Privacy policy

Who we are

pepita is published by Mathis Grosjean, who is the data controller. For any question, email support@pepitacards.com.

Data we collect

When you use Sign in with Apple or Google, we receive and retain the account identifier supplied by that provider and, when shared, your email address. This data is used to manage your account and support conversations. The authentication token is kept in secure storage on your device.

When you scan a card, the photo is sent to our server and then to Ximilar, our image-recognition provider, to identify the card. The photo is not stored. We retain only a digital fingerprint (hash), the identified card and technical scan metadata such as image size, outcome, confidence and processing times.

The app creates a persistent installation identifier to enforce anti-abuse limits. We also process the IP address and rate-limiting signals. This data is not used for advertising or tracking.

PostHog processes limited usage statistics: app opens, scans, cards added, features viewed, action outcomes and duration, an installation-specific identifier, app version, device model and type, operating system, language and time zone. IP-based geolocation, screen recording and session replay are disabled.

Your card collection is stored locally on your device. It is not stored in a server profile.

When you join the Pepita Market Weekly launch list, we retain the email address entered, language, signup surface and consent date. No newsletter is sent before a confirmation process is introduced.

On pepitacards.com, Vercel Web Analytics anonymously measures visits and pages viewed. It processes the URL, referring site, country, device type, browser and operating system. It does not use cookies and does not retain your IP address or an identifier that can recognise you.

How we use data

We use this data to authenticate your account, identify a scanned card, display its card sheet, estimate its value and track its value in the app. An address submitted to Pepita Market Weekly is used only to prepare and later confirm that newsletter.

We do not use your data for advertising, sell it or track you across apps or websites. App statistics help us measure and improve usage. Anonymous website statistics are used only to understand site traffic. We use no advertising or analytics cookies.

Sharing with service providers

Apple and Google provide the corresponding sign-in services. Ximilar receives the card photo temporarily to perform image recognition. Cardmarket and PriceCharting provide card price data; they receive no personal data.

Supabase, Fly.io and Vercel provide database, API and website infrastructure. They receive only the data required to provide these services. PostHog processes the limited app statistics described above in the United States. Vercel provides anonymous website analytics.

Retention and deletion

Card photos are not retained. Account data, digital fingerprints and scan metadata are kept while your account is active or for as long as necessary to provide the service.

A Pepita Market Weekly pre-registration is retained until it is confirmed, withdrawn or the project is abandoned. You can request deletion at support@pepitacards.com.

The anonymous identifier used by Vercel Web Analytics is renewed every day. Aggregated statistics are retained for the reporting period provided by our Vercel plan.

App statistics are retained only for the configured reporting period. The installation identifier is deleted from the device when the app is uninstalled.

You can delete your account and its scans at any time in the app through Réglages → Supprimer le compte. This also removes the local data for that account from the device. You may also revoke pepita in your Apple or Google account settings; the app does not retain a provider token that can revoke that authorization for you.

Your rights under the GDPR

You may request access to, correction or deletion of your data, or object to certain processing, within the limits provided by the GDPR.

To exercise these rights, email support@pepitacards.com.

Children

pepita is not intended for children under 15. If you believe a child has sent us data, contact us to request its deletion.

Changes and contact

If this policy changes, we will publish the new version on this page with an updated revision date.

For privacy or support questions, email support@pepitacards.com or visit Support.