Privacy Policy
GRADEON AI · EFFECTIVE MARCH 2026 · UPDATED SEPTEMBER 2026
Gradeon AI ("Gradeon", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights regarding your personal data.
By using Gradeon, you consent to the data practices described in this policy. If you do not agree, please do not use the app.
1. Information We Collect
a) Account Information
When you create an account or sign in with Google or Apple, we collect:
- Email address
- Display name
- Profile picture (if uploaded)
- Authentication credentials (securely hashed, never stored in plain text)
b) Card Images
When you use Gradeon's scanning features, we collect photos you capture or select from your photo library. These images may include the front, back, and close-up details of trading cards. Card images are stored securely in encrypted cloud storage and associated with your account.
c) Grading and Analysis Data
We store the results generated from AI analysis of your card images, including:
- AI-generated condition grades (corners, edges, surface, centering)
- Defect analysis (type, severity, location)
- Card identification (name, set, number, language)
- Centering measurements
- Market price data retrieved from third-party sources
d) Usage Data
- App usage patterns and feature interactions
- Scan frequency and session data
- Crash reports and performance data (via Sentry)
e) Device Information
- Device type and model
- Operating system and version
- App version and build number
2. How We Collect Your Data
We collect data through the following methods:
- Directly from you: When you create an account, upload a profile picture, scan cards, or contact support.
- Automatically: Device information, crash reports, and usage analytics are collected automatically when you use the app.
- From third parties: Authentication data from Google or Apple when you use social sign-in.
3. How We Use Your Information
We use your information for the following purposes:
- To provide AI-powered card grading and identification services
- To maintain your card collection and grading history
- To deliver market price estimates and price history
- To process in-app purchases and manage subscriptions
- To send push notifications about completed grades and account updates
- To improve our AI grading accuracy and service quality
- To diagnose and fix bugs and technical issues
- To prevent fraud, abuse, and violations of our Terms of Service
4. Third-Party AI Processing
Important: Gradeon uses a third-party AI service to analyze your card images. Before your first scan, the app will ask for your explicit consent. This section explains exactly what data is shared, with whom, and how it is handled.
a) What Data Is Sent
When you scan a trading card, the following data is sent to the third-party AI service for analysis:
- Card images only: The photos you capture of your trading cards (front, back, and detail close-ups).
No personal information (such as your name, email, account ID, or device information) is included in the data sent to the AI service.
b) Who Receives the Data
Card images are sent to Google Gemini AI (operated by Google LLC) via the Google Generative Language API. This processing occurs on Google's cloud infrastructure.
c) How the Data Is Used
Google Gemini AI processes your card images to:
- Identify the card (name, set, number, language)
- Analyze card condition (corners, edges, surface defects)
- Detect physical defects (scratches, whitening, dents, creases, etc.)
d) Data Retention by the AI Provider
Card images are processed by Google Gemini AI in real-time and are not retained by Google after processing is complete. Google does not use your card images to train or improve its AI models. For more information, see Google's Gemini API Terms of Service.
e) Your Consent
Before your first scan, Gradeon will display a consent dialog explaining the AI data processing. You must explicitly agree before any card images are sent to Google Gemini AI. You can use Gradeon's non-scanning features (collection management, profile, settings) without consenting to AI processing.
5. Third-Party Services
We use the following third-party services to operate Gradeon:
| Service | Provider | Purpose | Data Shared |
|---|---|---|---|
| AI Grading | Google Gemini AI (Google LLC) | Card image analysis, defect detection, condition grading | Card images only |
| Computer Vision | OpenCV (self-hosted) | Centering measurement and card detection | Card images (processed on our servers) |
| Backend & Database | Supabase (AWS) | Authentication, data storage, file storage | Account data, card images, grading results |
| Authentication | Google Sign-In / Apple Sign-In | Account authentication | Email, name (as authorized by you) |
| Payments | Apple App Store / Google Play Store | In-app purchases and subscriptions | Transaction data (managed by Apple/Google) |
| Subscription Management | RevenueCat | Subscription tracking and entitlements | Anonymous user ID, purchase receipts |
| Market Prices | PokeTrace / Cardmarket / TCGplayer | Trading card price data | Card name and set (no personal data) |
| Error Tracking | Sentry | Crash reporting and performance monitoring | Device info, crash logs (no card images) |
| Push Notifications | Expo (EAS) | Delivering push notifications | Push token, notification content |
Each third-party provider is bound by their own privacy policies and data processing agreements. We ensure that all providers offer the same or equivalent level of data protection as described in this policy.
6. Data Sharing
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
We share your data only in the following circumstances:
- Service providers: With the third-party services listed in Section 5, and only to the extent they need it to provide their service to us.
- Legal requirements: When we are required to do so by law, court order, or a valid request from a public authority.
- Protection of rights: When it is necessary to protect the rights, property, or safety of Gradeon, our users, or others, including to prevent fraud or abuse.
- Business transfers: If Gradeon is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
- With your consent: In any other case, only after you have given us your explicit permission.
7. Data Retention
We keep your personal data only for as long as we need it for the purposes described in this policy:
- Account data, card images, and grading history are kept while your account is active, so your collection is always available to you.
- When you delete your account, your account, card images, grading history, and personal data are permanently deleted within 30 days.
- Crash reports and technical logs are kept only as long as needed to diagnose and fix issues.
- Purchase records are handled by Apple and Google. Where the law requires us to keep transaction records, we keep them only for the required period.
8. Data Security
We use technical and organizational measures to protect your data, including:
- Encryption in transit (TLS 1.3) and at rest
- Private storage buckets for card images, accessible only to you and our grading service
- Row Level Security to keep each user's data isolated from other users
- Hashed authentication credentials that are never stored in plain text
No method of transmission or storage is 100% secure. If we become aware of a security incident that affects your personal data, we will notify you and the competent authorities as required by law.
9. Your Rights
Depending on where you live, including under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), you have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete your account and data: in the app, go to Profile > Delete Account
- Export your data in a portable format: in the app, go to Profile > Export My Data
- Withdraw consent to AI processing at any time. This does not affect processing that already took place, but new scans will not be possible without it.
- Object to or restrict certain processing of your data
- Lodge a complaint with a data protection authority, such as the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the authority in your EU country of residence
To exercise any of these rights, email us at hello@gradeon.ai. We respond within 30 days.
10. International Data Transfers
Gradeon is based in Switzerland. Some of our service providers, including Google, Supabase (AWS), and Sentry, may process data in other countries, including the United States. When your data is transferred outside Switzerland or the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, to keep it protected.
11. Device Permissions
Gradeon asks for the following permissions only when a feature needs them:
- Camera: to photograph your cards
- Photo library: to select existing card photos
- Notifications: to tell you when a grade is ready
You can change these permissions at any time in your device settings.
12. Children's Privacy
Gradeon is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal data from children below that age. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app or by email before they take effect. The date at the top of this page shows when the policy was last updated.
14. Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us: