Privacy Policy

This policy covers the Poplex mobile app, the Crew community inside it, and this website. It forms part of the Terms of Service.

1. Who is responsible for your information

Poplex is operated by TC Holding, LLC, a Wyoming limited liability company (“Poplex”, “we”, “us”). We decide why and how the information described here is used, which makes us the “controller” under the laws that use that word. Questions and requests go to support@poplexcollectors.com.

2. What stays on your phone

Card photographs you take with the scanner are read on your device and are not uploaded to us. While a scan is processed the app keeps temporary copies of the photograph in its cache on your phone. They are not kept in your scan history and are not sent to us; your phone may clear them when it needs the space, and deleting the app removes them. Photographs you take for Pre-grade checks also stay on your device.

Your Collection lives in a database on your phone: the cards you own, their variant, condition, grade and quantity, your Binders and their covers, your want list, the sets you track, the results of your scans and the notes and checks you make. We do not keep that Collection on our servers. Section 3 describes what your profile shows, which is a smaller and different set of information. Deleting the app deletes the Collection data on your phone, and we cannot restore it.

The app also keeps a few settings on your phone: your sign-in session, which ads you have hidden, the interests and sets you have allowed ads to use, posts you marked “Not interested”, and the recent scans of your current session. These are not sent to us, except your sign-in session, which works with our servers.

3. What we collect

Information you give us

• Your email address, because signing in sends a six-digit code to it. Poplex does not ask you to create a password.
• Your birth month and year, when you join. We use them once to work out your age group (13 to 17, or 18 and over) and then keep only the group, never the date. If you are under 13, we delete your account.
• Your profile: handle, profile picture, banner, bio, whether your account is public or private, whether your profile has a page on the web, and who has asked to follow you.
• What you post and send: photographs, captions, the kind of post, hashtags, polls, comments, reactions and bookmarks; stories, including text, mentions, poll and card stickers, and who viewed, liked or voted on them; private messages and group messages, which can be text, photographs, voice recordings up to a minute, shared posts, profiles, stories and cards, replies and reactions; and your read-receipt and typing signals, where you and the other person both allow them.
• Your choices: who you follow, pin, block and report; who may message you; your privacy, ad, story-sharing and notification settings; and what you vote for when we ask which Pokémon should come next.
• Business and verification information, if you use those features: a business account’s category and website and any request to promote a post; and, if you ask to be verified, what you say you are, the links you give, any note, the code we gave you, and our decision and its reason. We do not collect identity documents.
• Messages to us, such as emails to support, and what they contain.

Information created when you use Poplex

• Your Collection as your profile shows it. While you are signed in, the cards in your Collection and the sets you track are copied to our servers so your Collector Profile can show them: each card’s name, set, number, variant and image, and each set’s progress. Quantity, condition, grade and price are not stored with them (the app may send a card’s condition or grade along with the rest, and our database discards them on arrival). A Binder is copied only if you switch on “Show on my profile” for it, and its cover photo is never uploaded. Signing out stops new changes being copied; what is already on your profile stays until you make your account private or delete it.
• Shared sets (Collect Together). If you start or join a shared set with other collectors, we keep which set it is, who is in it, which cards of that set each member has (never quantity, condition, grade or price), and a short activity record of who joined, left, added or removed how many cards, and when. Everyone in the shared set can see this. Your cards leave the shared set when you leave it, when you are removed, or when you delete your account.
• Records of what you view and do in Crew: posts you view and open, and what you like, save, comment on and follow. These are used as section 6 describes.
• Searches. A search you type in Crew is sent to our servers to produce the results. We do not keep a search history for you.
• Ad events: that a sponsored post was shown to you, and whether you tapped it, recorded at most once a day for each ad (section 7).
• Notifications: a record of activity addressed to you and whether you have read or dismissed it.
• A device push token, if you allow notifications, with whether the device is iOS or Android. A push token is an address for your device, not an identifier for you; it is readable only by your own account and by the service that sends the notification.
• Safety records: reports you make or that are made about you, what they say, and, for a reported private message or group, a copy of the reported message and the messages near it, kept as evidence (section 8).

