Privacy Policy

1. Who is responsible

The controller of your personal data is Alexander Martinovic AB, company number 559329-0629, Lövaskog 6, 516 92 Äspered, Sweden. You can contact us about anything in this policy at geia.gr@pokeowl.com or through our contact form.

Because we are established in Sweden, we process personal data under the EU General Data Protection Regulation (GDPR), wherever you live. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply as well. Where the law of your own country gives you further protection, we respect that too.

2. What we collect, why, and on what legal basis

• Your account: your email address and a password (stored only in hashed form), or the name and email address Apple or Google shares with us if you sign in with them. Legal basis: contract (GDPR Art. 6(1)(b)), because we need them to give you an account.
• What you do with your account: watches, favourites, your collection, your settings and the alerts we send you. Legal basis: contract; it is the service you asked for.
• Your subscription: your plan, its status, trial and renewal dates, and the transaction identifiers from Stripe, the App Store or Google Play. We never see or store your full card details. Legal basis: contract, and our legal obligation to keep accounting records (Art. 6(1)(c)).
• Messages to us: what you write in the contact form or by email, so we can answer. Legal basis: our legitimate interest in replying to you and improving the service (Art. 6(1)(f)).
• Clicks to shops: when you follow a link to a shop, our server logs which product and shop, the time, the part of the site the click came from, the rough device type and whether the click looked valid. Signed-in clicks are tied to your account; for everyone else we use a pseudonymous, salted key that does not identify you. We do not store your IP address for this, and it uses no cookie. Legal basis: our legitimate interest in attributing traffic to shops correctly, preventing click fraud and reporting to shops in aggregate.
• Photos in the grading tool: if you photograph a card for a grading estimate, the images are resized in your browser (which strips location data) and sent to Anthropic, which reads them for us. We do not keep the images; we keep only a record that an estimate was made, so we can apply the usage limit. Legal basis: contract.
• Linking a referral link to an app install: if you open a referral or creator link (for example a link with `?ref=CODE`) in the browser on your phone and then install and open our app, we can connect the two visits so that the person who shared the link is credited without you typing the code. For this we store, for at most 30 minutes, a keyed hash (a salted hash, HMAC-SHA256) of your IP address (for IPv6, of the network part), your platform (iPhone or Android), your operating system major version, the code in the link you opened and the market it was opened on. We never store or log the IP address itself for this, and the hash cannot be turned back into the address without our secret key. The first time the app opens it asks once whether exactly one code was opened from the same network, on the same platform and OS version, in the last 30 minutes; if exactly one was, the app receives it and the record is marked used and cannot be used again, and if there are several or none, nothing happens. After 30 minutes the record is deleted; a random number that belongs to that one request, so a retry gets the same answer, is kept for at most one day. The data is not shared with anyone, not used for advertising, and does not follow you across websites or apps; only our database and hosting providers process it on our behalf. You can object at any time (see section 6). Legal basis: our legitimate interest in crediting a referral link you chose to open (Art. 6(1)(f)).
• Usage statistics: anonymous statistics about how the site is used, sent from our own server to PostHog (EU region), with no names, email addresses or payment details. Legal basis: our legitimate interest in understanding and improving the service.
• Analytics, session recordings and ad measurement: only if you choose "Accept all" in the cookie banner. See our Cookie Policy for the details. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time on the Cookie Policy page.
• Ad measurement in the app: only if you say yes to the app's own question; the app may then read your device's advertising ID together with install and activation events for Meta's measurement. Legal basis: consent, which you can withdraw in the app's settings.
• Preventing abuse: to stop the free trial being repeated, we keep a fingerprint Stripe gives each payment card (not the card number) with the trials it has been used for. Legal basis: our legitimate interest in preventing abuse.

We send marketing emails only with your separate consent, and you can unsubscribe through the link in every email. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Who we share data with

We use service providers that process personal data on our behalf and under our instructions:

• Supabase (database and sign-in, EU region) and Vercel (hosting);
• Stripe (payments on the web) and our email delivery provider;
• PostHog (usage statistics and, with consent, session recordings, EU region);
• Anthropic (reading the photos in the grading tool, United States);
• Google and Meta (analytics and ad measurement, only with your consent).

If you buy in the app, Apple or Google processes the payment as an independent controller under its own privacy policy. Shops never receive your account, your visitor key or anything else that identifies you: only aggregated statistics and an anonymous click identifier.

We do not sell your personal data. We may disclose data where the law requires it, to protect our rights, or to a buyer of the business, who would then be bound by this policy.

4. International transfers

We keep our main database in the EU. Some providers above are based in, or may access data from, the United States or other countries outside the EU/EEA. Where they do, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses, and for UK data by the UK equivalents. You can ask us for a copy of the relevant safeguards.

5. How long we keep data

• Account data, watches and your collection: for as long as you have an account. When you delete it, they are deleted, normally at once and at the latest within one month.
• Raw click logs: at most 13 months, then anonymised or deleted.
• Subscription and payment records: for as long as Swedish accounting law requires (currently seven years).
• Messages to us: for as long as needed to deal with them, and at most two years after the last message.
• Analytics and ad measurement data: as set out in the Cookie Policy and the providers' own retention settings.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to our processing (including an absolute right to object to direct marketing), to receive your data in a portable format, and to withdraw a consent at any time without affecting what happened before (GDPR Arts. 15 to 22).

To use a right, email geia.gr@pokeowl.com. You can delete your account yourself in your account settings. We answer within one month, and may ask you to confirm your identity first.

7. Complaints

Please contact us first, and we will try to put it right. You also have the right to complain to a data protection authority, in particular in the country where you live or work, or where you think your rights were infringed.

Because our only establishment is in Sweden, our lead supervisory authority in the EU is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se. In the United Kingdom you can complain to the Information Commissioner's Office.

8. Your local rights

If you live outside the EU, the EEA and the UK, the data protection law of your country may give you further rights, for example to be told about a data breach, to have data corrected or deleted, or to complain to your local data protection authority. We give everyone the rights described above, wherever they live, and we will honour any further rights your local law gives you. Contact us at geia.gr@pokeowl.com.

9. Children

PokeKynigi is not directed at children under 13, and we do not knowingly collect their personal data. If you are a parent or guardian and believe your child has given us personal data, contact us and we will delete it.

10. Security

We protect your data with encryption in transit, hashed passwords, access controls and providers that meet recognised security standards. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires.

11. Changes to this policy

We will update this policy when our processing changes. The date at the top shows the latest version, and we will tell you about material changes by email or on the site before they apply.