Privacy Policy

Last updated: November 2026

Gotta Track 'Em All ("we", "our", or "the app") is a Pokemon TCG collection tracker. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

Data Stored on Your Device

Your card collection data is stored locally on your device using Hive (a local database). This data never leaves your device unless you explicitly enable Cloud Sync.

• Card ownership and quantities
• App preferences and settings
• GDPR consent status (if applicable)

Camera. The card scanner uses your camera only to recognize cards, and recognition runs entirely on your device. Camera images are never stored, uploaded, or sent to analytics.

Age

Apple's App Store and Google Play can tell the app your age range (for example, 13–15): Apple where the law requires it, and Google Play where the law requires it or where you or a parent allow it. The app turns it into one of three groups (under 13, 13–17, or 18 and over) and stores only that group, and whether it came from the store or from you, on your device. It does not keep the age range. If the store gives no age range, the app asks for your date of birth once, and stores only whether you are under 13, not the date. Your age group decides whether you can create an account and whether the app collects usage analytics, which is off if you are under 13. If you are under 13, the app also tells our ad provider (Google AdMob) to treat you as a child, which limits the ads you see. The age range itself never goes into analytics, crash reports or our servers. If you enter your date of birth, analytics records only that someone 13 or older completed this step.

Anonymous Sign-In

When you first open the app, it signs you in anonymously, so Firebase Auth assigns you a user ID even if you never create an account. We store your preferred card language, and when it was last updated, with that ID. If you never create an account, the ID and this data are deleted automatically after 90 days without using the app (see Data Retention).

Account Data (Optional)

If you create an account, we collect:

• Email address — used for authentication only
• User ID — a unique identifier generated by Firebase Auth
• Display name — the name you enter when you sign up, or the one your Google or Apple account provides
• Profile photo link — if your Google account has a profile photo, a link to it
• Whether you are 13 or older — you confirm it when you sign up with email; for Google and Apple sign-ins we rely on those services' age requirements
• Email verification status, your preferred card language, and when the account was created and last updated

We do not ask for your phone number or physical address.

Subscription Data

If you subscribe to Pro, the following data is processed by our payment processor (RevenueCat):

• Purchase history and subscription status
• App User ID (linked to your account)
• Transaction receipts from Apple App Store or Google Play

RevenueCat does not have access to your payment card details. All billing is handled by Apple or Google.

Analytics

We collect usage analytics to improve the app:

• Feature usage (e.g., which screens you visit)
• Card activity: cards you view, zoom into, add or remove, with the card and set IDs, the card name and the quantity
• Collection and sync events (e.g., sorting and filtering, sync results, backups)
• Subscription and ad events (e.g., purchase, restore, cancel, ad requests and clicks)
• Error events for debugging

Firebase Analytics also collects some information automatically, such as your device model, OS and app version, approximate location (such as country, region or city, derived from your IP address) and, where available and allowed, your device's advertising identifier.

Analytics data is collected via Firebase Analytics. It is pseudonymous: events are linked to a random identifier for your app installation, not to your name, email or account.

Crash Reports

When Share crash reports (Settings > Privacy & Data) is on, the app sends a report to Firebase Crashlytics when it crashes, and for some errors it recovers from, such as a failed sync. A report contains the error and where in the app it happened, your device model, OS and app version, a random installation identifier, and the app's state at the time (such as your card languages and subscription tier). If you are signed in with an account, it also contains your user ID. It may also include your recent analytics events (see Analytics), such as cards you recently viewed or added. It does not contain your full collection, your email or your name.

The setting is on by default only where consent for crash reporting is not legally required. Everywhere else, including the EU/EEA and UK, it is off until you turn it on. It is always off for users under 13. You can turn it off at any time in Settings > Privacy & Data: pending reports are deleted and no further reports are sent.

Push Notifications

New set alerts are opt-in: nothing is sent unless you turn on New set alerts (Settings > Notifications) and allow notifications in your device settings. The app receives them through Firebase Cloud Messaging, which issues a device token that is processed by Google. We store no token and no notification preference on our servers: your choices stay on your device. Turning the setting off stops delivery to that device, and deleting your account in the app also clears that device's subscriptions. Subscriptions belong to an installation and are tied to no account, so other devices, and account deletion through the website, do not affect them: turn the setting off in Settings on each device.

Feedback

When you send feedback (Settings > Send Feedback), we store your message, the category you chose, your user ID, the time you sent it, and information about your device: platform, OS version, app version and build number, and device model. We automatically check the message for personal information, such as an email address or phone number, and flag it if we find any; the message itself is not changed. Your feedback is deleted with your account (see Data Retention).