Technical information

• Error reports. When the app fails in a way we need to know about, it sends a short report: which action failed, the error text, the app version, your device model and system version, and your account ID if you are signed in. It never contains your photographs, cards, captions, handle or Collection. We use these reports only to fix problems.
• Server and network information. When your phone or browser contacts us or our hosting providers, they receive and may log ordinary technical information, such as your IP address, device or browser type, time and the page or service requested, to deliver the service, keep it secure and prevent abuse.
• Photo, camera and microphone access. The app asks for the camera to scan cards, take Pre-grade photos and take photos for stories, chats and groups; for the microphone only while you record a voice message; and for your photo library only when you choose an image to add to a post, story, chat or group, or as a profile picture, banner or Binder cover. We do not read your photo library otherwise. Photographs you choose are re-saved by the app before they are uploaded, which removes the location and other details your camera stored in them. We do not ask for your location, your contacts or your advertising identifier.

Information from others

Other collectors may mention you, reply to you, message you, follow you, add your post to their story or report you, and that information becomes part of your account’s activity. Card catalog, image and price services supply information about cards, not about you (section 9).

4. How we use information, and why

We also use information where the law requires it, to establish or defend legal claims, and to protect the rights, property and safety of people using Poplex and of Poplex itself. We do not use what we collect for anything incompatible with these purposes without telling you first.

5. Where your profile and posts can be seen

Your account is public unless you make it private in Settings. This is true for every account, including teen accounts. A public account’s posts, stories, Collector Profile and follower and following lists can be seen by any signed-in collector, and its posts can appear in other collectors’ Explore. A private account’s posts, stories, Collector Profile and follower and following lists can be seen only by followers you approve; anyone can still see its handle, picture, banner, bio and counts. Your comments and reactions on other collectors’ posts are seen by everyone who can see those posts.

Your page on this website. If your account is public, your Collector Profile also has a page at poplexcollectors.com/@your-handle that anyone can see without signing in and that search engines can list. It shows your handle, picture, banner, bio, follower and following counts, your cards and tracked sets, the Binders you show on your profile, and the posts you turned on public preview for. You can turn it off in Settings, or by making your account private; the page then stops being shown within a few minutes, though search engines may take longer to drop copies they already made. A private account never has a page. Blocking someone in the app does not hide this page from them, as with any public web page.

Pictures and links. Profile pictures and banners are served from public web addresses that work without signing in, which is how they appear on your public page and in link previews. Post photographs are served through addresses that check, each time, whether the viewer may see the post; photographs in messages, groups and stories are served only to people who may see them, through links that expire in minutes. A post is visible outside the app only if you turn on public preview for it and your account is public, which is what makes it appear on a share link. Your email address is never shown to other collectors, and reports are private: the person you report is not told who reported them.

Shared sets. Only adults can start or join a shared set, and nobody is added without accepting an invitation. Everyone in a shared set can see the people in it, which cards of the set each of them has, and what each added or removed and when. They cannot see your Collection, how many copies you own, or a card’s condition, grade or price. If you block someone, you stop seeing each other’s cards and activity in a shared set.

6. Recommendations, search and personalization

Explore shows posts from public collectors, most of them people you do not follow yet, in an order chosen for you. Crew’s Latest view lists posts newest first. In Explore and in “More like this” and “Collectors like you”, the main things that decide the order are:

• how similar a post is to posts you saved, liked or opened in the last 180 days;
• whether it relates to the sets you track or the cards on your want list;
• whether it comes from a collector you follow or whose posts you keep opening;
• how other collectors have responded to it, and how recent it is;
• for suggestions of collectors, how similar their profile is to yours and whether they are in your age group; and
• whether you have already seen it, which moves it lower so that Explore changes between visits.

Part of this is worked out on our servers, from your saves, likes and opens, and part on your phone. To make similarity possible, we turn the text of posts (captions, hashtags and the names of the sets the author tracks) and the words you search for into numerical representations, using a model that runs inside our own systems; no outside artificial-intelligence service receives them. The names of the cards on your want list are sent to us once, as the search for which collectors’ public profiles hold them, and are not saved to your profile. Touch and hold any post in Explore to see why it is there, or to mark it “Not interested”. You cannot switch recommendations off, but Latest does not use your activity.

Everything in this section comes only from your use of Poplex. We do not collect it from other apps, websites or companies.

7. Advertising and sponsored content

Poplex shows advertising and sponsored posts from businesses such as card shops, grading services and hobby brands. Every one is labelled “Sponsored”, and its menu says why you are seeing it.

• How ads are chosen. An ad can be chosen from what is on your screen, for example a post about a kind of card. If you are 18 or older and Personalized Ads is on, it can also be chosen from the sets you track and the kinds of post you pick as interests. Those two things are kept on your phone and are never sent to us or to advertisers. Ads are never chosen from anything you do outside Poplex.
• Under 18, or age unknown. If you are under 18, you see only ads Poplex has approved for teens, chosen only from what is on your screen, never from your activity. If we do not know your age group, you see no ads.
• Your choice. Personalized Ads is on by default for adults. In Settings you can turn it off, and turn off or change each of the things it may use. You will still see ads, chosen only from what is on your screen.
• What we record. That an ad was shown to you and whether you tapped it, at most once a day for each ad, kept for 12 months. We limit how often you see the same ad.
• What advertisers receive. Totals only: how many different collectors saw an ad, how many times it was shown and tapped, and the same by day. They never receive your name, handle, email, Collection or anything that identifies you.
• Leaving Poplex. Tapping an ad opens the advertiser’s own website or app, governed by their privacy policy, not this one. We add three tags to the address, naming Poplex and the ad, never you, so the advertiser can tell which ad sent a visit. Once you arrive, the advertiser sees you as it sees any visitor, including your IP address.

8. Messages, groups and safety

Private messages and group messages are stored on our servers so we can deliver them and show them on your devices. They are not end-to-end encrypted. They can be read by the people in the conversation. Our staff do not routinely read them. We read or review a message only where a participant reports it, where we need to investigate abuse or a risk to someone’s safety, to enforce our rules, to answer a request from you, or where the law requires; administrators use a console that records what they do. Photographs and voice messages are stored privately and shown only to the people in the conversation.

When a message or group is reported, we keep a copy of the reported message and the messages just before it (or a group’s most recent messages and its member list) as evidence. Reports about a person can include what the reporter chose to write. Blocking a collector hides your content from each other and ends your conversation with them.

If you allow notifications, a message notification can show the first part of the text, and a story reply can show the reply. That text, with your device token, passes through the push services of Expo and Apple to reach your phone. A message request from someone you do not follow shows only that you have one. You can turn notifications off in your device settings.

We use automated filters that refuse offensive words in handles, captions, comments, bios, messages and similar text. A refusal does not report or penalize you. We do not use automated tools to scan photographs; photographs are reviewed when they are reported. We report apparent child sexual exploitation material to the National Center for Missing and Exploited Children, as the law requires.

9. Who else handles your information

We keep this list short on purpose. None of these are advertising companies, and none receives information about you to advertise to you. If we ever work with an advertising partner that would receive any information about you, we will name it here and update this policy before it does.

