Last updated 14 September 2026
Cardlore has no accounts and no servers of its own. It does not collect, store or transmit personal information. Your collection stays on your device, and card photos are never uploaded unless you deliberately tap to send a report.
Everything you create in the app is written to local storage on your phone and nowhere else: your collection and quantities, wishlist and favourites, scan history, settings, and any cached card images and prices. Uninstalling the app removes it. There is no account to create, nothing to sign in to, and no copy of your collection held anywhere by us.
Backups are produced only when you ask for one, and are saved to the location you choose. The app does not upload them.
Recognising a card is done entirely on your phone, using Google's ML Kit text recognition together with an offline card database bundled inside the app. Photographs you scan are not sent anywhere. They are processed on the device and kept in a temporary cache that the app clears as it goes. Identification works with no internet connection at all.
One qualification, stated plainly because it is outside our control: ML Kit is a Google library, and Google states that it may send performance and diagnostic telemetry about the library's own operation to Google. That telemetry concerns how the library performed, not the content of your photographs, and there is no opt-out available to the app. See Google's ML Kit terms.
| Purpose | What is sent |
|---|---|
| Card prices and details, from the Pokémon TCG API | A request naming the card being looked up. No personal information is attached. As with any web request, the service can see the IP address it came from. |
| Card images, from the same provider's image server | A request for the image file. Nothing else. |
| Reports you choose to send | Only when you tap to send one. See below. |
None of these requests carry an identifier for you or your device, because the app has none to send.
If a card is identified wrongly, or a centering measurement looks wrong, the app offers to send a report. Nothing is transmitted until you tap to send, and you can always decline.
A report contains the photograph of the card concerned, plus diagnostic details such as the text that was read, which card was matched, the measurement produced, and basic app and device information (app version, Android version, device model). It contains nothing else from your phone and nothing from your collection.
You choose where it goes: either to a private channel on our tester Discord, or through your phone's share sheet to any app you pick. Reports sent to Discord are covered by Discord's privacy policy while they sit there. They are used only to fix the app, and are deleted once the issue they describe is resolved.
Crash reports work the same way: if the app crashes it writes a diagnostic file on the device, and that file is shared only if you choose to share it.
The app links out to TCGplayer and Cardmarket so you can view a card in its marketplace, and to our Discord. One of these is an affiliate link, which means the marketplace may pay a small commission on a resulting purchase at no additional cost to you. Once you follow any of these links you are on someone else's site, under their privacy policy rather than this one.
There is none. Cardlore contains no advertising, no analytics library, no crash-reporting service, and no third-party tracking of any kind. It does not build a profile of you, because it holds nothing to build one from.
Cardlore is suitable for all ages and does not knowingly collect information from anyone, children included. Since the app collects no personal information at all, it holds none belonging to a child either.
If the app's behaviour changes in a way that affects this policy, this page will be updated and the date at the top changed with it. Material changes will also be announced in the tester Discord.
Questions about this policy, or about anything the app does with data, can go to reports@cardlore.app or the Cardlore Discord.