Privacy Policy
The short version
- Dexeon has no ads. It's free during the beta, free for life for a select group of early adopters, and a one-time $5.99 purchase for everyone else at public launch. We don't sell your data, we don't run advertising or analytics SDKs, and we don't track you across other apps or websites.
- You can use the app without an account. In guest mode your collection stays on your device. The only things that leave it are requests for card data and, if you use the scanner, the photo you take.
- If you sign in, your collection syncs to our cloud database (Google Firebase) so it's backed up and available on your other devices.
- If you create a public profile, your username, display name, avatar, bio, favorite species, social links, and collection stats become visible to other signed-in Dexeon users, and you can appear on leaderboards. You can turn discoverability off.
- Messages, trade listings and shared binders are user content. Messages are private to the two people in the conversation. Trade listings are visible to signed-in users. Public binders are visible to anyone with the link, including on the web.
- You can delete your account from inside the app. Settings → Delete Account.
1. Who we are and what this covers
Dexeon is an independent, fan-made trading card collection tracker built and operated by Bree Pear, a sole developer based in the United States ("we", "us"). This policy covers the Dexeon iOS app, the website at dexeontcg.com, shared binder pages at dexeontcg.com/b/…, and the beta sign-up form on the website (together, the "Service").
Dexeon is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, Creatures Inc., or The Pokémon Company. Card data and images come from licensed third-party sources described below.
2. Information we collect
We collect only what the features you use require. Here is the complete list, grouped by where it comes from.
2.1 Information you give us
| What | When | Details |
|---|---|---|
| Account credentials | When you create an account or sign in | Your email address and a password, or your Google account. Authentication is handled by Firebase Authentication. We never see or store your password; Firebase stores a salted hash. If you use Google Sign-In, Google shares your name, email address and profile photo URL with us. |
| Public profile | When you set up a trainer profile | A unique @username, an optional display name, an optional bio, an optional avatar photo (stored as a small image), an optional favorite species, optional links to your Instagram, TikTok, YouTube, Whatnot, eBay or website, and your "Share Publicly" (discoverable) setting. |
| Collection data | As you use the app | Which species you've marked caught or favorite, the date caught, which cards you've collected and your chosen showcase card per species, the condition, quantity, grading company and grade you record for each copy, notes, your chase list, your binders (name, layout, visibility and the cards in each pocket), custom card photos you upload, and a daily snapshot of your collection's estimated value. |
| Messages | When you message another trainer | The text you send, any card or binder you attach (card id, name, image link, price, binder share id and name), the time sent, and read state. Messages are stored so both participants can read the conversation. |
| Trade listings | When you tap Trade on a card you own | The card, its market price at listing, an optional condition, your username, display name and avatar, and the time listed. |
| Friend requests, friendships and blocks | When you add, accept, remove or block a trainer | Who requested whom and when, accepted friendships, and your block list. Blocks are private to you. |
| Reports | When you report a trainer or a message | Your user id, the reported user id, the reason you give, and for message reports the message text, so we can review it. |
| Photos for card scanning | When you use Scan a Card | The photo you take or choose is sent to our card-data provider, Scrydex, to identify the card. We do not keep the photo. Camera access is requested only when you tap the camera button. |
| Beta sign-up email | When you enter your email on dexeontcg.com | Your email address, the time, the page that referred you, and your browser's user-agent string, so we can send TestFlight release notes and follow up on feedback. |
2.2 Information collected automatically
- Push notification token. If you allow notifications, Apple issues a device token that we register with Firebase Cloud Messaging so we can notify you of messages and friend requests. Invalid tokens are pruned automatically.
- Timestamps and identifiers. Records above carry created and updated times and a random Firebase user id. We use the user id, not your email, to link your data.
- Service logs. Firebase and Google Cloud keep standard operational logs for the backend, and Vercel keeps standard web-server access logs for dexeontcg.com (IP address, user agent, requested page, time). We don't add tracking of our own on top of these.
