Scanemon Privacy Policy
Updated 22 September 2026
This policy covers Card Value Scanner: Scanemon, provided by Anul Agarwal, including Android package com.momo.scanemon.card and iOS bundle com.scanemon.card.value.scanner. Contact: kolagames07@gmail.com.
Your collection and device
Cards you save, collection folders, watchlist entries, preferences and saved card images are stored locally in the app. Device or operating-system backups may contain app data. Browsing and price lookup use online catalog services; card names, numbers, set identifiers and search queries are sent to our catalog server and its price-data providers, including Pokémon Price Tracker. Images loaded from catalog hosts are subject to those hosts' request handling. Guide prices are estimates, not appraisals.
Optional AI photo recognition
Before using AI recognition, the app asks permission to send your selected card photo through our server to OpenAI to read the card's details. You can choose Not Now and continue using non-AI features. Avoid photos containing faces, documents or other personal information. The server reduces image size and strips metadata before forwarding the image. We do not write uploaded photos to our recognition server's disk. Recognized card results may be kept there for up to 24 hours to handle duplicate requests.
We use OpenAI's API with response storage disabled. This is not a promise of zero provider retention: OpenAI may retain content for abuse monitoring, normally up to 30 days, or longer for applicable safety or legal reasons. API data is not used for model training by default. See OpenAI's data controls. Review or withdraw future AI photo-sharing permission in Settings. Withdrawal cannot recall data already processed. Earlier app versions may send recognition photos directly to OpenAI; update the app to use the protected server flow.
Installation security and purchases
Firebase Authentication creates a pseudonymous installation identity without a sign-up or email/password screen. Firebase App Check, using Google Play Integrity or Apple's App Attest/DeviceCheck, helps verify requests come from the genuine app. These services process app/device integrity and technical information. Our server checks access with Google Play or Apple and retains encrypted purchase tokens or receipts and pseudonymous purchase bindings so existing buyers can restore access and share usage limits across devices. These records are not anonymous and are not payment-card details.
RevenueCat manages purchase status, app-installation/customer identifiers and restoration. Apple or Google handles checkout and payment information; we do not receive your full payment-card details. Store, RevenueCat and Firebase records have their own retention and deletion processes.
Analytics and service protection
Firebase Analytics records app usage, device/app information and events such as onboarding, scan results, collection counts and purchase/restore events. App-instance identifiers may be shared with RevenueCat for purchase-conversion attribution and Google Ads reporting. We do not include card photos, raw purchase receipts or personal collection contents in these events.
Our services receive IP addresses, request identifiers, timestamps and app/security information to deliver requests, enforce fair-use and spending limits, prevent duplicate processing and investigate abuse. Recognition request bodies and authentication headers are not logged by our recognition endpoint. Other catalog, hosting and provider services may maintain technical logs.
Retention, clearing data and requests
Use Clear All Data in Settings to remove local collections, saved images, watchlist and preferences and withdraw AI permission. This does not cancel a subscription, delete your store purchase history, or automatically erase Firebase, RevenueCat or server records.
On the recognition server, raw IP limiter values expire after one minute, hashed claim IP values after one hour, claim-attempt rows after one day, and claim records after 30 days. Encrypted purchase proofs and purchase bindings are retained while needed to verify access and restoration. Pseudonymous request, image-hash and spend records are retained for replay, quota, fraud prevention and accounting integrity. Protected database journals or backups can retain older bytes; logical expiry is not immediate physical erasure from every copy.
Email us to request access, correction or deletion of records we control. Because the app does not use an email login, we may need minimal information to locate the installation or verify purchase ownership. Do not send passwords, authentication tokens or payment-card details. We review requests and explain any records that must remain for security, purchase, legal or accounting obligations. Removing the app alone does not erase all remote records.
Other providers and your choices
Our hosting provider, Hetzner, operates server infrastructure. Data may be processed outside your country by us and the providers above. Information is shared to deliver the requested features, handle purchases, measure app performance and protect the service, not to sell your photo library. Camera/photo permissions are requested only for the relevant action and can be changed in device settings.
Scanemon is not intended for children under 13. Contact us if you believe a child's personal data was provided. Depending on your location, you may have additional privacy rights and may contact your local data-protection authority. We update this page when our practices change and request fresh consent when required.