Privacy Policy

EFFECTIVE

This policy explains what Dexfast collects, why we collect it, how long we keep it, and what you can ask us to do about it. It covers the Dexfast mobile application and the dexfast.app website.

1. Who we are

Dexfast (“we”, “our”, “us”) is built and run by Khoa Le, an independent software engineer and card collector in Ho Chi Minh City, Vietnam. There is no company behind it — one developer answers the email. You can reach us at support@dexfast.app.

2. Information we collect

2.1 Account information

The current welcome screen offers Apple and Google sign-in, without asking you to enter an email address or create a Dexfast password. When you create an account with either provider we store:

  • the email address supplied by Apple or Google, which may be an Apple private relay address if you choose Hide My Email;
  • your display name and username;
  • your sign-in provider (Apple or Google) and account identifier;
  • your preferred currency and preferred game;
  • your subscription status;
  • the date the account was created.

If you use email and password authentication through a supported app version, we also store your email address and sign-in method. Our authentication provider stores a password hash, never a plain-text password, and handles password-reset requests.

2.2 Profile information

If you upload an avatar photo, we store it on our servers. Nothing in your profile is public: Dexfast has no followers, no comments, and no public collection pages.

2.3 Collection and card data

For every card you add we store which printing you own and, if you fill them in, its condition, the grader and grade, and the price you paid. We also store which cards you have marked as favourites, your set completion progress, and the estimated values and price history we show you in your chosen currency.

2.4 Camera, scanning, and image data

To scan a card you either point the camera at it or pick a photo from your library. The app reads the card on your phone and matches it against a card catalogue stored on your phone, so the scan image never leaves your device. Our servers receive only the text the phone read from the card (such as its name, number, and set code) and the card it picked, so we can confirm the match, count the scan, and show the price. If you add a paired Front and Back scan to your portfolio, we keep those submitted photos on our servers for up to 14 days so we can create and show that copy's AI assessment. The app can temporarily keep local review and recovery evidence until the Add either completes or is discarded.

Free scans are counted per email address through a one-way keyed hash of that address. That hash outlives the account on purpose: deleting your account and signing up again does not reset your free scans.

2.5 AI grading

An AI condition estimate starts from the card screen after you choose a physical copy and photograph its Front and Back. Those two photos are sent through OpenRouter for assessment. Photos for a new draft are deleted 14 days after the draft is created. Photos that already have a saved deadline keep that deadline. The completed report — the condition band, overall score, centring figures, and server assessment date — remains until you delete it or delete your account. Free accounts meet the paywall before a draft is created. Assessment starts after paid access is confirmed; viewing a completed report's detailed findings requires an active paid plan. Assessments reflect the submitted photos on that date and can become inaccurate if the card is not stored and protected properly. They are estimates, not an official grading opinion.

2.6 Payment and subscription

The paid tier is sold and billed by Apple through the App Store. We never see your card number. RevenueCat relays your subscription status to us, and we store your tier, whether the subscription is active, the identifier the billing provider uses for you, and the date the current period ends.

2.7 Device, usage, and technical information

The app sends product analytics to PostHog: which screens are opened and which features are used, keyed to your internal Dexfast user id. We never send your email address, your photos, or the contents of your collection to analytics. When the app hits an error it sends an error report to PostHog: the error message, where in the code it happened, the app version, and the device model and iOS version, keyed to the same user id. The app also sends diagnostic logs to PostHog about startup and failed operations, with the app version, build number, and technical error category. These logs exclude raw error responses, search text, photos, and collection contents. Our servers keep request logs that include an IP address and the app version. There is no analytics switch inside the app — if you would rather not be counted, write to us and we will delete your analytics profile.

The dexfast.app website sends a smaller set of the same kind of events to PostHog: which page was opened, whether the App Store button or a navigation link was clicked, and whether a contact message was opened and sent. Website analytics are anonymous — they are not tied to any account, and nothing you type into the contact form is sent to analytics, only whether sending succeeded. The website stores nothing on your device to do this, so a return visit is counted as a new one. We do not record website sessions.

2.8 Push notifications

If you allow notifications, the app gives us the push token iOS creates for your device, with your app language. We store it against your account so we can tell you when a new set comes out for a game you collect and when an AI condition estimate is ready. Turn notifications off in Profile → System or in iOS Settings at any time.

2.9 Messages you send us

If you use the contact form on dexfast.app we store the name, email address, and message you submit, and email them to ourselves so we can reply. Those stored messages are deleted after 90 days.

3. How we collect information

  • Directly from you: account details, profile, collection entries, scans, grading photos, and messages.
  • Automatically: analytics events and error reports as you use the app, your push token if you allow notifications, anonymous analytics events as you use the website, and server logs.
  • From Apple or Google, if you sign in with them: only what is needed to authenticate you and, where you allow it, an email address.
  • From Apple and RevenueCat: your subscription status when it changes.

4. How we use information

  • Run your account and sign you in.
  • Store your collection and show it back to you.
  • Identify the cards you scan.
  • Produce AI condition estimates you ask for.
  • Show market prices, converted to your currency.
  • Deliver the paid tier and check what it entitles you to.
  • Count free scans.
  • Send the push notifications you allow: new sets and finished condition estimates.
  • Answer your messages and handle requested account recovery.
  • Keep the service working, secure, and free of abuse.
  • See which features are used and which errors happen, so we know what to improve and fix.
  • Meet obligations the law places on us.

