Privacy policy

Last updated: 25 October 2026

This policy explains what happens to your information when you use the Pilefall app.

The short version

• Pilefall recognises your cards on your phone. Your photos never leave it.
• Your collection, wishlist and settings are saved on your phone and in your phone's own backups, not with us.
• The app needs no account. It gets a random install id from our server, which is not linked to your name, email or phone number.
• We count how the app is used without knowing who you are.
• When you report a wrong match, or correct a card the scanner named, we receive what the scanner suggested and the card you chose, never the photo, and keep it for 90 days.
• Crash reports are sent only if you turn them on.
• Pilefall Pro is sold by Apple or Google; we never see your card details.
• We do not sell your information, show ads, or track you across other apps or websites.

Who is responsible

The controller of your data is Francesco Noferi, Via Carlo Collodi 27, 50059 Vinci (FI), Italy ("we"). Partita IVA 07313090487. Write to hello@shpapps.dev about anything in this policy. We have not appointed a data protection officer (the law does not require one for a service of this size).

What we process, why, and on what basis

Photos and recognition: on your phone only

When you scan a card, count a pile or pick a photo of a card, Pilefall recognises the card on your phone: a recognition model built into the app finds the card, and a text reader (Apple's Vision, part of iOS, on iPhone; Google's ML Kit, built into the app, on Android) reads its number and language. No photo, camera frame or text read from a card is sent to us or to anyone else. Pilefall does not keep your photos with your collection: the camera's working copy of a photo stays in the app's temporary folder until the phone clears it, and it is never backed up or sent. The camera is used only while you scan or count a pile.

On Android, Google's ML Kit, which does the text reading, sends Google technical information about how it runs: the phone's model and system, the app's name and version, a random identifier for this installation of the feature, how long it took, its settings and any error codes. It does not send the image or the text it read. Google uses this to keep ML Kit working and to improve it (ML Kit data disclosure). Basis: our legitimate interest in a text reader that runs on the phone, so that photos never leave it (GDPR art. 6(1)(f)).

What stays on your phone

Your collection (binders, cards and their copies, conditions, editions, notes, copies for trade), your wishlist, the pile you are counting, how many of the day's free pile cards are counted, whether you have Pilefall Pro (so that it works offline), reports waiting to be sent (below) and your settings (the cards' language, sounds, vibration, the collection's order and filters, whether crash reports are on) are files on your phone. We never see them. Deleting the app deletes them.

Your phone's own backups include them: on iPhone, your iCloud or computer backup, like other app data; on Android, Google's backup of the collection, the pile and the settings, to your own Google account, when backup is on. A backup file or a spreadsheet (CSV) you make goes only where you send it with the share sheet, and comes back only through the file picker.

Your install

On first launch the app registers with our server (a Cloudflare Worker at api.shpapps.dev) and gets a random install id, which it keeps in the phone's secure storage (the Keychain on iPhone, the Keystore on Android). Every request the app makes to our server carries it. It lets the app download the card catalog and reference prices and send reports, and lets us keep our server for the app alone. Our server keeps, per install, the id and when it was created, and whether it has Pilefall Pro (Purchases, below); nothing else about you. Basis: to provide the app (art. 6(1)(b)). Kept: as long as the install may use the app, or until you ask us to delete it: then we delete the install, its reports and its purchase records, ours and RevenueCat's (Apple and Google keep their own) (our hosting provider's database history, kept for restoring it, still holds the deleted record for up to 30 days).

To keep the service fair and running, our server also keeps a count for the current day (UTC) only of the installs made from your network: your IP address (or the first half of an IPv6 address), and the wider block it belongs to (the first three numbers of an IPv4 address, or the first three groups of an IPv6 address). It also holds in memory, to cap them, how many requests an install made in the last minute and how many events it sent today. These counts are deleted by the first request our server handles after the day ends at midnight UTC, normally within minutes (our hosting provider's 30-day database history can still hold them). Basis: our legitimate interest in preventing abuse (art. 6(1)(f)).

Card data and reference prices

When the app starts (at most every few hours), it asks our server whether there is a newer card catalog, new sets for the scanner or a newer day of reference prices, and downloads them with its install id. Our server counts per day how many of these downloads it answered and which pages it did not have, without the install id. Basis: to provide the app (art. 6(1)(b)).

Card names and numbers come from TCGdex; reference prices are Cardmarket's public price guide. We prepare both in advance: the app never contacts TCGdex or Cardmarket by itself.

Cardmarket links

"Open on Cardmarket" opens the card's page on cardmarket.com in your browser. The link carries only the card's product number and language, nothing about you. From then on Cardmarket's own privacy policy applies.

Usage counts (everyone)

The app sends simple events to our server, such as "a card was scanned and recognised", "cards from a pile were added, and how many", "the Pilefall Pro screen was opened, and from where" or "a setting was changed, and to what". Our server adds them up per day; it does not keep your install id, your IP address or the time of day with them, and no photo, card name or anything you typed is included. We keep these daily totals for 90 days. Basis: our legitimate interest in understanding and improving the app (art. 6(1)(f)). These counts are aggregate statistics made by us for this app only, which the Italian Data Protection Authority treats like technical tools that need no consent (its cookie guidelines of 10 June 2021, section 7.2); you can object at any time by writing to us.

