This policy explains what data the Custor TCG app ("Custor" or "the app") for Android and iOS processes, why, and what your rights are, under Regulation (EU) 2016/679 (GDPR).
- Custor has no accounts and no servers of its own: your collection stays on your phone.
- We (the developer) do not receive your collection, profile or trade data.
- The app shows ads through Google AdMob. Google may process some device data to show and measure ads, according to your consent choices.
- When you share your showcase (QR code or file), you decide which profile details to include; whoever receives it stores it on their own device.
1. Data controller
Ciro Scognamiglio (Zeroclip Studio)
Via Guglielmo Pepe 31, 84010 Sant'Egidio del Monte Albino (SA), Italy
Email: support@custortcg.com
2. Data stored only on your device
The following data is saved locally in the app's storage and is not sent to us:
- Collection: owned cards, quantities, conditions, languages, variants, prices you enter, wishlists, cards for trade, notes.
- Profile (optional): nickname, city, contact details you choose to add (e.g. Telegram, WhatsApp, email), trade preferences, profile picture.
- Shop profile (optional, sellers only): business name, VAT number, shop address, phone number, website.
- Digital identity: a cryptographic key pair generated on your phone. The private key is kept in the operating system's secure storage and never leaves the device; the public key lets other users verify that a showcase really comes from you.
- Saved sellers: other users' showcases you have scanned, including the profile details they chose to share, and any sellers you have blocked.
- Settings and the status of the "no banners" feature.
If you uninstall the app without a backup, this data is deleted and cannot be recovered by us.
3. Sharing your showcase with other users
When you generate your showcase QR code, print a fair stand card or send the showcase file (e.g. via Quick Share, Bluetooth or messaging apps), it contains the cards you selected and the profile details you chose to show, together with your public key and digital signature.
- Sharing happens directly between people, without going through our servers.
- The recipient stores the showcase on their own device. We cannot delete it from other people's devices: only share details you are happy to make visible.
- You can edit or clear your profile at any time; showcases you generate afterwards will reflect the changes.
4. Backups
You can export a backup of your collection and identity. The file is encrypted with a password you choose (AES-256-GCM, Argon2id key derivation): without the password it cannot be read, not even by us. Keeping the file and the password safe is your responsibility. You can also export lists as unencrypted CSV files.
5. Internet connections
The app connects to external services only to download public information. Your collection is not sent in these requests; as with any connection, the service receives your device's IP address and basic technical information.
- Card catalogues and images: TCGdex, Pokémon TCG API, Scrydex, Scryfall, YGOPRODeck, Lorcana API and, for some games or languages, publishers' official websites (e.g. One Piece Card Game, Pokémon Korea).
- Offline game data: if you choose to download it (e.g. Magic, Yu-Gi-Oh!), the app downloads the card list and keeps it on your phone. For Magic, the list comes from a public file on our website custortcg.com (hosted by Cloudflare), updated weekly from Scryfall data; if the site does not respond, the app uses Scryfall directly. For the other games it uses the services above. We do not use these downloads to identify you.
- Indicative prices: public reference price lists (e.g. Cardmarket, TCGplayer).
- VAT number check (shop profile only, at your request): the number is sent to the European Commission's VIES service.
- External links: when you open a link (e.g. Cardmarket, eBay, an app store), your browser opens and that site's policy applies.
Custor is not affiliated with, endorsed or sponsored by The Pokémon Company, Nintendo, Wizards of the Coast, Konami, Bandai, Disney/Ravensburger or the services listed above. Game names are trademarks of their respective owners.
6. Camera and photos
- Camera: to scan cards and showcase QR codes. Images are processed on the device and are not sent to external servers.
- Scan photos: they stay on your phone only. Photos of cards that are recognised and added are deleted straight away; photos of cards "To identify" are kept until you identify or delete them (after 60 days the app asks whether to keep them).
- Photos / gallery: only when you pick an image yourself (e.g. a profile picture) or save your showcase QR code to the gallery.
You can revoke these permissions in your phone's settings; some features will then be unavailable.
7. Advertising (Google AdMob)
Custor is free and supported by banner ads and by optional videos that, when watched to the end, remove banners for 8 hours. Ads are served by Google AdMob (Google Ireland Limited), which acts as an independent controller for its own processing.
To show and measure ads, Google may process: your device's advertising identifier (GAID on Android, IDFA on iOS), IP address, device and app information, and interactions with ads.
- EU / EEA / UK: on first launch we ask for your consent through Google's consent management platform. You can accept, refuse or customise; if you refuse, you may see non-personalised ads. You can change your choice at any time in Settings → Manage privacy consent.
- iOS: you are asked whether to allow tracking (App Tracking Transparency). You can change this in iOS Settings → Privacy & Security → Tracking.
- Android: you can reset or delete your advertising ID in your phone's settings.
- United States: in states with privacy laws (e.g. California) you can opt out of the sale or sharing of your data for advertising from Settings → Manage privacy consent.
More information: How Google uses data.
8. Legal bases
- Consent (Art. 6(1)(a) GDPR): personalised ads and related on-device technologies.
- Legitimate interest (Art. 6(1)(f)): non-personalised ads to support a free app; app security.
- Performance of your request (Art. 6(1)(b)): replying to support emails and checking VAT numbers.
9. Support and reports by email
If you write to us (e.g. at support@custortcg.com or through the "Report seller" feature), we process the data in your message only to reply and handle the report, and keep it for as long as necessary, normally no longer than 24 months.
10. Children
Custor is not directed at children under 14. If you are under 14, use the app only with the consent and supervision of a parent or guardian. We do not knowingly collect data from children under 14.
11. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent at any time. Since the app's data is on your device, you can exercise most of these rights directly: edit or delete your profile, export your data, delete the app. For advertising data you can use the Google tools mentioned above.
For any request, write to support@custortcg.com. You also have the right to lodge a complaint with your data protection authority; in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
12. Transfers outside the EU
Some providers (e.g. Google, catalogue services) may process data outside the European Economic Area, with the safeguards required by the GDPR (e.g. standard contractual clauses or adequacy decisions).
13. Changes
We may update this policy. The current version is always available at custortcg.com/en/privacy, with the date of the last update; significant changes will also be announced in the app.