Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data OYAJITCG collects, why, who helps us process it, how long we keep it and what your rights are. It applies to the OYAJITCG apps for iOS and Android and to the website oyajitcg.com (together, the "Service").
1. The short version
- We collect only what we need to run your account and keep your collection in sync.
- Your account data is stored in the European Union.
- No ads. No tracking. No analytics. We do not sell your data and we do not share it for advertising.
- The website sets no cookies.
- You can export your data and delete your account from inside the app at any time.
2. Who is responsible for your data
The Service is operated by an individual:
Jorge Ribeiro, trading as OYAJITCG
Contact for all privacy requests: [email protected] (subject "Privacy")
Under the EU General Data Protection Regulation (GDPR) Jorge Ribeiro is the "controller" of your personal data. No data protection officer has been appointed: OYAJITCG is a small operator and does not carry out large scale processing of personal data, so the law (GDPR article 37) does not require one.
If the Service is later transferred to a company, we will tell you before it happens and update this policy (see section 12).
3. What we collect
| Data | Details | When |
|---|---|---|
| Email address | Used to sign you in with a one-time login code and to contact you about your account | When you create an account or sign in by email |
| Account identifier | A random user ID created by our database | When you create an account |
| Sign-in identity (optional) | If you use Sign in with Google or Sign in with Apple: the identifier and email address they give us. With Apple this can be a private relay address. With Apple we also keep a token Apple issues to us, stored encrypted, used only to revoke your Apple sign-in when you delete your account | Only if you choose that sign-in method |
| Display name | The name you choose for your profile | When you set it |
| Your collection | Cards, sealed products, wishlist, decks, quantities and notes | When you save them |
| Spend log | Purchase prices and dates you enter for items in your collection | Only if you use it |
| Value history | Snapshots of the estimated value of your collection over time, calculated from your collection and public price data | While you have a collection |
| Reminders | Release or event reminders you set and their timing | Only if you set them |
| Followed products | Sealed products you follow in Stores and the alert options you pick for them (for example restock or pre-order) | Only if you follow a product |
| Scan counter | How many card scans you have used in the current period, so that scan limits work | When you use the scanner |
| Technical data | IP address, device and app version, time of requests, error messages, kept in server logs by our hosting and database providers | When you use the Service |
| Support messages | Your email address and what you write to us | When you contact us |
| In-app feedback | The message you write, the app version, the platform (iOS or Android) and your device model, linked to your account. It is stored in our database and emailed to our support inbox ([email protected]) so we can read and answer it | Only when you send feedback from the app |
Camera and scanner. The card scanner uses your camera only after you grant permission. Card recognition runs entirely on your device: the camera images are processed on the device and are never uploaded, sent to us or stored by us. The only scanner data that reaches our servers is the scan counter above.
Notifications. Reminders are delivered as local notifications scheduled on your device; no push token is sent to us. If we add push notifications later, we will update this policy before they are switched on.
What we do not collect. No payment card or bank details (none are needed today; future purchases go through Apple or Google). No precise location. No contacts, photos library or microphone. No advertising identifiers. No sensitive data such as health, religion or political views.
4. Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR article 6) |
|---|---|---|
| Create your account, sign you in, keep your collection, spend log, value history and reminders in sync across devices | Account, sign-in, collection, spend log, value history, reminders | Performance of our contract with you (6(1)(b)) |
| Apply free scan limits | Scan counter | Performance of the contract (6(1)(b)) |
| Send login codes and essential account messages | Email address | Performance of the contract (6(1)(b)) |
| Keep the Service secure, prevent abuse, fix errors | Technical data | Our legitimate interest in a safe, working service (6(1)(f)) |
| Answer your questions and requests | Support messages, email | Performance of the contract or legitimate interest |
| Read and answer your in-app feedback and use it to fix and improve the app | In-app feedback, email | Our legitimate interest in answering you and improving the Service (6(1)(f)) |
| Alert you about products you follow in Stores | Followed products | Performance of the contract (6(1)(b)) |
| Revoke your Apple sign-in when you delete your account | Apple token | Performance of the contract (6(1)(b)) and legal obligation (6(1)(c)) for erasure |
| Comply with the law (for example tax records once paid plans exist, replies to authorities) | Only what the law requires | Legal obligation (6(1)(c)) |
We do not use your data for advertising, we do not build profiles, and we do not make automated decisions that have legal or similarly significant effects on you.
Launch list (website). If you leave your email on oyajitcg.com to hear about the launch, we keep only that email and the date you signed up. We use it for one purpose: to send you a confirmation and the launch announcement. We delete it after the launch email is sent, or earlier at any time if you ask (reply to any of our emails or write to [email protected]). Legal basis: your consent (GDPR article 6(1)(a)), which you can withdraw at any time. To stop abuse of the signup form we also keep, for at most 2 hours, a one-way scrambled code made from your IP address with a key that changes daily; it cannot be turned back into your IP and is deleted automatically. The form is also protected by Cloudflare Turnstile, which checks that a person and not a bot is signing up. Turnstile loads only when you start using the form; for that check Cloudflare processes your IP address and technical signals from your browser, and does not use them for advertising. Legal basis for this protection: our legitimate interest in keeping the form free of abuse (6(1)(f)).
