Privacy Policy

Chaser ("we," "our," or "us"), developed by AruAI Labs, is a Pokémon Trading Card Game app for scanning, pricing and trading cards. AruAI Labs is the data controller responsible for your information. This Privacy Policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have.

It covers the Chaser mobile app (available on Android through Google Play, with iOS to follow) and the chasertcg.com website. By using Chaser, you agree to the collection and use of information as described here. If you do not agree, please do not use the app.

Account information

• Email address and password if you sign up with email. Your password is stored hashed by our authentication provider; we never see it in plain text.
• If you use Google Sign-In: your name and email address from your Google account.
• If you use Sign in with Apple: the name and email Apple shares with us. If you choose to hide your email, we receive an Apple private relay address instead.
• Your username (@handle) and your home country and city, which we ask for the first time you sign in and use for Trade.
• Authentication tokens that keep you signed in.

Card photos and results

• Photos of cards you take or share for a quality scan, Card Assess, Deal Scan (for example a photo of cards shared from a WhatsApp or Telegram group), or when you share an image into Chaser.
• The results we produce: card identity (name, set, number), condition and grade estimates, prices, and buy/pass verdicts.
• Card Assess results you choose to save while signed in, so you can see them on your account.

Trade marketplace

• Listings you post: the cards, photos you take of them, notes, asking prices, and the city and country of the listing.
• Your trade wishlist, used to match you with listings.
• Private chat messages between you and the other party of a trade.
• Reports you make, blocks you set, and your trade history.

Purchases and credits

• Purchase tokens, order IDs, product and subscription status from Google Play (and, when available, Apple In-App Purchase). We never receive your card number or other payment details.
• Your credit balance, plan, and credit transaction history.
• Promo codes you redeem.

Device and technical information

• A device identifier.
• A Firebase Cloud Messaging push token, so we can send you notifications such as trade messages.
• Crash reports and diagnostics through Firebase Crashlytics.
• Debug logs: device model, operating system version, app version, memory and storage figures, and recent errors.
• IP addresses, used for rate limiting and abuse prevention, and recorded in admin audit logs and promo-redemption fraud logs.
• API usage logs: which features you used and, for AI features, how many AI tokens were used. We use these to control costs.

Information that stays on your device

Some information is stored only on your phone and is never sent to us: seller contact details you save in your "Potential Buy" list (phone number, name, asking price and notes), your scan history, and local caches. It is removed when you clear the app's data or uninstall the app.

The chasertcg.com website

• If you join the waiting list: your email address, the type of phone you use, an approximate location derived from your request (city and region based on your IP address), and your browser's user agent.
• Google Analytics 4 runs on the site and collects information about pages visited, device and browser type, and approximate location.

We use the information above to:

• Create and run your account and keep you signed in
• Identify cards, estimate condition, and show prices and verdicts
• Run the Trade marketplace: show listings, match wishlists, deliver chat messages and send notifications
• Process purchases and manage your credits and plan
• Prevent fraud, spam and abuse, enforce our Terms, and moderate reported content
• Diagnose crashes and errors and improve the app's performance
• Control the cost of AI and data services
• Tell waiting-list members when Chaser is available on their phone
• Comply with legal obligations

We do not sell your personal data. We do not show ads, and we do not track you across other apps or websites.

When you use an AI feature, the card photo is sent to Google Gemini to identify the card and assess its condition. If Gemini is unavailable, the same request may be processed by Anthropic (Claude) or OpenAI instead. These providers process the photos under their API terms.

To avoid processing the same photo twice, we may keep a hash (a short digital fingerprint) of the image together with the identification result for up to 7 days. We do not use your photos to train AI models.

Please only photograph cards. Avoid including people, documents or other personal information in your photos.

Trade is a public marketplace, so some of what you post is visible to others:

• Listings (cards, notes, asking prices), your @handle, and the city and country of your listings are shown to other signed-in users.
• Card photos you add to a listing are stored on our servers and can be opened by anyone who has the photo's link. We remove EXIF data, including location metadata, from these photos before they are stored.
• Chat messages are private between you and the other party of the trade.

You can report or block other users. Listings that receive 3 reports are hidden automatically and reviewed. We may access listings and messages when needed to investigate reports, enforce our Terms, or comply with the law.

We share information only with the providers that help us run Chaser, and only what they need to do their job:

• Supabase — database, authentication and file storage
• Vercel — hosting for our servers and website
• Google — Firebase (Crashlytics and Cloud Messaging), Gemini (AI processing), Google Play (billing), Google Sign-In, and Google Analytics on chasertcg.com
• Apple — Sign in with Apple and, later, In-App Purchase
• Anthropic and OpenAI — fallback AI processing

Prices come from third-party market data providers (Pokemon Price Tracker, which includes TCGplayer, eBay sold listings and Cardmarket data). We send them only card identities, never your personal data.

Other users see the Trade content described in section 5. We may also disclose information if required by law, or to protect the safety, rights or property of our users, the public, or AruAI Labs.

• Account data is kept while your account is active.
• When you delete your account, we delete the account and its associated data within 30 days. This includes your profile, credits, credit transactions, purchase records, saved assessments, trade listings, chats, wishlist, push tokens and trade photos.
• We keep minimal security and audit records (admin audit log entries, which may include an IP address) for up to 12 months for fraud prevention and legal compliance.
• Usage and rate-limit logs are kept for up to 90 days.
• Cached image hashes and identification results are kept for up to 7 days.
• Crash diagnostics are kept according to Firebase Crashlytics' retention period.
• Waiting-list entries are kept until you ask us to remove them.
• Information stored only on your device stays there until you delete it or uninstall the app.

Depending on where you live, you can:

• Access the personal data we hold about you
• Ask us to correct inaccurate information
• Ask for a copy of your data
• Delete your account and associated data
• Object to or restrict certain processing
• Withdraw consent at any time

Delete your account: in the app, open Settings and tap Delete Account. You can also request deletion without the app — see our account deletion page.

Other requests: email support@chasertcg.com from the email address on your account. We respond within 30 days.

Notifications: turn push notifications on or off in Settings, or in your phone's settings.

If you are not satisfied with our response, you can contact your local data protection authority.

Chaser is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. Where local law requires a higher age or parental consent, users below that age need a parent or guardian's consent to use Chaser. If you believe a child has given us personal information without the required consent, contact us and we will delete it.

We protect your information with:

• Encrypted HTTPS connections for all data in transit
• Row-level security policies on our database
• Hashed passwords and securely stored sign-in tokens
• Location metadata removed from Trade photos
• Access to personal data limited to people who need it

No system is completely secure, but we work to protect your data and will act quickly if a problem occurs.

AruAI Labs is based in the United Arab Emirates, and our service providers may process data in other countries, including the United States. When data is transferred, we rely on appropriate safeguards in line with applicable data protection laws, including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new "Last updated" date, and significant changes will be highlighted in the app. Continued use of Chaser after changes means you accept the updated policy.

For privacy questions or to exercise your rights: