Privacy policy

Your collection, portfolios, prices paid, recorded sales, watchlist, preferences and the card catalog you download are stored on your device. The collection works with no account and no connection.

To back your collection up and sync it between devices, the app keeps a copy in Google Firebase (Cloud Firestore): each card you hold, its grade, quantity, portfolio name, the price you paid if you entered one, and sales you record. Firestore access rules let only your own account read or write that copy.

On first launch the app creates an anonymous Firebase account without asking you for anything. It gives your backup and your scan allowance a stable owner. You can later sign in with email, Google or Apple, and we then receive the email address and basic profile details that provider shares.

Firebase Authentication issues a token the app sends with each request to our server. Our server reads only your account id from it.

Card identification runs on our server. When you scan, the app crops the photo to the card, reduces its size and uploads it. We read the card’s text, check whether it is a graded slab, and match it against our catalog. Scanning needs a connection. Photos you choose from your library are handled the same way, and the app reads only the photos you pick.

We keep scan photos to improve identification. Each cropped photo is stored with what our system read from it and the result, plus a one-way hash of your account id instead of the id itself. If you correct a result, the correction is stored against that scan. These photos are used to measure and train the models that recognise cards. They show the card you scanned, so frame the card and keep other things, such as faces or documents, out of the shot.

When our own matching is not confident, the cropped photo and up to five candidate cards may be sent to a third-party AI vision service to choose between them. The provider processes that request only to return an answer, and under its commercial terms does not use it to train its models.

Linked to your account id: how many scans you have used against the free allowance and the daily limits, corrections you submit, and sale disputes you report on a price. If you turn on price alerts, we store your device’s push token, your alert settings, and the cards, grades, quantities and target prices those alerts cover. Turning alerts off deletes those cards and grades from our server.

Price alerts are optional and off until you turn them on. They are delivered through Expo’s push notification service and Apple or Google, which receive your device’s push token and the alert text. You can turn them off in the app or in your device settings.

We use ActivationPal for product analytics: which screens and features are used, scan outcomes, and whether you started a trial or a purchase. Events are linked to your RevenueCat user id, and on iOS may include Apple Ads attribution and your App Store country. We use this to understand which parts of the app work, not to build advertising profiles. Grailo shows no third party ads.

Grailo Pro is sold through the Apple App Store and Google Play and managed through RevenueCat. These services process your purchase history, an app user id linked to your Firebase account, and related diagnostics so your subscription can be provided and restored. We never receive your payment card details.

Some screens show live eBay listings. Some of those links are eBay Partner Network affiliate links, labelled in the app, and we may earn a commission if you buy. When you open one you leave Grailo, and eBay may record the visit with cookies or similar technology under its own privacy policy.

We do not sell or rent your personal information, and we do not share it for cross-context advertising. The providers named above (Google Firebase, our AI vision provider, ActivationPal, RevenueCat, Expo, Apple and Google, and our hosting and storage providers) process it only to run the features described here. We may disclose information if the law requires it or to protect the app and its users.

Data on your device stays until you delete it or uninstall the app. Your backup stays until you delete the cards or ask us to delete your account. Scan photos are kept while they are useful for improving identification, and are deleted when you ask us to delete your data.

To delete your account and everything linked to it, including the backup, your scan photos, corrections and alert settings, email info@jayasena.dev from the address on the account. If you never signed in, deleting the app removes your local data, and you can email us to have the rest removed. Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play settings.

Grailo is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how it is used. You can export your collection as CSV in the app at any time. For anything else, email info@jayasena.dev.

We may update this policy as the app changes. The effective date above shows when it last changed.