Apart from that launch email, we do not send newsletters or marketing emails. If we ever offer a newsletter, it will be opt in only.
5. Cookies and device storage
Website. oyajitcg.com itself sets no cookies and uses no analytics and no third-party trackers. The only third-party component is the Cloudflare Turnstile check on the launch list form (see section 4), which loads only when you use that form.
App. The app stores your session and settings on your device, plus a local copy of your collection so it opens quickly and works offline. This storage is strictly necessary for the app to work. There are no analytics or advertising SDKs in the app.
6. Who processes your data for us
We use the following service providers ("processors"). They act only on our instructions and under data processing terms.
| Provider | What they do | Data | Where |
|---|---|---|---|
| Supabase | Database and authentication | Account, sign-in identity (including the encrypted Apple token), collection, spend log, value history, reminders, followed products, scan counter, in-app feedback, launch list emails, technical logs | European Union (Ireland, eu-west-1) |
| Resend | Sends login code emails and the launch list emails, and forwards in-app feedback to our support inbox | Email address, email content (including feedback messages) and delivery logs | European Union (Ireland, eu-west-1) |
| Cloudflare | Hosts oyajitcg.com, delivers card images and price files (content delivery network) and runs the Turnstile check on the launch list form | IP address, request logs and, for Turnstile, browser signals | Global network |
| Sign in with Google (only if you use it) | Sign-in identifier, email | Global | |
| Apple | Sign in with Apple (only if you use it) | Sign-in identifier, email or relay address | Global |
Future provider, not active today: RevenueCat to manage subscription status once paid plans launch (user ID and purchase records, no card details). We will update this policy before it is switched on.
Apple and Google also act as independent companies under their own privacy policies when you use their sign-in, their app stores or their payment systems.
Links to shops. When you tap a link to a shop or marketplace, the app first tells you that you are leaving OYAJITCG and then opens the link in your browser. We do not send the shop your account data. What happens on the shop's site is governed by its own privacy policy.
Other disclosures. We disclose data only if the law requires it, to protect our legal rights, or if the Service is transferred to a new operator (see section 12).
We do not sell your personal data and we do not share it for advertising.
7. International transfers
Your account data is stored in the European Union. Some of our providers are companies based in the United States (Supabase, Resend, Cloudflare, Google, Apple), and Cloudflare serves content from locations worldwide. Where personal data may be accessed from outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses. You can ask us for more information at [email protected].
8. How long we keep data
| Data | How long |
|---|---|
| Account, collection, spend log, value history, reminders, followed products, scan counter | While your account exists. Deleted within 30 days after you delete your account. |
| In-app feedback | In our database while your account exists (deleted with it). The copy in our support inbox follows the support messages rule below. |
| Apple token | Until you delete your account: it is then revoked at Apple and deleted. |
| Database backups | Overwritten on a rolling cycle of up to 30 days. |
| Login code emails and delivery logs | Up to 30 days at our email provider. |
| Server and request logs | Up to 90 days. |
| Support messages | Up to 2 years after the conversation ends. |
| Inactive accounts | Not deleted automatically. You can delete your account at any time. |
| Purchase records (only once paid plans exist) | As long as Portuguese tax and accounting law requires (currently 10 years). |
9. Your rights
Everyone, wherever they live, can:
- See and correct their profile and collection in the app.
- Export their data from the app (Profile > Account > Export my data), in-app feedback included, or by emailing [email protected].
- Delete their account and all associated data from the app (Profile > Account > Delete account), at oyajitcg.com/delete-account, or by emailing [email protected] with the subject "Delete my account". If you used Sign in with Apple, we also revoke the Apple token.
If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to: access your data (article 15 GDPR), rectification (16), erasure (17), restriction (18), data portability (20), objection to processing based on legitimate interest (21), and withdrawal of any consent at any time (7(3)). Residents of other countries (for example US states with privacy laws) may have similar rights; we honour the same requests for everyone.
To use any right, email [email protected]. We reply within one month (extendable by two months for complex requests, with notice). It is free. We may ask you to confirm the request from the email address on your account.
Complaints. You can complain to a data protection authority, in particular in the country where you live or work. Our lead authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. UK users can contact the Information Commissioner's Office, ico.org.uk. We would appreciate the chance to resolve your concern first.
10. Children
OYAJITCG is a general audience app and is not directed at children under 13. You must be at least 13 years old to create an account. In the European Economic Area and the United Kingdom, if you are under the age of digital consent in your country (between 13 and 16), you need the permission of a parent or guardian. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, write to [email protected] and we will delete it.
11. Security
We use encryption in transit (TLS), encryption at rest provided by our database host, database rules that let each user read and write only their own data, passwordless sign-in with one-time codes or trusted sign-in providers, and restricted administrative access. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify you and the CNPD as the law requires.
12. Changes to this policy
We will update this policy when the Service, the operator (for example a move to a company) or the law changes. Material changes are announced in the app before they take effect. The current version and its date are always at oyajitcg.com/privacy.
13. Contact
Jorge Ribeiro, trading as OYAJITCG
[email protected]