Privacy Policy

Effective October 27, 2026

This policy explains what information the Arcane Ledger app collects, why, and what happens to it. The short version: we collect what the app needs to work, we don't run ads, and we never sell your personal information.

Information you give us

• Account. If you create an account, we store your email address and a securely hashed password (handled by our backend provider, Supabase) so you can sign in, recover your account, and restore your collection on a new device.
• Profile. An optional display name and an auto-generated friend code, used for the Playgroup features.
• Your collection. The cards you add (names, printings, conditions, quantities, prices paid). Every install of the app signs in automatically as an anonymous guest, and a guest's collection is backed up to our cloud too. Adding an email to that account is what lets you restore it on another device, and it also turns on the friend features (like shared-deck matching and trade suggestions).
• Decks, wishlist and game history. The decks you import or build (with each deck's change history), your wishlist, the games you log at the Game Table, and each binder's value history (its daily value and a record of the cards added each day) are also backed up to our cloud, guests included. Adding an email is what lets you restore them on another device.
• Deals. If you use Buy, Sell or Trade mode, each completed deal is saved on your phone and backed up to our cloud, unless the account is a guest, so you can restore your deals on another device. A deal records when it happened, whether it was a buy, a sale or a trade, and your shop name. For each card or sealed product in it, it records the name, the card's set, number, condition and finish, the quantity, the price and its percent of market, what you paid and your profit where the app knows them, and the binders your cards came from. It also records the subtotal, the tax and its rate, the total, how it was paid, a trade's two sides and the difference, how many copies weren't found in your binders, and any private note you added, which a Buy or a Trade also keeps on each card it adds to your collection. A deal has no place for a customer's name or email address. When you send a receipt, you choose who gets it in your own email or messaging app, and that address is never sent to us or saved in the app. Backed-up deals are kept while your account is active and deleted when you delete your account.
• Messages. Direct messages you send to friends in Playgroup are stored so they can be delivered, and are visible only to you and the recipient. Messages you send in a group chat are stored the same way and are visible to the group's members, each of whom sees the messages sent since they joined. Like direct messages, they are kept while your account is active and deleted when you delete your account. A group's messages are also deleted when the group is deleted or its last member leaves. If you report a message, we keep a copy of that one message, with who sent it and who reported it, and nothing else from the conversation. A reported message is kept until we review it, even if its sender deletes their account. You can block users at any time.
• Community submissions. Decks you submit to the Community tab, with your display name, shown publicly after moderator approval.

Card scanning

Card recognition runs on your device by default. Camera frames are read locally and are not uploaded. An image of the card being scanned is sent to our image-recognition partner (Ximilar) in three cases. The first is when premium exact-printing matching refines a scan. The second is when you tap the photo-identification option on a card the on-device reader couldn't make out (available on every tier; without Curator it has a daily allowance). The third is when Auto-scan isn't sure about a card and the app's other checks can't identify it either. Auto-scan then sends a photo of that card without a tap, and without Curator it counts toward the same daily allowance. Once that allowance is used up, Auto-scan sends no photo and sets the card aside instead. The image comes from your camera or, in the first two cases, from a photo you chose to import from your gallery. For premium matching and Auto-scan the image is resized before it is sent. For photo identification a photo from your gallery is resized too, while a photo taken with your camera is sent at the resolution the camera took it, usually cropped to the card. It goes through our own server, which forwards only the image. In all three cases Ximilar processes the image solely to return a result and does not store it, and neither we nor Ximilar use your scans to train models. We don't keep the image either. It's deleted right after the scan, with one exception. If the scanner can't identify a card, its photo stays on your phone, up to 20 photos at a time, until you identify the card or remove it, so Identify by photo can use it. It only leaves your phone if you use Identify by photo.

Rue (AI advisor) and the other AI features

Rue, AI Insights, Deck Request and Translate use an AI service run by our AI provider, Anthropic, to generate answers. When you use one of them, the app sends Anthropic what you ask, a summary of your collection (card counts by color, type and rarity), your deck preferences and saved decks, relevant card data, and any text you ask it to translate. Anthropic uses this to generate the answer.

Nothing is sent until you agree. The first time you use an AI feature, the app explains what is sent and asks you to Agree or choose Not now; Not now sends nothing, and the rest of the app works without it. You can withdraw at any time with the "AI features (Anthropic)" switch in Settings, which stops all further sending at once. Don't put sensitive personal information in chat messages; it's a deck advisor, not a diary.

