects what we do with data you have already given us, we will tell you in the app first.