Privacy Policy
Last updated: 31 October 2026
1. Controller
Dominik Triska DT Software Studio c/o POSTFLEX PFX-441-864 Emsdettener Straße 10 48268 Greven Germany Email: [email protected]
2. Scope and summary
This policy covers the CardHub TCG app and the website dtsoftwarestudio.com. The app needs no user account and contains no trackers or analytics tools. You only see advertising if you choose to watch videos to unlock scans (section 13). Photos and text recognition stay on your device. Our server only receives what is needed for card search and prices. Only if you agree does it also receive the device token for notifications, and only if you turn on “Friends” your name, your cards and your wishlist for comparing with friends. If you set price alerts, it receives your alerts together with the device token for notifications. If you send us feedback from the app, it receives your message and the details you choose to include. The website sets no cookies and uses no tracking.
3. Camera, photos and text recognition
The app only uses the camera to scan cards. Card detection, cropping and text recognition run on your device; photos are not uploaded. So that no scan gets lost, the app stores the photos of your last 150 scans together with the recognised text locally on your device. You can export or delete them in your profile.
4. Card search, set lists and prices
For card search the app sends the recognised name, card number, set hint, language and recognised text lines to our server app.chemistrynexus.com; for prices and set lists it sends the identifiers of the cards and sets concerned. For technical reasons the server also receives your IP address and the time of the request. The IP address is only held briefly in memory to limit excessive requests from one device; it is not stored permanently, and server logs contain no IP addresses. We operate the server ourselves in Germany. It obtains catalogue and price data (Cardmarket and TCGplayer prices) from services such as TCGdex, Scryfall and Cardmarket, and exchange rates from the European Central Bank; no data about you is passed on. The country and price market you choose in the app stay on your device; the app calculates the display there.
Legal basis: Art. 6(1)(b) GDPR (providing the app's functions) and Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
5. Website dtsoftwarestudio.com
We run the website on our own server in Germany; it is delivered through Cloudflare (see section 6). It sets no cookies, uses no tracking and loads no content from other providers. When you open a page, technically necessary data is processed – IP address, time, requested page and browser identifier – to deliver the pages and protect them against attacks. The logs of our own web server contain no visitor IP addresses.
Legal basis: Art. 6(1)(f) GDPR.
6. Cloudflare
The encrypted connections to our app server and to the website run through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards the requests and protects the servers against attacks. In doing so, Cloudflare processes your IP address and technical connection data on our behalf (processing under Art. 28 GDPR). Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).
Legal basis: Art. 6(1)(f) GDPR.
7. Card images
The app loads card images directly from the image servers of the catalogue providers, for example TCGdex and Scryfall. As with any download from the internet, these providers receive your IP address.
Legal basis: Art. 6(1)(b) GDPR.
8. Purchases, codes and scan credits
Purchases (scan packs, unlimited folders and the CardHub Premium subscription) and the redemption of offer codes are handled by Apple through the App Store. We do not receive any payment data. The app only receives the purchase confirmation from Apple (product, transaction number, date, subscription status) and adds the credits or unlocks the feature. With every purchase the app passes Apple a random identifier of this installation (app account token) so that subscription renewals are assigned to the right device; it contains no information about you.
Free scans, scan credits and processed purchases are stored in your device's keychain so that your credits survive a reinstall. If you are signed in to iCloud, the app synchronises these entries – credits with product, transaction number and date, refunds and the number of scans used per device and month – through the private iCloud database (CloudKit) of your Apple Account, so that your credits are available on all your devices. This data is kept in your iCloud storage at Apple; we have no access to it. Without iCloud it stays on the device only. Apple's privacy policy applies to the payment and to iCloud.
Legal basis: Art. 6(1)(b) GDPR.
9. Notifications (push)
Only if you agree – on first launch or in your profile – does the app register for notifications. We then store on our server the device token issued by Apple, the app language, the environment (test or App Store) and the date of registration. We use this solely for the offers and free scan codes you chose in your profile. Notifications are delivered via the Apple Push Notification service. You can withdraw your consent at any time in your profile. The app then immediately unregisters your device with Apple and requests deletion of the token from our server; without a connection it retries as soon as it is online again. Tokens that Apple reports as invalid are deleted automatically.
Legal basis: Art. 6(1)(a) GDPR (consent).
10. Card comparison via Bluetooth
When comparing cards, two devices exchange the selected cards directly via Bluetooth. Our server is not involved.