Reporting an answer. If you tap "Report this answer", we keep that answer, what you asked, and which feature it came from, so we can review it. A report is kept until we review it; if you delete your account, the report stays for review without your account attached.

Collected automatically

• Push token. If you allow notifications, a device push token is stored so the app can deliver them (deck alerts, price watch alerts, friend and group messages, community updates, and a reminder before a Curator free trial or an Attic Pass ends). We also store the language your app is set to, so reminders arrive in it, and the end date of the last trial and of the last pass a reminder was due for, so no reminder is sent twice.
• Device identifier. A device ID is checked when starting a free trial, used only to prevent repeat-trial abuse.
• Card data requests. Card information and prices come from Scryfall. Our servers keep a copy of the card prices Scryfall publishes, and the app asks our servers for your cards' prices from that copy first, signed in as your account, the same way it backs up your collection. For anything the copy can't answer, and for all other card information, the app asks Scryfall's public API directly; those requests carry standard technical information (like any web request) but no account data. Sealed-product prices come from JustTCG, fetched once daily by our servers. The app on your device never contacts JustTCG.
• Usage events. The app records basic usage events (for example, that the app was opened or a deck was generated) with your app version and platform, so we can tell which features are working. These are tied to your account, never sold or used for advertising, deleted automatically after 180 days, and deleted immediately when you delete your account. Some usage events also record how many cards an action covered, or which export format or search box was used. They never record which cards, any price, or anyone's personal details. Separately, the app keeps a running total of the time you've spent in it for as long as your account exists, used only to understand how the app is used, never sold or used for advertising, and deleted when you delete your account. Usage events also include one daily summary of how your scans went on each device, such as how many you tried, how many were added automatically or typed by hand, and how many hit a camera error. It never says which cards were scanned.
• Error reports. When the app hits an error or closes unexpectedly, it records the kind of error, the place in the app's own code where it happened, the screen you were on and the app version, at most once a day for each error on each device. It never records the error message or anything you typed. Error reports follow the same rules as usage events. They're tied to your account, never sold or used for advertising, deleted automatically after 180 days, and deleted immediately when you delete your account.
• Turning them off. You can turn usage events, error reports and the time-in-app total off for your account in Settings, under Privacy & Sharing, with the Share usage data switch.

Purchases

Subscriptions are billed entirely by your app store (Google Play on Android, the App Store on iOS), so we never see or store your payment details. We use RevenueCat to confirm your subscription status and unlock premium features; it receives a purchase token and an app-specific user identifier to validate the subscription, never your payment information. If renewal reminders are on, we also use your purchase records to remind you before a free trial or an Attic Pass ends.

What we don't do

• No advertising, no ad trackers.
• No selling or renting your personal information. Ever.
• No collecting more than the features need.

Data retention & deletion

Your data is kept while your account is active. You can clear your collection in the app at any time (Settings → Account & Backup). Usage events are automatically deleted after 180 days regardless of account status. We keep purchase records for 7 years as accounting records, and a record of which devices have used a free trial, so a trial can't be started twice.

Guest accounts, the ones without a confirmed email, are also cleaned up automatically, in hourly batches. A guest account is deleted from our cloud, along with its profile, its friend code and its backups, when it is more than 30 days old and has no collection backup in our cloud, or when it is more than 180 days old and its collection backup has not been updated in the last 180 days. The collection backup is updated when you add, change or remove cards, so other use of the app, such as opening it, decks, the wishlist or Rue, is not counted. A guest account is kept if our records show a Curator trial or subscription for it, an Attic Pass it bought that is still running, free Curator access we gave it, a friend or friend request, or a message it sent or received. Approved community decks it submitted stay up without its name, and its other submissions are removed. The cleanup never touches what is saved on your device. An account with a confirmed email is never part of it.

Delete your account & data

Children

Arcane Ledger is intended for users 13 and older. We don't knowingly collect information from children under 13.

Service providers

We use Supabase (accounts, data storage, messaging), Google Play and the Apple App Store (billing), RevenueCat (subscription management), Expo with Google Firebase Cloud Messaging (app delivery and push notifications), Anthropic (AI responses), Ximilar (card-image identification), Resend (delivery of account emails such as password resets), Scryfall (card data and images), and JustTCG (sealed-product prices, fetched by our servers and never by your device). Each receives only what its job requires.

Changes

If this policy changes meaningfully, we'll update this page and the effective date above.

Contact

Questions? support@arcaneledger.app