Privacy Policy

Kira is developed and published by Guillem Martínez, an independent developer (“we”, “us”), who is the data controller for the processing described here. You can reach us at hello@kiratcgscanner.com.

Your binders, cards, scan history, settings and recent searches are stored only on your phone. We don’t upload them to our servers and we can’t see them.

Deleting the app, or using Profile › Reset all data, erases them. Because nothing is stored on our side, we can’t recover them for you. Your phone’s own backups (in iCloud, in your Google account or on a computer) may include this data, under Apple’s or Google’s terms.

Kira uses the camera only while you scan, to read the text printed on your cards. Recognition runs on your phone: with Apple’s on-device text recognition on iPhone, and with Google’s ML Kit, built into the app, on Android. Camera images are never saved, uploaded or shared, apart from the photo you choose to send with Identify with AI (below). You can turn camera access off at any time in your phone’s settings for Kira.

On Android, ML Kit sends Google technical diagnostics to keep it working: the phone’s model and Android version, Kira’s version, how the recognition performed, error codes and an identifier for the installation that isn’t meant to identify you or your phone. It never sends camera images or the text it reads. Google uses this data under its privacy policy.

When the scanner can’t read a card, you can tap Identify with AI. Only then, and only once you’ve agreed the first time, Kira takes one photo of the card in view and sends it to our card identification service, which runs on Supabase in the European Union, together with the games you’ve chosen and the anonymous ID RevenueCat knows your subscription by.

The service checks with RevenueCat that your subscription is active, then sends the photo to Anthropic, whose AI model, Claude, tells it which card the photo shows. Kira then finds that card in its catalog on your phone. We don’t store the photo. Anthropic processes it only to answer the request, doesn’t use it to train its models, and deletes it within 30 days, unless it must keep it longer to comply with the law or enforce its usage policies.

For a fair-use daily limit, the service counts how many cards each subscription identifies a day, under a one-way hash of the anonymous ID, and deletes those counts after about a month.

To keep scans instant, Kira downloads card catalogs and market prices for the games you choose from our storage provider, Supabase, which stores this content in the European Union and delivers it through a content delivery network. These downloads contain no information about you.

Card pictures load directly from public card databases and publishers’ websites: TCGdex (Pokémon), Scryfall (Magic: The Gathering), YGOPRODeck (Yu-Gi-Oh!), Lorcast (Disney Lorcana), SWU-DB (Star Wars: Unlimited), TCGplayer, Bandai (One Piece, Dragon Ball, Digimon and Gundam), Legend Story Studios (Flesh and Blood) and Riot Games (Riftbound).

Like any internet request, these downloads include your device’s IP address and basic technical details, such as the app and operating system version. The providers may keep them briefly in server logs for security and reliability, under their own privacy policies. We don’t combine them with anything else about you.

Ultimate Experience is sold through Apple’s App Store on iPhone and Google Play on Android, and Apple or Google processes your payment. We never see your payment details.

We use RevenueCat to check whether your subscription is active. RevenueCat receives an anonymous ID created by the app, your App Store or Google Play purchase history for Kira (such as the product, dates and transaction IDs) and basic technical details such as the app and operating system version, country and IP address. It never receives your name, email address or payment details. The privacy policies of Apple or Google, and of RevenueCat, apply to that processing.

Kira shows no ads, and we never sell or rent data. We do advertise Kira on Instagram, Facebook and TikTok, and in Apple Ads (App Store search). On iPhone, Kira asks in iOS’s own prompt whether it may track you; only if you allow it does it share identifiers with Meta and TikTok, to measure their ads (see Ad measurement on iPhone). Otherwise it doesn’t track you across other companies’ apps or websites. The usage statistics that versions before 1.0.5 could send, described below, aren’t linked to you or used for advertising; on Android, ML Kit’s diagnostics go to Google only (see Camera).

Kira doesn’t send usage statistics. Versions before 1.0.5 asked while you set up the app whether to share anonymous usage events with PostHog, our analytics provider, which stores them in the United States, and sent nothing unless you chose Share. If you did, those versions keep sending events until you update Kira; you can stop them in their Profile › Share anonymous usage data.

An event says what happened in the app and when: for example, a setup step finished (with the games and currency you picked), the subscription screen or a special offer shown or closed, a purchase started, completed or cancelled, whether you allowed notifications (in versions before 1.0.4), and the app being opened or closed. Each event also includes Kira’s version, your phone’s make and model, its operating system, language, time zone and screen size, and a random ID that Kira creates on your phone, so we can count installs without knowing who you are.

Events never include your name, email address, collection, searches, camera images or payment details, and they aren’t linked to the anonymous ID RevenueCat uses for your subscription. Your IP address reaches PostHog with each request, but PostHog discards it instead of storing it, and we don’t use it to estimate your location.

To learn which of our Instagram, Facebook and TikTok ads bring people who install Kira and start a subscription, Kira on iPhone asks you once, while you set it up, whether it may track you (Apple’s “Allow Kira to track your activity…” prompt). If you don’t allow it, the app sends nothing to Meta or TikTok.

If you allow it, Kira starts Meta’s SDK, which sends Meta Platforms Ireland your device’s advertising identifier (IDFA), an anonymous ID the SDK creates, and when Kira is installed and opened, with technical details such as the app version, device model, operating system and IP address. RevenueCat also sends Meta those identifiers with your trial starts, subscription purchases and renewals (product, price and date). Meta never receives your name, email address, collection, searches or camera images.

