Privacy policy

This English version is provided for convenience. In case of any discrepancy, the German version (Datenschutzerklärung) prevails.

This privacy policy applies to the websites www.kartenscan.com and www.kartenscan.de and to the Kartenscan app for Android. It explains which personal data we process, for what purpose and on which legal basis.

Summary

  • The website sets no cookies, uses no tracking and loads no content from third-party servers.
  • The app works without signing in. An account via email or Google is optional, for example to back up your collection.
  • To identify a card, the app sends a cropped image of the card and the text recognised on it to our server. The image is not stored afterwards.
  • The Kartenbörse (card exchange), where collectors trade and sell cards, is only open to private individuals aged 18 and over.
  • You can delete your account at any time in the app or on the delete data page and download your data.
  • We do not sell data and do not show personalised advertising.

1. Controller

MARCODES GmbH
Lena-Christ-Str. 2
82031 Grünwald
Germany

Managing director: Marco Hochmuth
Email: hi@marcodes.com
Phone: +49 (0) 89 / 244 19 0 19

For privacy questions about Kartenscan you can also contact us at contact@kartenscan.com.

2. Website

2.1 Hosting and server log files

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (DE). When a page is requested, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, referrer, browser and operating system. This is required to deliver the website and to keep it secure, for example to fend off attacks.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless they are needed longer to investigate a specific security incident. We have a data processing agreement with the provider (Art. 28 GDPR). Server location: Nürnberg (DE).

2.2 No cookies, no tracking

The website uses no cookies, no analytics or marketing tools and no social media plugins. Fonts, graphics and stylesheets are loaded directly from our server. There are no connections to third parties such as Google Fonts or content delivery networks. That is why there is no cookie banner.

If you choose a display mode (light or dark) with the switch in the page header, your browser stores only this setting locally on your device (local storage, entry "ks-theme"). It is not transmitted to us or to third parties and can be deleted in your browser settings. Legal basis is Section 25 (2) no. 2 TDDDG, as storing it is strictly necessary for the function you requested.

2.3 Email contact and beta waitlist

If you send us an email, for example via the "Join the beta waitlist" link, we process your email address, your name if you provide it, and the content of your message. There is no form on the website for emails to us, the message is sent by your email app.

If you sign up for the beta, we only use your email address to inform you when the beta starts and, if applicable, to invite you to test. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to contact@kartenscan.com. For other enquiries, the legal basis is our legitimate interest in answering them (Art. 6(1)(f) GDPR) or, where a contract is concerned, Art. 6(1)(b) GDPR.

We delete waitlist sign-ups when you withdraw your consent, at the latest twelve months after the public release. Other enquiries are deleted once they have been dealt with and no statutory retention obligations apply. Emails are processed by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521 (IE).

2.4 Sign-in, consent and account deletion on the website

The pages delete data, /consent/ and /sign-in/ send the data you enter or that is contained in the link from our email (email address, code, link identifier) encrypted directly to our app server api.kartenscan.com. There it is processed as described in section 3. No cookies are set and nothing is stored in your browser. The sign-in page only passes the link on to the app. The legal basis is Art. 6(1)(b) GDPR, for deletion Art. 6(1)(c) in conjunction with Art. 17 GDPR and for parental consent Art. 6(1)(a) in conjunction with Art. 8 GDPR.

3. Kartenscan app

3.1 Camera

The app needs access to the camera so you can scan cards. You grant access through the Android permission prompt and can revoke it there at any time. The live camera image is only analysed on your device to find the card in the picture. No video is transmitted to us.

3.2 Card identification on our server

When you scan a card, the app reads the text on the card directly on the device (text recognition, OCR) and then sends the following data to our server api.kartenscan.com:

  • a cropped and straightened image of the card. If the app could not find the card itself, the captured photo is sent instead and the crop is determined on the server;
  • the text recognised on the device, such as card name, card number and set code;
  • technically necessary connection data such as IP address and time.

The server compares the image and text with our card catalogue and returns the matching cards. The image is only used for this identification, processed in memory and not stored afterwards. The transmission is encrypted (TLS). Please photograph only the card if possible and no people or private items.

The legal basis is Art. 6(1)(b) GDPR, because identification is the function you request with the scan. Connection data in server log files is processed under Art. 6(1)(f) GDPR (secure operation). Log files are deleted after 14 days. Server location: Nürnberg (DE).

We do not use your photos to train our recognition. Should we want to offer this in the future, we will ask for your explicit consent first.

3.3 Card search and prices

When you search for a card or retrieve prices and sales of a card, the app sends the search term or the card identifier to our server. These requests are not linked to a person and not combined into a profile. Only if you save a search is it linked to your account (section 3.9). The legal basis is Art. 6(1)(b) GDPR.

3.4 Device account, account and sign-in

Device account: You do not have to sign in to use Kartenscan. On first start, the app creates an anonymous device account on our server: a random identifier without name and without email address. Your collection, lists and notifications belong to it (sections 3.9 and 3.10). The app stores the access key for it encrypted on your device. App settings are stored locally on your device and are deleted when you uninstall the app or clear the app data in the Android settings.

Account with sign-in (optional): You can sign in with your email address or your Google account to back up your data and use it on several devices. Your device account then becomes your account without losing data. We then store your email address and when it was confirmed, the sign-in methods you use, language setting, age information (section 3.8) and the times of creation and last use.

  • Sign-in by email: We send you a six-digit code and a sign-in link. Code and link are valid for 15 minutes and stored by us only in encrypted form (as a hash). The link leads to www.kartenscan.com/sign-in/ or www.kartenscan.com/de/anmelden/ and opens the app.
  • Sign-in with Google: Google confirms your identity to us. We receive your Google account identifier, your email address, whether Google has verified it, your name and, if available, the address of your profile picture. Google itself is responsible for signing in with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Details in section 3.15.
  • Sessions: For each signed-in device we store a session with device name and app version, but no IP address. Access keys are stored by us only as a hash. You can see and end signed-in devices in the app.

The legal basis is Art. 6(1)(b) GDPR (providing the features you request). Limits on sign-in attempts and protection against abuse are based on our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

3.5 Text recognition with Google ML Kit

For on-device text recognition the app uses the ML Kit library by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Recognition runs entirely on your device. According to Google, ML Kit may contact Google servers to receive bug fixes and model updates and may send metrics about the performance and use of the APIs to Google. According to Google, camera images and recognised text are not transmitted. The legal basis is Art. 6(1)(f) GDPR (reliable text recognition). More information: developers.google.com/ml-kit/terms.

3.6 Google Play

The app is distributed via Google Play. When you download and update it, Google processes data such as your Google account and device information under its own responsibility. We only receive aggregated statistics from Google, such as install numbers, and crash reports that are not linked to you. For the closed beta, Google Play invites you via the email address of your Google account, which you share with us for this purpose. Google's privacy policy: policies.google.com/privacy.

3.7 Affiliate links

The app is meant to show the cheapest current offer for a card. Such links are affiliate links labelled as ads, for example from the eBay Partner Network. If you open such a link, you are forwarded to the provider's website. The provider may set cookies or similar identifiers there to record that you came from Kartenscan and to attribute a commission to us. The respective provider is responsible for this. From the partner programmes we only receive aggregated reports on clicks and commissions, no information about you or your purchases.

To settle and check commissions, we count clicks on these links ourselves: card, offer, marketplace, time, a random installation identifier of the app and, if you are signed in, your account. If you delete your account, we remove the link to your account and your installation, the clicks remain only as a number. The legal basis is our legitimate interest in settling accounts with the partner programmes (Art. 6(1)(f) GDPR). See the affiliate disclosure for more.

3.8 Age information and parental consent

Kartenscan is meant for users aged 13 and over. When you create an account with sign-in, we ask for your age once: either your date of birth or a confirmation that you are at least 16. For the Kartenbörse you additionally confirm that you are at least 18. Under 13, no account with sign-in is possible, the app remains usable without an account. In that case only a note on the device account is stored.

If you are 13 to 15, your account is marked as a minor's account and needs the consent of a parent (Art. 8 GDPR). For this you enter a parent's email address in the app. We send a link with which the parent can consent or decline on www.kartenscan.com/consent/ (German: www.kartenscan.com/de/einwilligung/). As proof we store the time of consent and the parent's email address. Minors receive no advertising and no marketing emails and have no public profile.

The legal basis for the age check is Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR and our legitimate interest in protecting minors (Art. 6(1)(f) GDPR). Proof of consent is kept under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. The parent can withdraw consent at any time by email to contact@kartenscan.com.

3.9 Collection, wishlist, watchlist and saved searches

What you create in the app is stored with your device account or account: cards in your collection with language, condition, quantity and optionally purchase price, purchase date and note; cards on your wishlist with maximum price, languages, minimum condition and preferred channels; cards whose price you watch, with your price rule; saved searches with search term and filters. From this we calculate, for example, the value of your collection. So that prices and offers for wanted cards stay current, we fetch them more often. This evaluation relates to cards, not to people. The legal basis is Art. 6(1)(b) GDPR.

3.10 Notifications

If a new offer, a card in the Kartenbörse or a price change matches your wishlist, watchlist or a saved search, we create a notification in your inbox in the app. You decide what we notify you about, when and how often.

  • Push notifications are sent via Firebase Cloud Messaging, a service of [Anbieter Firebase Cloud Messaging mit Name und Anschrift]. For this we store a device token (push token), the platform and the app version. The message contains a title, a short text and a link into the app, but no content from Kartenbörse chats. You allow push notifications through the Android permission prompt and can switch them off there or in the app at any time. Google may also process data in the USA (section 4).
  • Daily email digest: Only if you switch it on and your email address is confirmed. To send these emails as well as sign-in codes, deletion codes and consent requests we use [Versanddienst für App-E-Mails mit Name und Anschrift].

The legal basis is Art. 6(1)(b) GDPR, because notifications are a feature you switch on. Storing and reading the push token on your device is strictly necessary for this service (Section 25 (2) no. 2 TDDDG).

3.11 Kartenbörse (card exchange)

In the Kartenbörse, collectors offer cards for sale, swap or as a gift and contact each other via chat. Kartenscan only brings them together, payment and shipping are arranged by the parties themselves. The Kartenbörse is only open to private individuals aged 18 and over with an account. We process:

  • Profile: a pseudonym assigned by us (for example "Sammler-4821"), member since (month only), number of completed deals and ratings. No real name, no profile picture.
  • Location: only the postcode area, that is the first two digits of your postcode. No address, no GPS location.
  • Listings: card, language, condition, quantity, type (sale, swap, gift), asking price, a short note and up to four photos. When photos are uploaded we remove all metadata (EXIF), including location data. Please do not photograph people or details of your home. Listings, pseudonym and postcode area are visible to other users.
  • Wants: cards on your wishlist with the Kartenbörse channel. Others only see how many people are looking for a card, never who. Only accounts active within the last 90 days are counted.
  • Chats: messages between you and other users about a listing. To protect against fraud, we automatically check messages for typical patterns, such as payments via "friends and family" or third-party payment links, and then show a safety notice. Chats are deleted [Speicherdauer Chats in Monaten nach der letzten Nachricht] months after the last message. If you delete your account, the chat remains for the people you talked to, but the content of your messages is removed and shown as "deleted".
  • Reports, blocking and moderation: You can report listings, profiles and chats, even without an account, and block other users. We store the report with reason and description, the content concerned and our decision with its reasons. Affected users are informed of a restriction and its reason (Art. 16 and 17 Digital Services Act). After several reports, content may be hidden automatically for the time being, the final decision is made by a person. We keep reports until the procedure is completed and beyond that as long as claims can arise from it.

The legal basis for the Kartenbörse itself is Art. 6(1)(b) GDPR. The automatic check for fraud patterns, moderation and keeping reports are based on our legitimate interest in a safe marketplace (Art. 6(1)(f) GDPR) and on our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).