- On-device storage. The app stores your collection in a local database, caches card images and card data on your device so screens load quickly, and remembers settings such as light or dark mode. Guest-mode data lives only here.
2.3 What we do not collect
- No precise or approximate location.
- No contacts, calendar, health or motion data.
- No advertising identifier (IDFA) and no cross-app tracking. The app does not ask for tracking permission because it doesn't track.
- No analytics or crash-reporting SDKs. We don't measure how you use the app.
- No payment information. Dexeon is free during the beta. At public launch it is sold as a one-time purchase through the App Store; Apple processes the payment and we never receive your card or billing details. At launch there is nothing else to buy inside the app.
3. How we use it
- To run the app: show your collection, chase list and binders, sync them across your devices when signed in, and restore them when you sign in on a new device.
- To provide social features you opt into: your profile, friend connections, messaging, the trade board, shared binders and the Gym Leaders leaderboard.
- To keep the community safe: run an automated hate and violent-threat check on messages before they send and again on the server, enforce a per-sender rate limit, act on reports, and honor blocks.
- To notify you: push notifications for new messages and friend requests, which you can mute in Settings.
- To communicate about the beta: if you gave us your email on the website, to send TestFlight release notes and ask for feedback.
- To protect the Service: prevent abuse, debug problems, and comply with law.
We don't use your data to build advertising profiles, and we don't train machine-learning models on your content.
4. What other people can see
| Content | Who can see it |
|---|---|
| Your public profile (username, display name, avatar, bio, favorite species, social links) | Any signed-in Dexeon user who searches for you or views the leaderboard, a trade listing of yours, or a conversation with you. If "Share Publicly" is off you don't appear in search or on the global leaderboard, but people you're already connected with can still see your profile. |
| Your stats (Full Dex percent, caught count, sets completed, cards owned, weekly catches, game high score, top sets and a few top cards by value) | Signed-in users, on your profile and on the leaderboard when you're discoverable. Publishing stats is what puts you on the board. |
| Trade listings | Every signed-in user browsing Community Trades. |
| Binders set to Public | Anyone with the link, including people without an account, on dexeontcg.com. Public binder pages show card art and names; prices are hidden behind a toggle. |
| Binders set to Friends | Trainers you've connected with, inside the app. |
| Binders set to Private (the default) | Only you. |
| Messages | Only the other participant. Deleting a conversation hides it on your side; the other person keeps their copy. |
| Trainer card image | Whoever you send it to. It's a picture you generate and share yourself through the iOS share sheet. |
Your email address is never shown to other users. Your collection details beyond the stats above, your chase list, your private binders and your blocks are never shown to other users.
5. Who we share it with
We share personal information only with the service providers needed to run Dexeon, and only for that purpose. We do not sell personal information and we do not share it with advertisers or data brokers.
| Provider | What they do for us | What they receive |
|---|---|---|
| Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging), Google LLC | Sign-in, the cloud database that stores synced and social data, server-side functions for messaging safety, username claims, weekly leaderboard seasons and push delivery | Everything in section 2.1 that you create while signed in, plus your push token. Stored in the United States. |
| Google Sign-In, Google LLC | Optional sign-in method | Google shares your name, email and photo URL with us; Google's own privacy policy governs what Google collects. |
| Apple (Push Notification service, TestFlight, App Store) | Delivers notifications; distributes the app | Your device token for notifications. Apple's privacy policy governs TestFlight and App Store data. |
| Scrydex | Card catalog, prices and image-based card identification | Search terms and card ids you look up, and the photo you scan. Requests are made with our API key, not with your identity, and we don't send your account details. We don't retain scanned photos. |
| TCGplayer | Market pricing source; "View on TCGplayer" links | Nothing from us. If you tap a TCGplayer link, you leave the app and TCGplayer's policy applies. |
| Venmo | Optional tips link on the website | Nothing from us. If you tap "Support the dev", you leave our site for Venmo and Venmo's privacy policy applies; we see only what Venmo shows a recipient. |
| Vercel | Hosts dexeontcg.com and the shared-binder pages | Standard web request logs when you visit the site. |
| Image hosts (Scrydex and its image CDN) | Serve card artwork | Standard image requests from your device. |
We may also disclose information if required by law, to protect the rights and safety of users or the public, or to enforce our Terms. If Dexeon is ever transferred to a new owner, your data would go with it under the same protections, and we would tell you first.
