Privacy Policy

Last updated: 2026-09-06

Talaiot ("the app") respects your privacy. This policy explains what data we process and why. Data controller: Guillem Reig Martin, Spanish tax ID (NIF) 39404606V, address: Calle Cristina 19, 08301 Mataró (Barcelona), Spain. Contact: talaiot.tcg@gmail.com.

What data we process

• Account data: your email address (and the provider if you sign in with Google).
• Profile: display name, username, avatar photo and bio.
• Your collection: the cards you save, their language, grade, quantity and which collections they belong to.
• Social: who you follow and who follows you, and the chat messages you send.
• Camera and photos: when you scan a card, the photo is analyzed on your own device to identify it; it never leaves your phone and we do not store it. If you choose an avatar photo, it is uploaded to your profile.
• Purchases: if you subscribe to Talaiot Pro, the store (Apple or Google) tells us the status of your subscription (product, validity and renewal) so we can activate it on your account. We never receive your card or payment details.
• Notifications: if you turn notifications on, we store a device identifier (notification token) so we can alert you when someone follows you or sends you a message. You can turn them off in Settings → Notifications, and doing so deletes that identifier.
• Basic technical data needed for the app to work.

Why we use it

• To provide the service: account, cloud sync, collections and social features.
• To manage your Talaiot Pro subscription (activating it and checking its validity).
• Sending you social activity notifications (new follower, new message), only if you have turned them on.
• Security and moderation (blocks and reports).

Legal basis (GDPR)

• Performance of the contract: providing the service you request.
• Consent: when you create the account and accept this policy.
• Legitimate interest: keeping the app safe and free of abuse.

Where it is stored

We use Supabase as our backend; data is hosted on servers in the European Union.

Third parties

• Supabase (hosting and database, under a data-processing agreement).
• Google, only if you choose to sign in with Google.
• Apple App Store / Google Play: they process the subscription payment with the payment method of your store account, under their own privacy policies; we do not receive that data.
• RevenueCat (subscription management and receipt validation, under a data-processing agreement): it receives an identifier of your account and the purchase status, never your payment details.
• Expo (notification delivery service) and, through it, Apple (APNs) or Google (FCM): only if you turn notifications on. They receive your device token and the notification text, which for a message includes a preview of up to 120 characters.
• Card data/image and currency-exchange services: queried to show public information; they only receive basic technical data (such as your IP address) inherent to any connection, not other personal data.

International transfers

Some providers (for example, the market-price service, which runs only on our server) may be outside the European Economic Area, such as in the USA. In those cases, transfers rely on the appropriate safeguards provided by the GDPR, such as the Standard Contractual Clauses.

Your rights

You may exercise your rights of access, rectification, erasure, portability, restriction and objection, and withdraw your consent at any time without affecting the lawfulness of prior processing. You can delete your account and all your data from Settings → Delete my account. You may also lodge a complaint with your data protection authority (in Spain, the AEPD, www.aepd.es).

Retention

We keep your data while you have an account. When you delete it, everything is permanently removed, except data we must keep to comply with legal obligations (for example, billing records) for the legally required periods.

Automated decision-making

We do not make automated decisions with legal effects about you, nor do we build profiles with your data.

Minors

The app has a minimum age of 14 to create an account.

Data security

We apply reasonable technical and organizational measures to protect your information. No method of transmission over the internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

External links

The app may contain links to third-party sites (for example, Cardmarket). We are not responsible for their content or privacy practices; we recommend reviewing their policies.

Cookies

The app does not use cookies.

Changes

We may update this policy. We will notify you of relevant changes within the app.

Contact

For any privacy question, write to talaiot.tcg@gmail.com.