Privacy Policy

The website is delivered by Vercel Inc. (USA). When you visit, Vercel processes technically necessary connection data in server logs: IP address, time, requested page, referring page and browser identifier. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Vercel keeps these logs only briefly; we do not analyse them. Vercel is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

gettopload.com sets no cookies, embeds no analytics or advertising services and loads no external fonts. That is why there is no cookie banner.

When you join the waitlist, the form sends to our database at Supabase (Paris region): your email address, the chosen language, whether you expressed interest in Pro, the campaign parameters of the page address (UTM), the referring page and a salted hash of your IP address. The hash only serves to slow down bulk signups, cannot be traced back to you and is deleted after 24 hours.

The purpose is to notify you once about the launch of the app and to see which channels signups come from. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the form. We secure the signup with double opt-in: you are only on the list once you click the link in our confirmation email.

You can withdraw your consent at any time — an email to access@gettopload.com is enough and we will delete the entry. We delete it anyway once we have notified you about the launch.

If you write to us, we process your address and the content of your message to answer you (Art. 6(1)(b) or (f) GDPR). We delete enquiries once they are resolved and no retention obligation applies.

You sign in with your email address (login code by email) or via Sign in with Apple. From Apple we receive your Apple user identifier and — depending on your choice — your real email address or a relay address generated by Apple. We store your email address, an internal user ID, your display name and, if you set one, your profile picture. Profile pictures and images of custom cards are kept in publicly accessible storage — anyone with the link can view them. Do not upload anything there that should stay private.

The cards and products you add (condition, quantity, language, purchase price, purchase date), your transactions, wishlist, watchlist and price alerts. From this data we compute portfolio value and profit/loss. Market prices themselves are public, non-personal data; requests to price sources (Cardmarket, TCGplayer, PriceCharting, PSA, eBay) contain no user data.

When you scan, the photo of the card is sent to our recognition service on Google Cloud Run (region europe-west1, Belgium) for matching. It is only compared there, not stored.

• Downscaled photo (1280 px): We keep it in your scan history so you can review scans and add them to your collection later. It is deleted when you remove the entry or delete your account, and at the latest after 365 days (Art. 6(1)(b) GDPR).
• Original full-resolution photo: Only with your explicit consent (opt-in in the app). Purpose: improving card recognition and testing new recognition models on real photos. The photos are kept in private EU storage, linked to your account, invisible to other users, and deleted after 180 days. You can withdraw your consent at any time under Profile → Privacy; we then delete the originals within one day (Art. 6(1)(a) GDPR).
• Scan diagnostics: For each scan we store the recognised text fragments and the candidate list so we can trace and fix misidentifications (legitimate interest, Art. 6(1)(f) GDPR).

We store search queries with your user ID to compute the “Trending” section from the most searched cards (Art. 6(1)(f) GDPR). You can object to this processing (see section 8).

Only if you allow notifications in iOS do we store your device’s push token and use it to send price alerts and notices via the Apple Push Notification Service (Art. 6(1)(a) GDPR). If you turn notifications off in iOS settings, the token is no longer used and is removed.

Purchase, billing and management of the subscription run through your Apple account (in-app purchase). Only Apple sees payment data. To verify your entitlement we use RevenueCat (USA): it receives subscription events such as purchase, renewal and expiry, linked to your user ID. We store only your purchase status (tier and expiry date). The transfer to RevenueCat is secured by the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Photos for the grading check are processed for analysis (centering, corners, edges, surface). What we store is the report with measurements and prediction in your account, so you can open it again later.

Once we activate crash reporting, the app will send the error message, device type, iOS and app version and your user ID to Sentry (EU region, Frankfurt) after a crash, so we can fix bugs (Art. 6(1)(f) GDPR). Collection data or photos are not part of these reports. Until activation, no crash reports are transmitted.