Wrong-match reports and corrections

If the scanner names the wrong card, you can tap "Report a wrong match" on a scan's result or on a line of a pile. And when you correct a card the scanner named (you add another card in its place, or change the card on a pile's line), the app sends the same kind of report without a separate tap, so that we learn which cards it confuses, unless you turn off "Send corrections" in Settings.

A report holds: the scanner's five best guesses and their scores, what it read off the card's print (the number, the set's total, the set code, the language), whether the number matched, the card you chose (for a correction), whether it came from a scan or a pile, the versions of the app and of the card catalog, the time, and your install id. Never the photo. Until it can be sent (when you are offline, say), a report waits on your phone (the last 500 are kept). We use reports to find and fix the cards the scanner confuses. Basis: our legitimate interest in recognition that works (art. 6(1)(f)). Kept: 90 days, or until you ask us to delete your install's data. You can object at any time: turn off "Send corrections" in Settings (a report you ask for with "Report a wrong match" is still sent), or write to us with your Support ID and we delete your reports.

Feedback

"Send feedback" in Settings sends us the note you type (at most 500 characters) and your install id. We read it to fix and improve the app. Basis: our legitimate interest in an app that works well (art. 6(1)(f)), started by you sending it. Kept: 90 days, or until you ask us to delete your install's data. You are not required to send feedback.

Crash reports (only if you turn them on)

In Settings you can turn on "Send crash reports". It is off until you do, and nothing is sent while it is off. When it is on and the app fails, the app sends a report to PostHog (servers in the EU): the error and where in the app's code it happened, the app's version, the phone's model and system version, and the technical details PostHog's library adds to every report (such as the system's language, time zone and screen size), with a random id that PostHog's library makes for the app on this phone. No screen recordings, no usage events and no profile of you, and never a photo, a card or your collection. Our PostHog project discards IP addresses. Basis: your consent (art. 6(1)(a)), which you can withdraw at any time by turning the switch off. Kept: up to one year on the PostHog plan we use. (PostHog privacy)

Purchases

Pilefall Pro is sold by Apple (App Store) or Google (Google Play), who handle payment as the sellers; we never see your card details. RevenueCat processes the purchase records for us so that Pro works on your install: it receives your install id, what you bought and when (from the store), technical details of your phone such as its system, and the times the app showed the Pilefall Pro screen, so that we can see how many of those who see it buy. Our server keeps, per install, whether it has Pro, which plan and until when, and the app keeps the same on your phone so that Pro works offline. The day's free pile cards are counted on your phone; we do not receive that count. The reminder a week before a yearly plan renews is a notification your phone schedules for itself: nothing is sent for it. Basis: to provide what you bought (art. 6(1)(b)) and our legal obligations (art. 6(1)(c)). Kept: while the install may use the app, or until you ask us to delete them; Apple and Google keep their own records. (RevenueCat privacy)

Request logs

Our server runs on Cloudflare, which logs the requests the app sends to it (technical details of each request, which may include your IP address). The logs help us find errors and abuse, and are kept for 7 days. Basis: our legitimate interest in a secure, working service (art. 6(1)(f)).

Support emails

If you write to us, we use your email address and what you send to answer you. Emails to hello@shpapps.dev are forwarded by Cloudflare to our mailbox at Apple (iCloud Mail). We keep them as long as needed to help you and for up to two years afterwards, in case you write again. Basis: our legitimate interest in answering you (art. 6(1)(f)).

Who receives your information

Only the service providers named above, each for its own task: Cloudflare (our server, its logs and email forwarding), RevenueCat (purchase records), PostHog (crash reports, only if you turned them on), Google (ML Kit's technical information, on Android only, under Google's own terms), and Apple (our support mailbox). Apple and Google also sell Pilefall Pro and keep their own records of your purchases and of your download from their stores, under their own policies. We do not sell or share your information with anyone else, except when the law requires it.

Transfers outside the EU

Cloudflare, RevenueCat and Google are based in the United States, and Apple processes iCloud Mail in its own data centres, which may be outside the European Economic Area. Where data leaves the European Economic Area, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for companies certified under it) or on the Commission's Standard Contractual Clauses in each provider's data processing terms. PostHog stores crash reports in the EU (Frankfurt); some of its processing happens outside the EU, including in the United States, under the Data Privacy Framework and the Standard Contractual Clauses. Write to us for a copy of the relevant safeguards.

How long we keep it

Your rights

You can ask us for access to the information we hold about you, and to correct, delete or restrict it, to object to processing based on our legitimate interests, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time (in the app: Settings) without affecting what was done before. Write to hello@shpapps.dev; for anything about your install, include the Support ID shown in the app's Settings (under About; tap it to copy it), since it is the only way we can find your data. We answer within one month.

You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali, or the authority where you live or work.

Children

Pilefall is made for adult collectors. It is not meant for children under 14, and we do not knowingly collect their information. In Italy, children under 14 need a parent's consent to use AI technologies, which include the card recognition, and to agree to data processing on their own.

Changes

We update this policy when the app changes what it collects, and change the date at the top. If a change needs your consent, the app asks for it again.