• Supabase hosts the database, the sign-in service and the file storage behind Crew, which is where almost everything in sections 3 and 4 is kept. Its servers are in the United States (Amazon Web Services, US East, Ohio).
• Vercel hosts this website and processes ordinary request information for it.
• Cloudflare stores and delivers the photos and voice messages shared on Crew: posts, stories, chat and group messages, profile pictures, covers, group photos and approved ad images. Private files are delivered only through links that stop working within ten minutes. It processes ordinary request information, such as your IP address, when a file is uploaded or opened. We ask Cloudflare to keep these files in eastern North America. A copy of each file is also kept with Supabase.
• Expo and Apple deliver push notifications, and Apple distributes the app. The notification text and your device token pass through them.
• Resend, an email provider, sends the sign-in code and the emails about business accounts, verification and similar decisions. It receives your email address and the content of the message.
• Card data services. When you scan or search for a card, your phone contacts card-catalog services directly: TCGdex (api.tcgdex.net and assets.tcgdex.net) and, if it is unavailable, the Pokémon TCG API (api.pokemontcg.io), as well as Poplex’s own market service at tcproshield.com. They receive your IP address and the details of the card being looked up (such as a set, number or the name you typed), not your name, email or account. Their own privacy policies apply to what they keep. Visitors to a public Collector Profile also load card images from assets.tcgdex.net.
• Links you follow to other websites, such as a seller or a price source, are governed by those sites.

We also share information when the law requires it (for example, a valid legal request), to protect people from serious harm, to enforce our terms, and in connection with a merger, financing or sale of Poplex, in which case we will tell you if it changes who is responsible for your information. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Poplex also uses a shipping tool, available only to its operator, to buy postage and track parcels; it handles the names and addresses of recipients, who may not be Poplex users, and sends postal codes, sizes and tracking numbers to the United States Postal Service.

10. Where information is held

Poplex is operated from the United States and information is processed there and in the places our providers operate. If you use Poplex from elsewhere, your information is transferred to and handled in the United States, where privacy laws may differ from your own. Where the law requires safeguards for such transfers, we rely on the data processing terms and standard contractual clauses our providers offer, or another recognized mechanism.

11. Cookies and similar technologies

This website contains no analytics, advertising or tracking code and no third-party scripts, and visitors who are not signed in receive no cookies. If you sign in on the website, we set cookies that keep you signed in. They are strictly necessary for that, are not used for advertising or analytics, and are removed when you sign out. The website also keeps one small item in your browser’s storage: the identifiers of chat messages you have reported, so reported photographs stay blurred. The app has no advertising identifier, no analytics or advertising software from other companies, and does not track you across other companies’ apps or websites. We do not respond to browser “Do Not Track” signals because we do not track you across sites, and we treat a Global Privacy Control signal as a request not to sell or share your information, which we do not do in any case.

12. How long we keep information, and what happens when you delete your account

The table in section 4 gives the periods for each kind of information. In addition:

• Stories are shown to others for 24 hours. After that they are visible only to you, until you delete them or your account.
• Messages. Unsending a message within 15 minutes removes its content for everyone. Deleting a chat removes it only for you. If either person deletes their account, the conversation is deleted for both. Messages you sent in a group are deleted with your account; the group continues.
• Notifications are kept while your account exists, and push tokens are removed when you sign out.
• Safety records. Reports about a person, and the evidence copied for them, and a log of what our administrators did and why, are kept as long as they are needed to enforce our rules, to recognize repeat behaviour, to answer a complaint or claim and to meet legal duties; we review them from time to time and delete what is no longer needed. They can include a copy of a reported message, and the text of content that was removed.
• Ad credit and payment records for business accounts are financial records, and are kept for as long as the law requires us to keep financial records, even after the account is deleted, with the business’s handle but no other link to the account.
• Backups. Deleted information may remain in our hosting provider’s backups until its normal backup cycle overwrites them.

Deleting your account. You can delete your account yourself, in the app (Settings, then Privacy & Safety, then Delete Account) or on this website (sign in, then Settings, then Delete Account), by typing your handle to confirm. Deleting it removes your Crew profile and everything under it straight away: your posts, stories, comments, reactions, follows, blocks, notifications, push tokens, your messages, your shared set cards, and everything your Collector Profile showed. Conversations with you are deleted for the other person too. The photographs and voice messages you sent are deleted from our storage with your account, except any kept as evidence of a report (section 8). Photographs and voice messages the other person sent you are theirs, and stay in their own storage. Copies that other people made or received, such as a screenshot, a story that another collector made from your post, or a reply to your comment, are theirs and are not removed. What is kept is described above: safety records, administrators’ logs, business payment records, error reports that no longer name you, and backups for the period above. Your Collection is on your device and is removed by deleting the app.

