Who is responsible

Zukan (the "app") is published and operated by OBAM CORP, a French EURL registered for VAT under FR19930292438 [registered postal address to be completed before publication], the data controller for the purposes of the GDPR. You can reach us at support@getzukan.com.

What stays on your device

Everything that makes up your collection is stored locally, in a database on your phone:

the cards you own, their quantities, conditions, and the price you paid;
your scan history and any scan that failed to identify a card;
your settings — language, currency, display preferences;
the local backups the app writes for you, and any CSV you export.

None of it is sent anywhere unless a section below says otherwise. Settings → Data → Erase all data deletes it, and deleting the app deletes it too.

Your camera and your photos

Zukan asks for camera access for one purpose: reading the text printed on a card. The recognition runs on your device, using the text-recognition engine built into iOS and Android. The image is analysed in memory and discarded — it is not saved to your photo library, not sent to us, and not sent to any third party.

A cloud-assisted recognition fallback exists in the source code for development builds only; it is disabled at compile time in every build distributed through the App Store or Google Play, and no image can reach it.

What leaves your device

Card data and prices

To identify a card and price it, the app queries card catalogues and price sources (currently TCGdex and pokemontcg.io) and Zukan's own backend. These requests carry the card reference being looked up. They carry no identifier of you, and no content of your collection.

Backup and sync

When cloud backup is active in your build of the app, Zukan creates an anonymous account on our backend (hosted on Supabase, in the European Union) the first time it runs. Anonymous means literally that: a random identifier is generated on the device, and no email address, no name, no password and no phone number is asked for or stored. That account holds a mirror of your collection, your daily scan counter, and whether you are subscribed — nothing else. It exists so a reinstall does not cost you your collection.

Purchases

Subscriptions are sold and billed by Apple or Google, and managed through RevenueCat. We never see, receive or store your payment method, your card number or your billing address — the stores do not give them to us. What we receive is whether a subscription is active, and until when. Under the App Store privacy labels this is Purchase History, collected, not linked to your identity and not used for tracking.

If you write to us

If you email support, or use the app's "Report a missing card" button, we receive your email address and whatever you write. We use it to answer you, and we keep the exchange no longer than we need to.

What Zukan never does

No advertising, anywhere in the app, and no advertising identifier — the Android AD_ID permission is stripped from the build.
No analytics SDK, no crash-reporting SDK, no third-party tracker.
No sale of data, no sharing of data with advertisers or brokers. There is nothing to sell.
No cross-app or cross-site tracking, and therefore no App Tracking Transparency prompt.
No profiling and no automated decision-making with legal effects.

Legal basis and retention

Data	Why	Kept for
Collection, scans, settings	Performance of the service you asked for	Until you erase it or delete the app
Anonymous backup mirror	Performance of the contract	Until deletion is requested; inactive accounts are purged
Purchase status	Performance of the contract — knowing what you paid for	Duration of the subscription plus the legal accounting period
Support emails	Legitimate interest in answering you	Up to 12 months after the exchange ends

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to its processing. Most of it you can exercise yourself, immediately, without asking anyone: Settings → Data → Export collection (CSV) is portability, and Settings → Data → Erase all data is erasure.

For the server-side backup mirror, write to support@getzukan.com from the device concerned and we will delete it. Because the account is anonymous, we have no way to find your data from an email address alone — we will tell you what we need. You may also lodge a complaint with your national supervisory authority; in France, the CNIL.

Children

Zukan is a general-audience app. It asks for no personal information from anyone, of any age, and creates no profile. We do not knowingly collect personal data from children, and there is no mechanism in the app by which a child could supply any.

Transfers outside the EU

The backup backend is hosted in the European Union. Apple, Google and RevenueCat are United States companies and process purchase data under their own terms and the European Commission's standard contractual clauses.

Changes

If this policy changes, the date at the top changes with it. A change that materially affects what we collect will be announced in the app before it takes effect.

Contact

support@getzukan.com