Privacy

The short version

• No ads and no ad networks. The one analytics tool is Google Analytics, which counts visits and page views — see below for exactly what it gets.
• Your taste profile and saved cards live in your browser first.
• We never sell or rent your data, and we run no email marketing.
• Signing in is optional and only ever asks Google for your email address and name.
• You can wipe everything yourself from the ⋯ menu — no request, no waiting.

What stays in your browser

Swiping writes to your browser’s local storage under four keys: your taste profile (the weights the deck learns), the cards you have already been shown, your Wanted list, and your Owned list. This is what makes the app usable with no account at all. Clearing your browser data, or choosing Delete everything from the ⋯ menu, removes it.

We set no advertising cookies. If you sign in, Supabase (our authentication provider) stores a session cookie so you stay signed in — that is the only cookie the app relies on. Google Analytics sets its own cookies to tell a returning visitor from a new one; the analytics section below covers what it collects.

What we store on our servers

When you first swipe, the app creates an anonymous account — a random identifier with no name, no email and nothing linking it to you. Against that identifier we may store:

• Swipes — the card, whether you liked, passed or already own it, and the reason line we showed you, so we can tell whether those explanations actually help.
• Wanted and Owned — the cards you saved, so they survive a new device once you sign in.
• Outbound clicks — when you tap through to eBay we record the card, whether it was the graded search, and a short random token. See below.
• Guesses — when you answer a round of Guess the Pokémon we record the card, which Pokémon it was, and whether you got it right. That is what lets a card say how often people get it right; we never show anyone which answers were yours.

We do not store your IP address or your browser’s user-agent string against any of this. The one device detail we keep on a click is a coarse “mobile” or “desktop” hint.

Signing in with Google

Sign-in is optional; it exists so your collection follows you to another device. If you use it, Google tells us your email address, your name and your Google account identifier, and nothing else. We do not get your password, your contacts, or access to any other Google service. Signing in attaches those details to the anonymous account you already had, so the cards you saved before signing in come with you.

eBay links and affiliate tracking

PokeDiscover is a member of the eBay Partner Network, and of TCGplayer's affiliate program via Impact and earns a commission on qualifying purchases made through those links. That is the only way the app makes money — it costs nothing to use, and there are no ads.

Those links carry a short random token so that a sale reported back to us can be matched to the card that produced it. The token is meaningless on its own; it is not derived from anything about you, and eBay never receives your identity from us. Once you land on eBay or TCGplayer you are on their site, subject to their privacy notice, and they will set their own cookies. The reporting we get back is aggregate: clicks and commissions, not who bought what.

Analytics

We use Google Analytics to see how many people visit and which pages they use — the numbers that tell us whether the app is worth improving and what to improve first. It receives page views and the coarse facts every analytics tool collects: browser and device type, screen size, country, and which page led to which. It does not receive your card lists, your swipes, your taste profile, your email address, or anything you typed.

Ad personalization is not something we use it for — there are no ads to personalize. If you block the tag with a content blocker, everything on the site keeps working; nothing here depends on it.

Who else is involved

• Vercel hosts the app and, like any web host, processes the requests your browser makes.
• Supabase provides the database and authentication.
• TCGdex supplies card data and card images. Images load directly from their servers, so your browser contacts them when a card renders; a small number of images come from pokemontcg.io the same way.
• Google — sign-in, if you choose to use it, and Google Analytics as described above.

Your controls

The ⋯ menu in the header has two destructive controls, and they do exactly what they say. Reset taste profile forgets what the deck has learned and keeps your saved cards. Delete everything erases your saved cards, your swipes and your taste profile — from this browser and from our servers, in the same action. No request, no waiting, no one to ask.

Use the contact form — leave your email and a reply comes back to it.

Children

Plenty of the people who love Pokémon card art are children, and this app is written for them as much as anyone. We do not pretend otherwise, so we keep the data side small instead.

The app never asks anyone for a name, an age, a photo or a phone number, and you can use all of it without signing in — an account made by swiping is a random identifier with nothing attached to it. Signing in with Google is the one exception, and it is optional: if you use it, Google passes us the email address and name on that Google account, as the section above describes.

We show no adverts and we build no advertising profiles. Nothing anyone does here is shown to other people: saved cards are private to the account that saved them, and the guessing game publishes only how often an answer is right across everybody, never whose answer it was.

Buying happens somewhere else. Card links lead to eBay and TCGplayer, which are separate shops with their own rules, their own checkouts and their own privacy policies, and we earn a commission when a purchase is made there.

Anyone can wipe everything the app has stored, at any time, from the “⋯” menu → Delete everything. If you are a parent and would rather we did it for you, contact us and we will.

Changes

If this policy changes in a way that affects what we collect, the date at the top of this page changes with it. Continued use after a change means you accept the revised policy.

See also the Terms and About.