We do not use your collection or your photos to advertise to you, and we do not sell information about you.

5. Account and support messages

We email replies to messages you send us, and reset codes if you request a password reset for an email and password account. No newsletters and no marketing. Push notifications are sent only if you allow them, and only about new sets and your condition estimates, as described in section 2.8.

6. Cookies and similar technologies

The dexfast.app website sets no cookies and writes nothing to your browser's storage. Its analytics, described in section 2.7, keep a visitor identifier in page memory only, which is discarded when you close the tab — so there is no cookie banner to click. The app uses no cookies either; the third-party SDKs it does use are named in section 8.

7. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we rely on:

  • Contract — running your account, storing your collection, scanning, grading, and the subscription.
  • Legitimate interests — security, abuse prevention, and understanding which features are used so the app gets better.
  • Consent — access to your camera and photo library, and push notifications, which you grant in iOS and can withdraw in Settings at any time.
  • Legal obligation — records we are required to keep.

8. How we share information

We do not sell your personal information and we do not share it for advertising. We use these processors, each receiving only what its job needs:

  • Convex (United States) — our database, file storage, and server functions. It processes and stores the account, profile, collection, scan-record, grading, push-token, subscription, and contact-form data described above. Ordinary scan images never reach it; submitted paired assessment photos are kept for up to 14 days.
  • OpenRouter and its model providers — receive the Front and Back photos you submit for an AI condition estimate.
  • Google (global) — Google Sign-In authenticates you if you use it.
  • Apple (United States and other countries) — App Store billing, and Sign in with Apple if you use it.
  • RevenueCat (United States) — your subscription status and the billing identifier that goes with it.
  • PostHog (United States) — product analytics events and error reports keyed to your internal user id.
  • Expo (United States) — delivers push notifications to Apple. It receives your push token and the notification text.
  • Resend (United States) — delivery of the emails described in section 5.
  • Scrydex (processing region not published) — the card catalogue and market prices. It receives no personal data; we only ask it about cards.

We may also disclose information where the law requires it, or where it is necessary to protect the service, its users, or us.

9. Third-party services

Each provider above handles data under its own privacy policy and terms. Sign in with Apple, Google Sign-In, and App Store purchases are governed by Apple’s and Google’s terms as well as this policy.

10. International transfers

We operate from Vietnam, and our servers and several of our processors are in the United States. Using Dexfast means your information is transferred to and stored in the United States and handled by us in Vietnam.

11. Data retention

  • Account, profile, collection, scan records, and grading reports: kept while your account exists.
  • Submitted Front and Back assessment photos: new drafts are deleted 14 days after the draft is created; photos that already have a saved deadline keep that deadline. Each face is deleted on its own deadline.
  • Ordinary identification images: never sent to our servers. Local review and recovery evidence is removed after Add completes or is discarded.
  • Push tokens: until you turn notifications off, iOS replaces the token, or you delete your account.
  • Contact-form messages: 90 days.
  • Stored copies of emails we sent you: 7 days.
  • Server logs: a short period, for security and troubleshooting.
  • The one-way hash of your email address and the number of free scans used: kept after deletion, so free scans cannot be reset by deleting an account.

12. Account deletion

In the app, open Profile → Delete account. That deletes your account and the app data tied to it: profile and avatar, holdings, favourites, scan records, grading reports and their photos, push tokens, and your subscription record. If you signed in with Apple, we also revoke the sign-in grant. Your analytics profile is deleted from PostHog. Deletion is immediate and cannot be undone, and repeated attempts are rate-limited to protect the account.

Two things survive by design: the one-way hash of your email address with the free-scan count, and short-lived server logs. Cancelling a paid subscription is separate — do that in your App Store subscription settings; deleting your Dexfast account does not stop Apple billing.

13. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or export your information, to object to processing, to withdraw consent, and to complain to your data protection authority. Most of it you can do yourself in the app. For the rest, write to support@dexfast.app and we will answer within 30 days.

14. California residents

We do not sell or share personal information as those terms are used in California law, and we offer no financial incentive in exchange for data. Write to support@dexfast.app to exercise your access or deletion rights; we will not treat you differently for asking.

15. Children

Dexfast is not intended for children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has an account, write to support@dexfast.app and we will delete it.

16. Security

When you sign in with Apple or Google, Dexfast does not receive your provider password. Traffic is encrypted in transit, and access to production data is limited to the one developer who runs Dexfast. No system is perfectly secure; if a breach affects your information, we will tell you and any regulator we are required to notify.

17. Automated processing

Card identification and condition grading are automated and can be wrong. Neither decides anything with legal or financial consequences: you see every result and can correct or discard it.

18. Marketing and advertising

We do not send marketing email and we do not show ads.

19. Data accuracy

You can edit your profile and every entry in your collection in the app. Card names, images, and prices come from our card data provider and may lag the market; prices are estimates, not offers.

20. Changes to this policy

When this policy changes we update this page and the effective date above. If a change materially affects you, we will say so in the app.

21. Contact

Khoa Le — Dexfast
Ho Chi Minh City, Vietnam
support@dexfast.app