Privacy Policy
Effective 2026-08-18
OWNED is operated by Eros Media LLC, 1000 Brickell Ave, Suite 715, Miami, FL 33131 (“OWNED”, “we”, “us”).
This policy explains what we collect, why, who else sees it, and what you can do about it. We have tried to write it so that it describes this software, rather than describing a category of software.
1. The short version
- You photograph a card. We send that photo to an AI service to read what card it is. We do not store the photograph from an ordinary scan. You may separately choose to donate a photo for recognition review.
- We keep your email address, the cards you save, and counters that stop the service being abused.
- Optional product analytics are off until you choose them. Advertising measurement and session replay are off in this build, and we do not sell your information.
- You can export everything you have saved at any time and delete your account. Bounded opaque cleanup and session-revocation records remain only for their stated completion or expiry periods.
Detail follows. Where something is a limitation rather than a feature, we have said so rather than leaving it out.
2. Where OWNED came from
We acquired this software from a different company that ran a Pokémon card business. No user data came with it. OWNED starts with an empty database. Nobody’s account, collection, or email address was carried over, and no information about you exists here unless you gave it to us yourself.
3. Card photographs
What happens. The native app allows a limited number of guest scans; saving a card requires an account. When you scan a card, your device sends the photograph to us. The collection scanner sends it to TCGAPIs to identify the card. If that result is empty or uncertain, we may send the same photograph to Ximilar as a second recognition source. Our legacy single-card scanner uses OpenRouter. What comes back is text — the card’s name, set, number, and any grader label it can read. We keep that text. We do not store an ordinary scan photograph in our database, in our record of your scan, or in the holding we create when you save the card.
Photos kept for your review. If you choose to review a possible match later, the native app keeps the photo and suggested matches on your device for up to seven days. You can delete them sooner. On the website, possible matches stay only while the scan page is open. These review queues do not donate a photo to us.
Optional donated photos. After checking the exact printing, you may separately opt in to share a scan photo and the corrected catalog identity for private recognition review. Access to the photo and its review record expires after 30 days; the private storage bucket is configured to delete photos aged 30 days. It is not public, is not part of your collection, and is not counted as an independently verified accuracy label until an operator checks it. This choice is separate from anonymous scan feedback.
How OpenRouter handles it. OpenRouter is a routing service: it selects an artificial-intelligence model provider to handle each request, and may use different providers at different times. Those providers process the image on OpenRouter’s behalf and act as our subprocessors. OpenRouter publishes the providers it uses and their data policies, and we configure our account to restrict routing to providers whose terms are consistent with this policy.
What our routed AI provider does with it. OpenRouter selects a model provider for each request, and that provider handles your photograph under its own retention policy. Our account is configured so that no provider may use what we send to train its models. We do not require providers that guarantee zero retention, so an image may be held for a period before deletion. We do not keep the photograph ourselves, and we do not send your account or your identity with it.
Other recognition providers. TCGAPIs and Ximilar receive a photograph only when their recognition path runs. Their handling is governed by our provider account terms and their published privacy policies.
What else might be in the photo. We ask for a picture of a card, and our system is built to read cards only. But a photograph captures whatever you point the camera at — your hand, your desk, whatever is behind the card. We do not detect, remove, or analyse anything other than the card. Please frame the card and not something you would rather not share.
Your control. Scanning is always something you start. The app never opens your camera on page load, and nothing is sent until you explicitly choose a photo or press the capture button.
4. What else we collect
Your account
Your email address, and whether you are signed in. We sign you in with a link emailed to you.
Your collection
The cards you save: which card, how many, what condition, when you added it, and optionally what you paid. This is your record of things you own, and we treat it that way.
Operational data
| What | Why |
|---|---|
| Whether a scan succeeded, which model ran, roughly how large the image was, what it cost us | Keeping the service running and affordable |
| Rate-limit counters keyed to your IP address | Stopping automated abuse |
| A random device id, if you scan without an account | Counting your three free scans |
| Your answer to “Is this the right card?” | Measuring how accurate our identification is |
- Scan feedback is anonymous and aggregated. If you opt in and answer whether we showed the right card, we count the outcome by recognition-service release, game, camera-or-library source, and raw-card-or-slab mode. We use a one-way receipt to prevent duplicate counting, but do not retain the card identity, your account, your IP address, OCR text, or the photograph with that accuracy counter.
Scanning without an account
You can scan three cards before making an account. To count those three, the app generates a random identifier the first time you scan and stores it on your device. It is sent with each scan so we know how many of the three are left.
- It is random, not your device. It is not derived from your hardware, your advertising identifier, or anything else about your phone, and it means nothing outside this app. We never read a device or advertising identifier to create it.
- We store it hashed. The server keeps a one-way hash of it against a scan counter, not the identifier itself, and uses it for nothing but that count.
- You can clear it. Deleting the app removes it. It is not linked to an account, so if you later make one, the scans you keep are attached to that account and the guest counter stops being used.
Optional product analytics
If you turn on Product analytics, we send bounded events about account setup, searches and scans, saved-card and portfolio features, alerts, app reliability, and subscription status. We use them to understand where people get stuck, whether features provide value, and whether releases are reliable. Events use a pseudonymous identifier rather than your email address.