Sign-in Activity

To keep your account secure and to investigate sign-in problems, we keep a log of sign-in activity: when you sign up, sign in, sign out, confirm your identity again (for example, before deleting your account), request a password reset or request account deletion, and when one of these fails (except signing out). Each entry contains the type of event, the sign-in method (email, Google or Apple) where there is one, the time, your platform (such as iOS or Android) and app version. Entries for successful sign-ins, sign-outs and other account events also contain your user ID; most entries for failures do not. Depending on the event, an entry also contains whether you are a new user, the date your account is scheduled to be deleted, or the error code and error message of a failure. Before an error is stored, email addresses we detect in it are reduced to their first letter and domain, and the error message is shortened to 200 characters. A password reset entry contains your email address, reduced the same way, and no user ID. Entries with your user ID are deleted with your account (see Data Retention); entries without one, such as password reset requests and most failures, cannot be linked to your account and are deleted automatically after 90 days (see Data Retention).

How We Use Your Data

• Authentication: To sign you in and sync your collection across devices
• Subscription management: To verify your Pro status and manage entitlements
• App improvement: Pseudonymous usage analytics help us understand which features to improve
• Stability: Crash reports, while Share crash reports is on, help us find and fix crashes
• Feedback: Feedback you send helps us investigate the problems you report and improve the app
• Security: Sign-in activity helps us protect your account and investigate sign-in problems
• Support: Your email may be used to respond to support requests you initiate

Third-Party Services

Your Rights

For All Users

• Export your data: Settings > Privacy & Data > Export My Data
• Delete your data: Settings > Privacy & Data > Delete My Data (on this device, clears your milestone message settings, resets your crash report choice to the default for your region, clears the count of days you opened the app and your privacy consent, and stops linking this device to your account at our payment processor, which keeps its existing purchase records; your card collection is kept)
• Delete your account: Settings > Delete Account (removes your authentication account), or visit our web deletion page

Additional Rights for EU/EEA/UK Users (GDPR)

• Consent: We ask for your consent before processing subscription-related data
• Crash reports: Share crash reports is on by default only where consent is not legally required, and always off for users under 13 (see Crash Reports); if you are 13 or older, you can turn it on or off at any time in Settings > Privacy & Data
• Withdraw consent: You can revoke consent at any time in Settings > Privacy & Data. This stops linking this device to your account at our payment processor until you grant consent again; our payment processor keeps its existing purchase records. Your Apple/Google subscription is not affected.
• Data portability: Use the Export feature to get a JSON copy of your data
• Right to erasure: Use Delete My Data to clear the data listed above, and Delete Account to remove your account after the retention period described below. Uninstalling the app removes the collection stored on this device

Data Retention

• Local data: Stored on your device until you delete it or uninstall the app
• Firebase Auth & Firestore: Account data is retained until you delete your account. After a deletion request is confirmed, your account enters a 30-day retention period during which you can cancel by signing back into the app. After 30 days, your user profile, collection data, feedback, sign-in activity linked to your user ID, and authentication account are permanently and irreversibly deleted by an automated daily cleanup process. If you requested deletion on our website, a record of that request (your email address, a hashed IP address, an anti-abuse score, your user ID and the request dates) is kept after the cleanup as proof that the request was carried out
• Sign-in activity without a user ID: Deleted automatically 90 days after it is recorded
• Anonymous accounts: If you never create an account, your user ID and the data stored with it are deleted automatically after 90 days without using the app
• RevenueCat: When you delete your account, your purchase history is deleted with it after the 30-day retention period. It is included when you export your data. Apple and Google keep their own purchase records under their policies
• Analytics: Aggregated analytics data is retained for up to 14 months
• Crash reports: Retained by Firebase Crashlytics for 90 days

Children's Privacy

This app is intended for users aged 13 and older. We do not knowingly collect data from children under 13.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the app after changes constitutes acceptance.

Contact Us

If you have questions about this privacy policy or your data:

• Email: support@gottatrackemall.app

Website

This section applies specifically to visitors of the GottaTrackEmAll website (gottatrackemall.app).

Hosting & Server Logs

This website is hosted on Firebase Hosting. As with any web server, Firebase Hosting automatically collects standard access logs, which may include:

• IP address
• Browser type and version
• Pages visited and timestamps
• Referring URL

These logs are managed by Google as part of the Firebase Hosting service and are subject to the Google Privacy Policy.

Fonts

All fonts used on this website are self-hosted. No requests are made to third-party font CDNs (such as Google Fonts), so no additional data is shared with external services when loading fonts.

Analytics

This website uses the Google tag (Google Ads) to measure our ads: it records that you visited from an ad and whether you then tapped the App Store or Google Play button. Google may set cookies and receive your IP address, browser details and the pages you visit for this. We use it only to count ad results, not to build a profile of you. The account deletion pages do not load it.

If you visit from the EEA, the UK or Switzerland, the tag runs with ad and analytics cookies turned off and sends Google only cookieless measurements. See how Google uses information from sites that use its services.