11. Friends and invitations
When you turn on “Friends” in the card comparison, the app creates a friend profile on our server. We store the name you enter for it, your friend code, a random profile ID with a key (on the server only as a check value, in plain text only in your device's keychain), your cards (catalogue ID, name, number, set, language, finish and quantity), your wishlist and the time of the last update. Prices, folders, photos and purchases are not transferred. Anyone who knows your code or link can retrieve your name, your cards and your wishlist – in the app and, without the app, as a web page at your link (name, duplicate cards and wishlist; the page is blocked for search engines); “Create new code” makes old codes and links invalid. Your friend list – your friends' codes and names you give them – is stored by the app on your device only.
For the invitation reward (20 scans for you and your friend) we store which code invited you and the rewards credited. So that a reward is paid only once per device, our server checks with Apple's DeviceCheck service whether an invitation was already redeemed on the device. For this the app sends a short-lived device token generated by Apple, which our server passes on to Apple; Apple stores two bits for your device for our developer account. We do not store the token itself.
“Turn off friends” deletes your profile with all shared data from our server immediately. We delete profiles automatically that have not been updated for one year.
Legal basis: Art. 6(1)(a) GDPR (consent by turning on “Friends”) and Art. 6(1)(b) GDPR (providing the feature).
12. Price alerts
When you set a price alert, the app sends the list of your price alerts to our server: for each alert the catalogue ID, name and number of the card, its language, the price market, the kind (below/above) and the target price. In addition: the device token Apple assigns for notifications, the app language, the environment (test or App Store) and a random ID of this installation (on the server only as a check value, in plain text only in your device's keychain). Our server checks the prices about every three hours and sends you a notification via the Apple Push Notification Service when a target is reached; for this it stores the last price seen and when the alert fired. No consent for offers is needed for this, and the token is not used for offers. If you delete all price alerts, the app removes the data from our server. We automatically delete installations that have not checked in for 180 days and tokens that Apple reports as invalid.
Legal basis: Art. 6(1)(b) GDPR (providing the feature you set up).
13. Ad videos for scans (Google AdMob)
When your free scans for the month and all extra scans are used up, you can choose to watch two short ad videos and get 5 scans for them (at most four times a day). The videos are provided by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The app only starts the Google Mobile Ads SDK when you tap “Watch video”; before that, no data goes to Google. In the EU, the United Kingdom and Switzerland, Google's consent dialog asks you first; you can change your choice at any time in the app under Profile › “Ad privacy”. We only request non-personalised, family-friendly ads and do not ask for permission to track you across apps, so your device's advertising identifier is not used. In doing so, Google processes in particular your IP address (and from it your approximate location), device and app information, an app-specific identifier, your interactions with the ads and diagnostic and performance data in order to deliver the videos, prevent abuse and measure reach. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More information: policies.google.com/technologies/partner-sites. With Premium you do not see any videos. How many videos you have watched today is stored only on your device.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent) as well as Art. 6(1)(b) GDPR (providing the scans you unlock).
14. Backups
You store backups and CSV exports yourself in a location of your choice. We receive none of it.
15. Contact and feedback
If you write to us, we process your email address and the content of your message to answer your request. Our mailbox is provided by Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. We delete messages once the request is settled and no statutory retention obligations apply.
With “Send feedback” in the profile of the app you can send us a message. We then store on our server the kind (idea, bug, praise, other), your text, an email address for our reply if you enter one and – if you leave “Include device details” on – app version, iOS version, device model and app language. We do not store an account, a device token or your IP address with it; the IP address is only used briefly in memory to limit too many messages from one connection. We read feedback to improve the app and to answer you if you wish, and delete it no later than one year after it arrived, or earlier on request.
Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR.
16. Retention
Local data stays on your device until you delete it or remove the app; scan credits in the keychain remain even after removal. The credit entries in your iCloud remain stored until you delete them in your device's iCloud storage settings. We store push tokens until you withdraw consent or Apple reports them as invalid. We store friend profiles until you turn off “Friends”, but no longer than one year after their last update. We store price alerts until you delete them in the app, but no longer than 180 days after the app last checked in. We store feedback from the app for no longer than one year.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Please write to [email protected]. As there are no user accounts, please include the support ID from the app's profile for questions about notifications and your friend code for questions about friends. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
18. No automated decisions
There is no automated decision-making and no profiling.