Privacy Policy

Effective date: 2026-07-14 · Back to app · justin@pajela.com

Plain summary

Poké Bowl works without an account — in that mode your collection lives only on your phone and we never see it. If you sign in (Apple, Google, or email), your collection, master sets, and (for Business profiles) sales records sync to our backend so they survive phone changes. Anything you post to the Social feed is visible to other users. The free tier shows non-personalized ads; we never build advertising profiles or track you across other apps. We never sell your data.

What we collect

Without an account (guest mode)

• Local-only data: your card collection, scan history, grading results, pack-simulator stats, and app preferences — stored in a database on your device and never transmitted to us.
• Camera input during scanning and grading: processed entirely on your device by bundled machine-learning models (Apple CoreML). Scan and grading images are not uploaded anywhere.

With an account (when you sign in)

• Account data: your email address and the identifier provided by Apple or Google sign-in.
• Profile data you choose to add: username, bio, avatar photo, and (for Business profiles) business name.
• Collection data: card identifiers, quantities, conditions, variants, want lists, master-set progress — synced so your collection survives device changes.
• Seller data (Business features): sales you record (price, platform, fees, optional buyer note) and cost-basis entries you add. Used only to show you your own ledger and profit & loss; never shared or published.
• Social content: posts, photos, captions, comments, likes, and stories you publish are visible to other users of the app. Photos you upload for social posts or avatars are screened by an automated image-moderation service before publishing.

We do not collect

• Your location
• Advertising identifiers or cross-app tracking data (we do not use Apple's App Tracking Transparency because we do not track)
• Payment card numbers — all purchases are processed by Apple
• Data about other apps on your device

Advertising

The free tier shows banner and optional rewarded-video ads served by Google AdMob. We request non-personalized ads only: ads are selected from context (like general region), not from a profile of you, and we do not pass Google any identifier for advertising. Ads are removed by the Premium subscription or the one-time "Remove Ads Forever" purchase. Google's own processing is described in Google's privacy policy.

Purchases

Subscriptions and one-time purchases are processed by Apple. We use RevenueCat to manage subscription state; RevenueCat receives your Apple transaction receipts and an app-generated user identifier — never your payment details. We never see or store card numbers.

Third-party services

• Supabase — our backend: authentication, synced collection data, social content, and sales records, protected by per-user access rules.
• Apple / Google Sign-In — authentication only; we receive your assigned identifier and the email you authorize.
• RevenueCat — subscription and purchase management (see Purchases).
• Google AdMob — non-personalized ads on the free tier (see Advertising).
• Sightengine — automated moderation scan of photos you upload for social posts and avatars, before they are published.
• Cloudflare — CAPTCHA on sign-in/sign-up (Turnstile) and delivery of price-data files (R2).
• eBay Browse API — public marketplace listings, fetched through our server so your device never talks to eBay directly; requests contain card search terms, not personal information. Outbound "View on eBay" links are eBay Partner Network affiliate links.
• pokemontcg.io, TCGdex, tcgcsv.com, PokeAPI — public card catalogs and pricing reference data; requests contain only card identifiers or search keywords.

These services receive the standard network metadata that accompanies any request from your device (IP address, user-agent). If we add new services we will update this policy first.

On-device machine learning

Card identification and pre-grade screening run entirely on your device via Apple's CoreML. Scan and grading images and their results never leave your device. The models are bundled with the app and work offline.

Camera permission

Camera access is used for scanning and grading cards. The camera is active only on scanning and grading screens. The only photos that ever leave your device are ones you explicitly choose to upload — a social post or an avatar.

Data deletion

• In the app: every card, post, story, sale record, and photo you've added can be removed individually. Signing out clears synced data from the device.
• Account deletion: you can delete your account and all associated server-side data at any time directly in the app — Profile → Settings → Delete account. Deletion is permanent and covers your profile, collection, social content and photos, and sales records. If you can't access the app, you can also request deletion by emailing justin@pajela.com from your account email.
• Guest mode: uninstalling the app deletes all local data.

Children

The app is not directed at children under 13, and account features require being 13 or older. We do not knowingly collect information from children under 13. If you believe a child has created an account, contact us at justin@pajela.com.

Future changes

We will update this policy before shipping any feature that changes how data is handled. The effective date at the top always reflects the most recent change.

Contact

Questions about this policy: justin@pajela.com.