3.12 Reported sales

You can report what a card sold for: price, date, platform, condition, language, grading and optionally a proof link. We store the report with your account, if you are signed in, and the random installation identifier of the app, to detect duplicate and false reports. Reports are reviewed before they enter the price statistics. Other users only see the price, not who reported it. If you delete your account, the price remains as an anonymous data point, the link to you and the proof link are removed. The legal basis is Art. 6(1)(b) GDPR, for the abuse checks Art. 6(1)(f) GDPR.

3.13 Data export and deletion

In the app, under "Profile" and "My data", you can download all data of your account as a file (Art. 15 and 20 GDPR). You delete your account in the app under "Profile" and "Delete account", or without the app on the delete data page with a code we send to your email address. Deletion is immediate and permanent. That page explains what is deleted and what remains without any link to you.

3.14 Storage periods

  • Account with sign-in and its content: until you delete the account.
  • Device account without sign-in: until you delete it, at the latest 365 days after last use.
  • Notifications in the inbox: 180 days.
  • Sign-in codes and links: valid for 15 minutes, deleted one day after expiry.
  • Sessions: you stay signed in for up to 90 days without use. Ended sessions are deleted after 30 days.
  • Push tokens: until you sign out, switch off push or Google reports the token as invalid.
  • Kartenbörse chats and reports: as described in section 3.11.

3.15 Google Sign-In / Google user data

If you choose "Sign in with Google", the app only requests the scopes openid, email and profile from Google. With them we receive from Google:

  • your Google account ID (a number that uniquely identifies your Google account),
  • your email address and whether Google has verified it,
  • your name as stored in your Google account,
  • if available, the address of your profile picture.

We get no access to any other data in your Google account, such as contacts, Gmail, Drive or photos, and never your password.

What for: We use this data only to sign you in, to link your Kartenscan account with your Google account and, where needed, to contact you by email about your account (for example for deletion codes). We do not show your profile picture to anyone, not even in the Kartenbörse.

No sharing: We do not sell Google user data, do not use it for advertising, for credit assessment or for training AI models. We do not share it with third parties, except with service providers who process it on our behalf under Art. 28 GDPR (hosting), where the law requires it, or with your explicit consent.

Storage and deletion: The data is transmitted encrypted and stored on our server in Germany for as long as your account exists. If you delete your account (section 3.13), we delete it immediately. You can also revoke Kartenscan's access at any time in your Google account: myaccount.google.com/connections ("Third-party apps and services"). After that, signing in with Google requires your consent again, your Kartenscan account remains until you delete it.

Kartenscan's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The legal basis is Art. 6 (1) (b) GDPR.

4. Recipients and transfers to third countries

We only share personal data with service providers who process it on our behalf (hosting, email, sending app emails, push notifications) and are bound by contract under Art. 28 GDPR. In the Kartenbörse, other users see your pseudonym, your postcode area, your listings and the messages you write to them. We do not sell data.

For push notifications, Google as the provider of Firebase Cloud Messaging may process data in the USA. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google is certified, and additionally on the European Commission's standard contractual clauses (Art. 46 GDPR). Beyond that, we do not intend to transfer data to countries outside the EU or EEA. Where Google or providers of affiliate programmes transfer data to third countries under their own responsibility, their privacy policies apply.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to us at contact@kartenscan.com. You can also download your data and delete your account directly in the app, and delete it on the delete data page.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

6. Children and young people

Kartenscan can be used without signing in and without providing personal data. An account with sign-in is available from 13, from 13 to 15 only with the consent of a parent, and the Kartenbörse only from 18 (section 3.8). Anyone younger than 16 should only sign up for the beta or write to us with the consent of their parents.

7. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles. Notifications are based on the rules you set yourself. Safety notices in chats and temporarily hiding reported content in the Kartenbörse happen automatically, blocking accounts and finally removing content is decided by a person.

8. Changes

When the app or the website changes, we will update this policy. The current version is available at www.kartenscan.com/privacy/. The German version at www.kartenscan.com/de/datenschutz/ prevails.

The rules for using the app and the website, for example for the Kartenbörse, are set out in the terms of use.