13. Your choices and rights

In the app and on the website you can change your handle, picture, banner and bio; choose whether your account is public or private and whether it has a page on the web; choose which Binders your profile shows; answer follow requests; decide who may message you and whether to share read receipts; allow or refuse story sharing; delete your posts, stories, comments and messages; block and report collectors; mark posts “Not interested”; turn Personalized Ads and what it may use off; and turn notifications off in your device settings.

Getting a copy of your data. Signed in on this website, Settings then Download My Data gives you a file of the information in your account: your profile and settings, posts, comments, reactions, bookmarks, follows, blocks, stories, notifications and the cards and sets on your profile. It does not yet include your messages or your shared sets; write to support@poplexcollectors.com and we will send you those. Your Collection is on your device and is not held by us.

Your rights. Depending on where you live, you may have the right to know what we hold about you and to get a copy, to have it corrected or deleted, to receive it in a portable form, to object to or restrict some uses, to withdraw consent you gave, and not to be treated worse for using these rights. To exercise any of them, write to support@poplexcollectors.com. We may ask you to confirm that you control the account’s email address, which we do by sending a code to it, and we may ask for more only where we cannot otherwise tell it is you. An authorized agent may act for you with your written permission. We answer within the time the law gives us, generally one month, or 45 days for California residents, and tell you if we need longer. If we refuse a request, you may appeal by replying to our answer, and we will review it and tell you the result and how to complain to your regulator.

People in the European Economic Area and the United Kingdom

We rely on the legal bases in section 4. Where we rely on legitimate interests, you may object to that use, and where we rely on consent, you may withdraw it at any time without affecting what was done before. You can complain to your national data-protection authority; we would be grateful for the chance to resolve a concern with you first. We do not make decisions about you that have legal or similarly significant effects solely by automated means.

California and other states

In the last 12 months we have collected these categories of personal information: identifiers (handle, email, account ID, push token, IP address); information in your content and profile (photographs, audio, captions, bio); internet and app activity (views, opens, saves, likes, ad events); professional information (a business account’s category and website); and inferences used for recommendations. The contents of your private messages are sensitive personal information, because we are not their intended recipient; we use them only to provide the Service, keep it safe and meet our legal duties, which is why there is no separate right to limit that use. We collect no precise location. We use these categories for the purposes in section 4 and share them only with the providers in section 9. We do not sell personal information or share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Residents of California and of other states with similar laws can use the rights above and the appeal in this section.

14. Children and teens

Poplex is not for children under 13. We ask for your birth month and year when you join and delete the account of anyone who is under 13; we do not knowingly keep personal information from a child under 13. If you believe a child under 13 has an account, write to support@poplexcollectors.com and we will remove it.

Collectors aged 13 to 17, and anyone whose age we do not know yet, get extra protections: they never see ads chosen from their activity and see only teen-approved ads; they can message only collectors they follow; they cannot join or create group chats or shared sets, open a business account or request verification; and story sharing is off unless they turn it on. A teen’s account is public until they change it, as for everyone, and teens can make it private in Settings.

15. Security

Access to Crew information is enforced in the database itself, row by row, rather than only in the app, so a collector can read their own information and what others have allowed them to see, and not more. Information travels between your phone, your browser and our servers over encrypted connections. Photographs in messages, groups and stories, and voice messages, are stored privately. Our team can access information only as needed to run Poplex, handle reports and help you, and administrators’ actions are logged. Collectors sign in by emailed code, so there is no password to reuse or lose. Messages are not end-to-end encrypted (section 8). No system is perfectly secure, and we cannot guarantee against every risk. If a breach affects your information, we will tell you and the authorities as the law requires.

16. Changes and contact

We will post any updated policy on this page with a new effective date, and will tell you in the app or by email about a material change before it takes effect. Questions, requests and complaints go to support@poplexcollectors.com. Our Terms of Service and Community Guidelines also apply.