TCGrail - Privacy Policy

Last updated: March 19, 2026

1. Data Controller

The data controller responsible for this app is:

Endemine OÜ
Registry Code: 17006805
Narva mnt 5, Tallinn 10117, Estonia
Phone: +372 5601 1319
Email: contact@endemine.com
Authorized Representative: Tommes Klaus Parzl

2. Introduction

TCGrail ("we", "our", "the app") is a mobile application for managing Trading Card Game collections. This privacy policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable Estonian data protection laws.

3. Data We Collect

Account Data

Email address (for authentication)
Display name (optional)
Profile photo (optional)

Collection Data

Card collections and binder contents
Card conditions and grading results
Wishlist items and price alerts
Trade offers and history

Usage Data

App interactions and feature usage (via Firebase Analytics)
Crash reports and error logs (via Firebase Crashlytics)
Device type and operating system version
IP address (collected automatically by Firebase)

Camera Data

Card photos are processed for recognition and grading
Images are sent to our secure servers for AI analysis and are not stored permanently

Purchase Data

Subscription status and purchase history (managed by RevenueCat and Google Play)
We do not process or store payment details (credit card numbers etc.)

4. Legal Basis for Processing (Art. 6 GDPR)

Processing Activity	Legal Basis
Account creation and authentication	Art. 6(1)(b) — Performance of contract (providing the service)
Collection management, syncing, pricing	Art. 6(1)(b) — Performance of contract
AI card recognition and grading	Art. 6(1)(b) — Performance of contract
Push notifications (price alerts, trades)	Art. 6(1)(a) — Consent (user enables notifications)
Crash reports and analytics	Art. 6(1)(f) — Legitimate interest (improving app stability and performance)
Advertising (free-tier users)	Art. 6(1)(a) — Consent (via ATT/ad consent prompt)
Subscription and purchase management	Art. 6(1)(b) — Performance of contract

5. Third-Party Services and Data Transfers to Third Countries

We use the following third-party services, some of which transfer data to servers in the United States:

Service	Provider	Purpose	Data Location	Transfer Safeguard
Firebase (Auth, Firestore, Storage, Analytics, Crashlytics, FCM)	Google LLC, USA	Core infrastructure, analytics, crash reporting, push notifications	EU / US	EU-US Data Privacy Framework
Google AdMob	Google LLC, USA	Advertising for free-tier users	EU / US	EU-US Data Privacy Framework
RevenueCat	RevenueCat Inc., USA	Subscription and purchase management	US	Standard Contractual Clauses (SCCs)
OpenRouter / Google Gemini	OpenRouter Inc. / Google LLC, USA	AI-powered card recognition and grading	US	EU-US Data Privacy Framework / SCCs
CardMarket API (via RapidAPI)	RapidAPI Inc., USA	Card pricing data	US	SCCs

Each service has its own privacy policy. We encourage you to review them.

6. Advertising

Free-tier users see advertisements provided by Google AdMob. AdMob may collect device identifiers (Advertising ID) and usage data to serve relevant ads. You can:

Opt out of personalized ads in your device settings (Settings → Google → Ads)
Upgrade to a paid plan (Plus, Pro, or Lifetime) to remove all advertisements

Paid subscribers do not see any advertisements, and no advertising-related data is collected for them.

7. Data Storage and Security

All data is stored in Firebase (Google Cloud) servers
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
API keys are stored server-side in Firebase Secret Manager — no sensitive credentials are stored on your device
Access to your data requires authentication
Firestore security rules enforce user-scoped access (users can only access their own data)

8. Your Rights Under GDPR

As a data subject in the European Economic Area, you have the following rights:

Right of Access (Art. 15) — Request a copy of your personal data
Right to Rectification (Art. 16) — Correct inaccurate or incomplete data
Right to Erasure (Art. 17) — Delete your account and all associated data ("Right to be Forgotten")
Right to Data Portability (Art. 20) — Export your collection data in machine-readable format (CSV/JSON)
Right to Object (Art. 21) — Object to processing based on legitimate interests (e.g., analytics)
Right to Restrict Processing (Art. 18) — Request restriction of processing under certain conditions
Right to Withdraw Consent (Art. 7) — Withdraw consent at any time for consent-based processing (notifications, personalized ads)

To exercise these rights:

Use the "Delete Account" option in the app settings for account erasure
Use the "Export" feature for data portability
Contact us at contact@endemine.com for all other requests

We will respond to your request within 30 days as required by the GDPR.

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The responsible authority for Endemine OÜ is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Phone: +372 627 4135
Email: info@aki.ee
Website: www.aki.ee

You may also lodge a complaint with the supervisory authority of your country of residence.

10. Automated Decision-Making

TCGrail uses AI-powered card recognition and grading. These features:

Process card images to identify card names, sets, and conditions
Do not make decisions that produce legal effects or similarly significantly affect you
Are used solely to assist with collection management

No automated decision-making as defined in Art. 22 GDPR takes place.

11. Data Retention

Account data is retained until you delete your account
When you delete your account, all personal data (collections, trades, alerts, profile) is permanently and irreversibly removed within 30 days
Crash reports and analytics are retained for 90 days, then automatically deleted
Card images sent for AI analysis are processed in real-time and not stored

Billing and Financial Record Retention (Estonian Accounting Act)

As an Estonian company, Endemine OÜ is subject to the Estonian Accounting Act (Raamatupidamise seadus §12), which requires that accounting and financial records be retained for 7 years.

What is retained: Anonymized billing records, including subscription purchase history, lifetime purchase records, and transaction identifiers (e.g., Google Play order IDs), are retained for 7 years after your account is deleted.
What is removed immediately: Upon account deletion, all personal data — including your name, email address, and any other identifying information — is removed from billing records. Only anonymized transaction data is kept.
After 7 years: All remaining data, including the anonymized billing records, is permanently and irreversibly deleted.
Legal basis: Retention of anonymized billing records is based on Art. 6(1)(c) GDPR — compliance with a legal obligation (Estonian Accounting Act, Raamatupidamise seadus §12).

Because this retention is required by law, it applies even if you exercise your right to erasure under Art. 17 GDPR. However, since only anonymized records are retained (with no personal data), this does not constitute processing of your personal data after deletion.

12. Children's Privacy

TCGrail is not directed at children under 16 (the GDPR age of consent for data processing). We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately and we will delete it.

13. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via in-app notification. The updated policy will be posted on this page with a revised date. Continued use of the app after changes constitutes acceptance.

14. Contact

For privacy-related questions, data subject requests, or complaints:

Endemine OÜ
Narva mnt 5, Tallinn 10117, Estonia
Email: contact@endemine.com
Phone: +372 5601 1319