Last updated: 27 September 2026
The short version: photos of your cards are processed on your phone and never sent to any server, your collection is stored only on your device, and you don't need an account to use the app.
Eric Fernández, the developer of PriceSpot TCG. You can reach me at ericfernandez1994@gmail.com about anything in this policy or about your data.
The app needs camera permission to recognise cards. Recognition happens entirely on your phone: both AI models and the card catalogue ship inside the app itself.
If you record a video of the scanner or create a summary video of a session, that video is produced on your phone, saved in your gallery (Movies/PriceSpot folder) and only leaves it if you share it. We never receive a copy.
Videos have no sound by default. If you have PRO and turn on "Record sound in burst videos" in Settings, the app asks for microphone permission and uses the microphone only while you record: the sound goes into the video, on your phone, and is never sent to any server. You can turn it off or revoke the permission at any time.
The cards you add, quantities, condition, what you paid and any notes are stored in a local database inside the app. Nothing is uploaded. Uninstalling the app or clearing its data removes that information from the device, and we hold no copy.
The CSV export creates a file you control and share with whoever you want: it does not pass through our servers.
Android backup. The app keeps a small file with your collection (cards, quantities, purchase prices and value history). If Android backup is turned on on your phone, the system may store it in your Google account and give it back when you switch phones. That backup is managed by Google, not by us, and we have no access to it. You can turn it off in Android settings.
If you turn on cloud backup, your collection (cards, quantities, purchase prices and value history) is encrypted on your phone with a key derived from a 32-character recovery code, and only the already-encrypted block is uploaded to our server. We cannot read your collection: we do not have the key.
All we keep on the server is that encrypted block, an account identifier derived from the code (it does not say who you are), the hash of an access token and the creation and last update dates. We do not ask for an email, a name or a password, and the server does not log backup requests.
If you lose the code we cannot recover your backup. You can delete it whenever you want from Settings → Cloud backup → “Turn off and delete from the cloud”; it is removed from the server immediately and syncing stops on all your phones. If you lost the code and want the copy removed, write to us with any part of the code you remember; otherwise note that without the key nobody can read the block.
The app makes network requests for these things only, and none of them send any information about you or your collection:
tcg.bytora.es). It is the same file for everybody; the server
does not know which cards you own.tcg.bytora.es/app/config.json),
the same for everybody, which lets us ask you to update the app if there is a
serious bug, or switch off a feature that is failing.tcg.bytora.es/app/cambio.json),
published by the European Central Bank, for the travel calculator. It is the same
file for everybody.None of these requests carries an identifier of you or your phone, and they are not linked to each other: our server may know which card was looked up, but not who looked it up or which cards they own.
Shopping links. The Amazon and eBay buttons open their website or app with our affiliate code: if you buy something we may earn a commission at no cost to you. From then on, what you do in that shop is handled by Amazon or eBay under their own privacy policies.
Like any web server, ours writes the IP address, the date and the requested file of each request to a technical log. It is used only for security and to detect faults, and is deleted automatically after 7 days.
The free version shows Google AdMob ads. Never inside the scanning screen.
Google may use device identifiers to serve ads and measure their performance. Before any ad loads, the app asks for your consent through Google's official form, where you can accept, reject or choose option by option. You can change that decision at any time from the app's settings.
How Google handles that data is described in their own policy: policies.google.com/technologies/partner-sites.
The PRO subscription removes advertising completely.
Subscriptions are handled by Google Play Billing. Payment details are handled by Google directly: we never see or store card or bank details. All we receive from Google is whether your subscription is active.
The app is not specifically directed at children under 13 and does not knowingly collect personal data from them. If you are a parent or guardian and believe a child in your care has given us any data, write to us and we will delete it.
Because your collection data lives only on your device, you have direct control: you can view, edit, export or delete it from inside the app, or remove all of it by uninstalling the app or clearing its data in Android settings.
For advertising data, Google is the controller and you can exercise your rights with them; you can also withdraw your consent at any time from the app's settings.
If you live in the European Union and believe your data protection rights have not been respected, you may complain to your national authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).
If any of this changes, this page and the date above will be updated. If the change genuinely affects how your data is handled, you will be told inside the app.