6. How long we keep it
- Account and collection data: for as long as your account exists. Deleting your account deletes it (see section 7).
- Guest-mode data: stays on your device until you delete it in the app or remove the app. If you later sign in, it's claimed by your account and synced.
- Messages: kept for both participants for the life of the conversation. Hiding a conversation removes it from your inbox only.
- Trade listings: until you remove the listing or delete your account.
- Reports: kept for as long as needed to review and to keep a record of enforcement actions, then deleted.
- Push tokens: until you sign out, disable notifications, or the token is invalidated by Apple.
- Beta sign-up emails: until the app launches publicly, or earlier if you ask us to remove yours.
- Scanned photos: not stored by us.
- Backups and logs: provider backups and operational logs may hold copies for a limited period, typically up to 30 days, before being overwritten.
7. Your choices and rights
Controls inside the app
- Use guest mode. Don't sign in and nothing about your collection leaves your device.
- Share Publicly toggle. Turn it off in Edit Profile to leave search results and the global leaderboard.
- Binder visibility. Every binder is private, friends-only or public. Public links can be turned off with "Stop Sharing".
- Mute notifications. Settings → Mute Message Notifications, or turn off notifications for Dexeon in iOS Settings.
- Block and report. From any profile, message or trade listing.
- Export. Any binder can be exported as a PDF or a CSV from its menu.
- Edit or remove profile details at any time in Edit Profile.
- Delete your account. Settings → Delete Account. You'll confirm by typing DELETE. This removes your sign-in, your collection entries, chase list, binders, published binder links, value history, custom card photos and profile photo from our servers and from the device, and clears your public profile, username, stats, trade listings, friendships, blocks and push tokens. Messages you sent remain in the recipient's copy of the conversation, attributed to a deleted account.
Rights you may have
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Most of these you can exercise directly in the app. For anything else, email us (section 13) and we'll respond within 30 days. We will never discriminate against you for exercising a privacy right. You can also complain to your local data protection authority.
8. Security
Data travels between the app, the website and our providers over TLS. Cloud data is protected by Firebase security rules that restrict every record to its owner, with narrowly defined exceptions for the social features described above (for example, a public profile is readable by signed-in users, a public binder by anyone with its id). Passwords are handled by Firebase Authentication and are never visible to us. Messages pass through an automated content check before and after sending. No system is perfectly secure; if we learn of a breach affecting your data we'll notify you as the law requires.
9. Children
Dexeon is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Creating an account, a public profile, or sending messages requires that you are at least 13 and old enough to consent to data processing where you live (16 in much of the EU). If you believe a child has provided us personal information, contact us and we will delete it.
10. International transfers
Dexeon is operated from the United States and our providers store data there. If you use Dexeon from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those in your country. Our providers rely on standard contractual safeguards for such transfers.
11. Regional notices
European Economic Area, United Kingdom and Switzerland
Our legal bases are: performance of a contract (providing the app you asked for, syncing your account), legitimate interests (keeping the Service safe, preventing abuse, operating the beta), and consent (camera access, push notifications, the beta email list, and creating a public profile). You can withdraw consent at any time by changing the setting or contacting us. The controller is Bree Pear; contact details are in section 13.
California
We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. The categories we collect are identifiers (email, user id, username), user content, and limited device information (push token). You have the rights to know, delete, correct, and to non-discrimination. Exercise them in the app or by email.
12. Changes to this policy
When we change this policy we'll update the effective date at the top and, for changes that matter, note it in the app or on the website. If we ever want to use your information in a way that this policy doesn't cover, we'll ask first.
13. Contact
Bree Pear, developer of Dexeon
Email: breepear@gmail.com
Web: dexeontcg.com
See also the Terms of Service.