Legal

Privacy Policy

Advertising and consent

This website carries Google AdSense, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To deliver and account for ads, AdSense stores identifiers on your device (cookies and comparable techniques) and processes, among other things, your IP address, device type, browser and the page you are on. Data may be transferred to the United States in the process.

This happens only with your consent. The legal basis is Art. 6(1)(a) GDPR together with § 165(3) TKG 2021 in Austria (§ 25 TDDDG in Germany). Nothing is stored before you decide: the site sets Google's consent signals to "denied" up front, before any Google service is loaded at all. Consent itself is collected through Google's own consent management, certified under IAB TCF v2.2, which appears on your first visit.

You can withdraw or change your consent at any time with effect for the future by reopening the consent management; it stays reachable from the notice at the foot of the page. If you decline, the intake bench works exactly as before — you will then see no ads, or only non-personalised ones.

No card images and no recognition results are passed to the ad platform. Ads are not targeted on scanned cards and are labelled as advertising. Details on Google's processing: policies.google.com/technologies/ads.

Analytics

This site uses Umami, a self-hosted web analytics tool running on our own server — not with an external provider. No cookies are set, nothing is stored in localStorage, and no browser fingerprinting is performed. Umami derives the session server-side from a daily-rotating hash, so no visit can be linked to a person across days.

Because no identifier is stored on your device for this, audience measurement needs no consent; it therefore runs independently of what you choose in the consent banner, which is there for the advertising. The legal basis is the legitimate interest in data-frugal audience measurement, Art. 6(1)(f) GDPR. What's recorded is which pages were visited and the events defined in tracking.js (e.g. camera turned on, scan started, language switched). Umami does not permanently store the IP address.

A campaign parameter (?ref=) is read and attached to this visit's events, to attribute channels such as Discord or store listings. This does not create any device- or person-level ID.

Every call to Umami is guarded against an outage or a blocker: if the analytics host or tracking.js is unreachable, the site keeps working exactly as before — nothing is recorded, that's all.

Camera and image data

The camera starts only after your browser permission. Capturing or uploading a card sends the selected image to our recognition service. The sample scan does not transmit an image. Photograph only the card and avoid personal information in the background.

Text recognition runs on our server. If it cannot identify the card, deeper analysis may use local or external AI services through our model platform. Asynchronous scans store image, result and diagnostic files on the server; no automatic deletion period is currently configured. The pricing feature does not send card images or identifiers to advertising services. The browser session list stays in memory and is lost on reload. Downloaded exports remain on your device.

For a price lookup you request, card identifiers such as set, number, name and selected language are sent to TCGdex through our server. TCGdex receives no card photograph and no direct connection from your browser. Responses are cached on the server for up to 24 hours. Opening a Cardmarket link connects your browser to Cardmarket, where that provider's terms apply.

Disclosure to third parties

In addition to the advertising services described above, external services may participate in deeper card recognition and TCGdex in price lookups. Typefaces are loaded from Google Fonts, transmitting your IP address to Google. Audience measurement is self-hosted. TCGdex describes its processing in its privacy policy.

Your rights

To the extent personal data is processed, you have the right to access, rectify, erase, and restrict processing, as well as the right to lodge a complaint with the Austrian data protection authority (dsb.gv.at). Requests go to the email address listed in the imprint.