Product analytics exclude card photographs, search text, card names, collection notes, filenames, document contents, exact collection or purchase values, payment details, credentials, precise location, and raw provider errors. Turning the control off immediately stops future product-event capture on that device. Product analytics are separate from advertising measurement.
A saved analytics preference cannot start a provider until the current web or app session is checked with our server using the server-issued session window. Queued product events expire after 89 days and are checked again before delivery, inside the 90-day deletion-cleanup period.
Session replay
Session replay is a separate control and is off and unavailable in this build. If a compatible replay integration later passes legal and physical-device review, it will still require a separate choice, mask all text and element attributes, exclude scan, purchase, account, export, collection-detail, and deletion surfaces, and start with a 30 days retention target. Turning replay off stops it without restarting the app. The 30-day target is not a statement that replay is active now.
5. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
owned_session | Keeps you signed in | Session-based, HttpOnly |
We do not run advertising pixels or an advertising network. Optional product analytics use the choice stored on your device and are not advertising measurement.
6. Who else sees your data
| Who | What they do | What they see |
|---|---|---|
| Google Cloud | Hosts the service and stores our data | Everything we store |
| OpenRouter | Routes your card photographs to a model provider it selects | The photograph, and the text extracted from it |
| Model providers OpenRouter selects | Read your card photographs on OpenRouter’s behalf | The photograph, and the text extracted from it |
| TCGAPIs | Provides the primary collection-card recognition result | The photograph and selected game |
| Ximilar | Provides a second recognition result when the primary result is empty or uncertain | The photograph and selected game |
| Cloudflare | Delivers and protects the site | Traffic in transit, including your IP address |
| Twilio SendGrid | Sends account and price-alert emails | Your email address |
| PostHog | Processes optional product analytics; session replay remains disabled | Pseudonymous, allowlisted product events; no card images or free text |
| Google/Firebase | Processes selected product milestones and, when separately enabled, app reliability signals | Pseudonymous, allowlisted event and bounded reliability categories |
| RevenueCat | Verifies subscription entitlements and purchase lifecycle status | A pseudonymous app-user identifier and store subscription status, not payment-card details |
| TCGplayer, eBay | Marketplaces we link to | Only what your browser sends them if you click through |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Where your data is processed. the United States
7. How long we keep things
| What | How long |
|---|---|
| Ordinary scan photographs | Not stored by us |
| Native photos you keep for later match review | On your device for up to seven days, or until you delete them |
| Photos you explicitly donate for recognition review | Access expires after 30 days; bucket deletion begins at 30 days, or sooner if you delete one |
| Your account and collection | Until you delete it |
| Save records that stop duplicate entries | 30 days |
| “Is this the right card?” answers | 180 days |
| Rate-limit counters | Minutes to 24 hours |
| Session replay, if separately approved and enabled later | Initial target: no more than 30 days; replay is off now |
| Undelivered optional product events on your device | No more than 89 days; older events are dropped before provider delivery |
| Provider-deletion request | Through the 90-day maximum signed-session delivery horizon with daily erasure at PostHog, Google/Firebase, and RevenueCat, then until a final sweep confirms completion |
| Session-revocation record | No more than 90 days, matching the maximum lifetime of an issued session |
8. Your choices
Export. You can download your entire collection as CSV or JSON at any time, from your collection page. It is your data and it leaves in a format you can use somewhere else.
Correct. You can edit or remove any card in your collection.
Delete your account. You can delete your account and its locally stored data from your account settings. We show you exactly what will be removed first, and point you at the export. Local deletion cannot be undone; processor deletion or anonymization is repeated daily during the 90-day maximum signed-session delivery horizon and retried until a final sweep confirms completion.
Analytics controls. Product analytics and session replay have independent controls in Account settings. Replay cannot be enabled in this build. When you delete your account, we first create a durable, retryable request to delete or anonymize the pseudonymous identifier at PostHog, Google/Firebase, and RevenueCat. The request remains through the 90-day maximum signed-session delivery horizon so late provider events are erased again before a final confirmation. We also keep a temporary opaque security marker so old signed browser and native sessions and in-flight requests cannot reopen or rewrite the deleted account. Neither retained record contains your email address. We do not report deletion complete if either prerequisite cannot be saved.
Apart from the bounded provider-deletion and session-revocation records described above, we keep nothing after a deletion request.
Sign-in email. We only email you for sign-in and essential service notices unless you opt in to more.
How to reach us. support@owned.app
9. Children
You must be at least 13 to have an OWNED account. We ask for your date of birth when you sign up.
We do not keep your date of birth. We use it to work out whether you meet the minimum age, store only the answer and the date we checked, and discard the rest. If you are under the minimum we do not create an account and we keep nothing about you at all.
This is an age check, not age verification — we cannot confirm what you enter.
10. Security
Sessions are signed. Administrative access requires both an allowlisted address and a verified session, and the admin surface is disabled rather than open when that allowlist is unset. Credentials live in Google Secret Manager, not in configuration files. Our database is not directly reachable by any client; every read and write goes through our server.
No system is perfectly secure, and we will tell you if something happens that affects you.
11. Changes
If we change this policy materially, we will say so here and update the date. If the change affects how we handle card photographs, we will tell you directly rather than only updating this page.
12. Contact
Eros Media LLC, 1000 Brickell Ave, Suite 715, Miami, FL 33131. Privacy enquiries: support@owned.app.
See also our Terms of Service.