Privacy policy

Last changed: 2026-11-14

This policy is for the iPhone app Amass – TCG Scanner and this website. It says what data the app uses, where the data goes, and how you can delete it. Questions: contact@amasscards.com.

In short: the app scans your cards on your phone. We get a photo only when you choose to send it: a report, or failed photos after you turn that on. We show no ads, we do not track you across apps or websites, and we do not sell or share your data.

1. Scanning happens on your phone

The app uses the camera and, when you pick a photo, your photo library, only to scan cards. The scan runs on your phone. Your photos, batches, answers and lists are saved on your phone. Deleting the app deletes them.

2. Reports (only when you send one)

When you tap Report on a photo, the app sends us:

the photo. The app sends the photo file as it is. If the file has location data in it (for example, a photo from your library taken with location on), that data goes with it;
your note and what you said is wrong;
the scan result (the cards found, names, scores and times);
the app version, the phone model, the iOS version and the device id (see section 4).

We use reports only to find and fix scanner mistakes.

3. Failed photos (only when you turn it on)

Send failed photos in Settings is off until you turn it on, and the app asks you first. When it is on, the app sends photos that the scanner got wrong (for example, a card it could not name or that you corrected), on Wi-Fi only, with the same kind of details as a report. We use them to test the scanner. We do not use them to train it. You can turn it off at any time.

4. The device id

The app makes a random id for your phone. It is not the advertising id, and it does not contain your name or phone number. It stays on the phone, also when you reinstall the app. It goes with reports and failed photos, so we can keep them together. The app also sends it when it asks our server if the testing tools are on for your phone. You can see it in Settings, under About this build.

5. Downloads: card data and prices

The app downloads card data packs and weekly price lists from our server, api.amasscards.com. These downloads send no personal data.

The app shows card pictures from Scryfall, TCGdex and pokemontcg.io. Your phone gets the pictures from them directly. Like every website, they see your IP address. Their own privacy policies apply.

6. Accounts (when you sign in)

Accounts are optional. You can use the app without one. When you sign in (with Apple, Google or your email), we use Supabase to keep your account. Then we store:

your email address (with Sign in with Apple, this can be a private relay address from Apple) and your user id;
your batches, answers, lists and settings, so you can use them on another phone;
your photos, only if you turn on photo backup.

Reports you send while signed in are linked to your user id. Your account data is stored with Supabase in the United States.

7. Our servers

Our server runs on Cloudflare. To answer your phone, Cloudflare handles your IP address and keeps short technical logs. We count requests per day, per route and per answer code. For errors we keep the error text. These counts do not contain IP addresses or photos. We delete error rows after 90 days and counts after 400 days.

Reports and failed photos go from Cloudflare to our own test computer. We keep them while we need them to test the scanner, and we delete them when you ask.

8. What we do not do

No ads, and no advertising id.
No tracking across apps or websites, and no outside analytics.
We do not sell your data, and we do not share it, except with the services named above that run the app for us (Cloudflare, Supabase).

9. How to delete your data

With an account: in the app, open Settings, then Account, then tap Delete account. This deletes your account and its batches, lists, settings and backed-up photos from our servers. It also asks us to delete the reports you sent while signed in. The copy on your phone stays until you delete the app.
Without an account: send an email to contact@amasscards.com with your device id (Settings, About this build, Copy). We delete the reports and failed photos from that phone.
On your phone: delete the app.

10. Children

The app is not made for children under 13, and we do not knowingly collect data from them. If you think a child sent us data, write to us and we delete it.

11. Changes

When this policy changes, we change the date at the top. If the app starts to collect new kinds of data, we change this page first.