If you allow it, Kira also starts TikTok’s App Events SDK, which sends TikTok Technology Limited (Ireland) the same advertising identifier, an anonymous ID the SDK creates, when Kira is installed and opened, and, when you start a trial or a subscription in Kira, the product, the price paid and the currency, with technical details such as the app version, device model, operating system and IP address. TikTok never receives your name, email address, collection, searches or camera images.

Meta and TikTok use this data to tell us which ads led to an install or a subscription, and each as an independent controller under its own privacy policy (Meta’s privacy policy, TikTok’s privacy policy), including to improve their ads. You can withdraw your permission at any time in iOS Settings › Privacy & Security › Tracking; Kira stops sending from then on.

Kira also advertises in Apple Ads, in App Store search. On iPhone, Kira passes Apple’s AdServices attribution token to RevenueCat, which asks Apple which Apple Ads campaign, ad group and keyword led to the install. This is Apple’s standard attribution: it uses no advertising identifier and doesn’t need your permission to track. We use it only to measure our own Apple Ads.

Kira doesn’t send notifications. Versions before 1.0.4 asked whether they could remind you before a free trial or an introductory month renewed; a reminder scheduled that way still arrives. Those reminders are scheduled on your phone; no push server is involved. You can turn them off in your phone’s notification settings for Kira.

When you open Cardmarket, TCGplayer, eBay or Wallapop from Kira, their websites and privacy policies apply.

kiratcgscanner.com uses no cookies and no trackers. Our hosting provider, Cloudflare, processes your IP address in server logs to deliver the site and keep it secure.

To know how many people visit and how they find the site, we use Cloudflare Web Analytics. It stores nothing on your device and doesn’t identify you: it counts visits without any code or identifier for you, so we only ever see totals. For each page view it records the page, the site that sent you, your country, your browser, operating system and type of device, and how quickly the page loaded.

If you email us, we use your email address and message only to reply and help you. We keep the conversation for as long as we need it to help you and delete it no later than 12 months after your last message, unless the law requires us to keep it longer.

The app never asks for your email. Before Kira was on the App Store, this website had an optional waitlist, now closed.

On 10 October 2026 we emailed everyone on it once to say that Kira was on the App Store. The same day we deleted the list, which Supabase had stored for us in the European Union. We no longer keep any waitlist data.

Where data protection laws such as the GDPR apply, we rely on:

• Performance of a contract: providing Kira and its Ultimate Experience subscription, Identify with AI included, when you use them or subscribe.
• Consent: usage statistics, in versions before 1.0.5 and only if you chose to share them, and ad measurement on iPhone, only if you allow tracking. You can withdraw it at any time, in iOS Settings › Privacy & Security › Tracking or, for usage statistics, in those versions’ Profile; that doesn’t affect what was sent before.
• Legitimate interests: delivering card data and images, keeping our services secure and reliable, counting visits to this website, and answering your messages.
• Legal obligations: keeping records where the law requires it.

We don’t sell or rent personal data, and we share it for advertising only with Meta and TikTok, and only if you allow tracking on iPhone (see Ad measurement on iPhone). We work with these service providers: RevenueCat (subscription status), Supabase (card data storage and the card identification service), Anthropic (identifying cards from photos with Identify with AI), PostHog (usage statistics from versions before 1.0.5), Cloudflare (website hosting and visit statistics) and our email provider. Each processes data only to provide its service to us and is contractually required to protect it with the same or equal protection as this policy. Apple and Google process store purchases as independent companies under their own privacy policies, Google also receives ML Kit’s diagnostics on Android, and the card image hosts listed above receive only the standard technical details of each download.

We may also disclose information if the law requires it. We don’t sell personal information. If you allow tracking on iPhone, sending identifiers to Meta and TikTok may count as “sharing” under California law; you can opt out at any time by turning tracking off for Kira in iOS Settings.

Some providers, such as RevenueCat, Anthropic, PostHog, Cloudflare, Meta and TikTok (if you allow tracking on iPhone) and, on Android, Google, may process data outside the European Economic Area, including in the United States. When they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

• Your collection and settings: on your phone until you delete them or the app.
• Camera images: never stored. We don’t store photos sent with Identify with AI either, and Anthropic deletes them within 30 days.
• Identify with AI daily counts: about a month.
• Download logs (card data, prices, images and this website): kept briefly by each provider, typically for days or weeks, for security and reliability.
• Usage statistics from versions before 1.0.5: kept by PostHog for up to 12 months.
• Website visit statistics: anonymous totals, kept by Cloudflare for up to 6 months.
• ML Kit’s diagnostics on Android: kept by Google under its own privacy policy.
• Ad measurement data (iPhone, if you allow tracking): kept by Meta and TikTok under their own privacy policies.
• Subscription records at RevenueCat: while needed to provide Ultimate Experience and meet legal obligations. You can ask us to delete them.
• Emails: up to 12 months after your last message.

Kira isn’t directed at children under 13, or under the minimum age in their country (14 in Spain), and we don’t knowingly collect personal data from them. Kira doesn’t ask anyone for personal details.

Your collection stays on your phone, so you control it directly: edit or delete binders at any time, or erase everything with Profile › Reset all data.

Depending on where you live, you may also have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. To use any of these rights, including deleting subscription records held by RevenueCat, email hello@kiratcgscanner.com. We answer within 30 days, and may ask for a detail such as an App Store or Google Play order ID to find your records.

You can also complain to a data protection authority. In Spain, that’s the Agencia Española de Protección de Datos (aepd.es).

Data sent between Kira and the services above is encrypted with HTTPS. Data on your phone is protected by its operating system, including device encryption when your phone is locked with a passcode.

If our practices change, we’ll update this page and the date at the top. If a change is significant, we’ll also point it out in the app.

Questions or requests about privacy: hello@kiratcgscanner.com