Privacy Policy

Last updated: 20 September 2026

HoloKeep ("the app") is published by Rasilaben Talaviya ("we", "us"). This policy explains what the app handles, why, and what you can do about it. It covers the iOS app only.

1. What HoloKeep handles

• The photo you scan To identify the card. Sent to Google's third-party AI service. A copy is saved on your device if you save the scan.
• Card names you search To look up card details and prices. Sent to the TCGdex API.
• Your collections, favourites and settings To let the app work. Stored on your device only.
• Usage events and crash reports To see what is used and to fix crashes. Sent to Google Firebase.
• Purchase and subscription status To unlock what you paid for. Sent to RevenueCat and Apple.
• Advertising identifier Advertising, only if you allow it. Not used unless you tap Allow on the tracking prompt.

We never ask for your name, email address, phone number or postal address. There is no account to create and no password to remember.

2. Camera, photo library and what happens to a scan

The app asks for camera access so you can photograph a card, and photo library access so you can pick one you already took. Both are asked for only when you first use them, and both can be turned off at any time in iOS Settings. Declining either does not lock you out of the app: if the camera is unavailable you can still choose a photo, and if both are declined you can still browse the card catalogue.

A photo is only sent anywhere when you press the scan button. Photos are not read in the background, and the app has no access to the rest of your library beyond the image you pick.

When you save a scan, the photo and the result are written to a database on your device. They are not uploaded to us, and we have no server that could receive them.

3. AI service and third-party processing

Card identification is performed using Google's third-party AI service. The cropped photo is uploaded to lens.google.com, together with the question the app asks about the card, and the answer is read back. This means:

• Scanning requires an internet connection.
• The photo is processed by Google under Google's Privacy Policy and the terms that apply to Google services.
• We do not receive a copy on a server, and we cannot retrieve a photo you have deleted from your device.

If you do not want a photo processed by Google's third-party AI service, do not scan it. Every other part of the app works without scanning.

4. Card data and prices

Card details, artwork links and marketplace prices come from the free TCGdex API. Searching sends the card name you typed, and nothing that identifies you.

Prices shown in the app are estimates from public marketplace data. They are not an appraisal, not a quote, and not a guarantee of what a card will sell for.

5. Links to marketplaces

After a card is identified, the app offers ready-made searches on TCGplayer, Cardmarket, eBay and PriceCharting. These open in a browser view inside the app. Once a page loads, that company's own privacy practices apply to what happens there — we do not receive anything you do on those sites, and we have no control over them.

6. Analytics and crash reports

The app uses Google Firebase Analytics and Firebase Crashlytics to understand how features are used and to find crashes. What is sent:

• Events such as a scan being started, whether it succeeded, a collection being created, a store link being opened, and a purchase completing. Events describe actions, not content: the app does not send your photos, your card names or your collection contents.
• Device and app information such as device model, OS version, app version, language and country.
• Crash reports: the error, the stack trace and the state of the device when it happened.
• An app instance identifier generated by Firebase. It is not your Apple ID and it is reset if you delete the app.

Analytics and crash reporting are disabled in development builds. Firebase processes this data as described in Firebase's privacy documentation.

7. Remote configuration

The app fetches a small configuration file from Firebase Remote Config so that settings can be corrected without shipping an update. The request sends app and device information. It does not send anything about you or your collection.

8. Purchases

Subscriptions are sold by Apple and managed through RevenueCat. When you buy or restore a purchase, RevenueCat receives the App Store transaction information and an anonymous identifier it generates for your install, so the app can tell whether your subscription is active.

We never see your payment card, your Apple ID or your billing address. Those stay with Apple. RevenueCat's handling is described in its privacy policy.

9. Advertising and tracking

On first launch the app shows Apple's App Tracking Transparency prompt. If you choose Ask App Not to Track, the advertising identifier is not used and nothing is shared for advertising. If you choose Allow, the identifier may be used to make advertising more relevant and to measure it.

Every feature of the app works identically either way. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking.

10. Sharing and sale of information

We do not sell your information, and we do not share it for cross-context behavioural advertising beyond what is described in section 9. Information is shared only with the processors named in this policy — Google, TCGdex, RevenueCat and Apple — each for the single purpose described, and where required by law.

11. Keeping and deleting information

• On your device: collections, saved scans, favourites and settings stay until you delete them in the app, or until you delete the app. Deleting the app removes all of it.
• Analytics and crash data: kept by Firebase according to its retention settings, currently up to 14 months for event data.
• Purchase records: kept by RevenueCat and Apple for as long as they need them for billing and support.

To delete everything the app holds about you, delete the app. If you want analytics or crash data associated with your install removed, email us and we will request its deletion.

12. Security

Connections to Google, TCGdex, Firebase and RevenueCat use HTTPS. Data on your device is protected by iOS, including device encryption when you have a passcode set. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

13. Children

HoloKeep is a tool for collectors and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information through the app, contact us and we will act on it.

If a child uses the app on a shared device, we recommend declining the tracking prompt and using Screen Time restrictions to prevent purchases.

14. Where information is processed

The services above operate globally, so information may be processed in countries other than yours, including the United States. Those transfers are governed by each provider's own safeguards.

15. Your choices

• Decline or revoke camera and photo access in iOS Settings.
• Decline or change tracking in iOS Settings → Privacy & Security → Tracking.
• Simply do not scan, if you would rather no photo were processed.
• Delete a saved scan or a whole collection from inside the app.
• Delete the app to remove everything stored on the device.
• Contact us to ask what is held about your install, or to have it deleted.

Depending on where you live you may have further rights — access, correction, deletion, portability, or objection to processing. Email us and we will respond.

16. Changes

If this policy changes, the date at the top changes with it, and material changes will be noted in the app's release notes. Continuing to use the app after a change means you accept the updated policy.

17. Contact

Questions, requests or complaints: gurukarupamenufechar237@gmail.com