Vendr is a collection, pricing and trading app for Pokémon and One Piece cards. It is run from Greece ("we"). Questions about your data go to support@vendr.pro.
Without an account
Your collection, binders, lists, decks, deals and watchlist are stored only on your phone. To show prices, the app asks our servers for card and price data. Like any web request, these carry your IP address, which our hosting provider keeps in technical logs for up to 7 days to keep the service secure.
If you set a price alert, we store your phone's push notification token, the card and your target price so we can notify you. Clearing the alert or unwatching the card removes the target.
Your location. When you tap "Near me" to find shops, the phone gives Vendr your location for that search only: it's sent with the search to work out distances. We don't store it, and the app forgets it when you close it. Vendr never asks for your location in the background. If you pick a town instead, the town is kept on your phone so the next search uses it.
Card scanning. When you scan cards, the camera pictures are read on your phone (by Apple's on-device text recognition) and deleted straight away. On newer iPhones the camera reads the text live instead, without taking pictures at all. Only the text that identifies the card, such as its name and number, is sent to find it in the catalog. Pictures are never uploaded or kept. Choosing "From a photo" works the same way and leaves the photo where it was.
The store finder. The map finds card shops and retailers with Apple Maps, from your phone: Apple receives the search words and the area shown on the map, under Apple's privacy policy, and the place cards you open come from Apple. To mark verified Vendr shops and restock sightings, the app asks our servers about the places on your map (by Apple's place identifiers) and for sightings in the area you're looking at (the map's edges, not your location). These requests aren't stored.
Widgets, Live Activities, Siri and iPhone search. So that Vendr's widgets, Lock Screen countdowns, Siri answers and iPhone search can show your collection's value, your watchlist and the next drop, the app keeps a summary of them in storage on your phone that only Vendr and its own widgets and extensions can read. Your cards are added to iPhone search on your phone. None of this is sent to us. When you ask Siri to price a card, the card's name is sent to our servers to look it up, like a search in the app.
Share to Vendr. A link, some text or a photo you share to Vendr from another app is handed to Vendr on your phone. A photo is read on your phone like a scan and then deleted; a link or text becomes a search sent to our servers.
Error reports. When something in the app breaks, it sends us a short report so we can fix it: the error message and where in the app's code it happened, the app version, and your iPhone model and iOS version. If the app had to close, the report is kept on your phone and sent the next time you open it. If you're signed in, the report is linked to your account so we can follow it up; it never includes your cards, messages or anything you typed.
Vendr has no ads, no analytics and no tracking across apps.
With an account
Accounts are optional. When you create one, we process:
| Data | Why |
|---|---|
| Your Apple or Google account identifier and the email it shares (Apple can give a private relay address), or the email address you sign in with by code | To sign you in. We never see your Apple or Google password. |
| Handle, avatar card and, if you add it, your country | Your public profile |
| Collection, binders, lists, decks, deals, watchlist and settings | To back them up and sync them between your devices |
| Trade binder and wants | To show them to other collectors, as you choose |
| Offers, counter-offers, trade messages, shipping status and reviews | To run trades between you and other collectors |
| Notifications in your inbox, and which collectors you've been told match you | To show you what happened in your trades, new followers and new trade matches |
| Your notification settings | To send only the notifications you want |
| Follows and blocks | To show people you follow and keep blocked people away from you |
| Push tokens for your devices | To notify you about offers, messages and price alerts |
| Reports you make or receive, and moderation decisions | To keep the community safe |
| Photos you send in a trade chat | To show the other trader the cards or parcel |
| If you turn on "Trade binder on the map": the town you pick, stored as its centre rounded to about 1 km | To show collectors nearby that your trade binder is there |
| What you follow for drops (shops, retailers, sealed products, sets) and, if you turn on "Drops near me", a town, rounded the same way | To tell you about restocks, releases and drops you asked for |
| If you run a shop: its name, kind, town and country, address (stores only), website and links, opening hours, shipping, logo, the contact email and evidence you send with the application, its listings and drops, and who decided on the application | To check the shop is genuine, show it to collectors, and keep a record of moderation decisions |
| If you claim a store found on the map: the store's Apple Maps identifier, name, address and position, your role there, the email and phone number you give, your note, and the decision | To check that you run the store, contact you about it, and then show it as a verified shop |
| Problems you report with a place on the map (doesn't sell cards, closed, wrong group) | To keep the map accurate |
| Restock sightings you post (the place, what you saw, a short note, when) and your "still there" or "gone" votes; stores you follow for sightings | To show collectors nearby where cards are in stock, and to tell people who follow that store |
Who can see what
- Everyone signed in: your profile (handle, avatar card, country if you add it, member since, and your trading record: completed trades, reviews from people you traded with, and trades you didn't complete), your trade binder and your wants, unless you limit them to followers or hide them.
- Only you: the rest of your collection (unless you open it to followers or everyone), what it's worth, what you paid, your vendor deals, lists, decks and watchlist.
- The two people in a trade: the offers, their versions, the trade chat and the shipping status.
- On the map (only if you turn it on): collectors who can see your trade binder see your handle in a group at your town's centre, never closer.
- Shops are public: everyone sees a shop's name, logo, town, opening hours, website and links, shipping, stock and drops. A store's address is shown so people can visit; a shop run from home shows its town only. The contact email and application evidence are seen only by Vendr's moderators.
- Store claims: only Vendr's moderators see your contact details and note. Once a claim is approved, the store shows as a verified shop like any other.
- Restock sightings: everyone using the map sees a sighting, with the handle of the person who posted it, for 48 hours. Others see how many people said "still there" or "gone", not who.
- Problems reported with a place: only Vendr's moderators.
- Photos in a trade chat: the two people in the trade, and Vendr's moderators if the trade is reported.
- People you block see nothing of yours and can't contact you.
- Vendr's moderators: when a profile, offer, message or trade is reported, the reported content and, for a trade, its offers, shipping status and chat, so we can decide on the report.
Legal bases
- Running your account, sync, profile and trades, shops, the map, drops you follow and searches near you: performance of our contract with you (GDPR Art. 6(1)(b)).
- Security, preventing fraud and abuse, and handling reports: our legitimate interest in a safe service (Art. 6(1)(f)).
- Keeping a record after you delete your account, in the cases described under "How long we keep it": our legitimate interest in settling disputes between traders and preventing fraud and ban evasion (Art. 6(1)(f)), and establishing or defending legal claims (Art. 17(3)(e)).
- Push notifications: your consent, given and withdrawn in iOS Settings.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, sign-in, server functions | Stored in the EU (Frankfurt, Germany) |
| Resend | Sending sign-in codes by email | EU sending region; the company is in the United States |
| Expo (650 Industries) | Delivering app updates; sees your IP address when an update downloads | United States |
| Apple | Push notifications, TestFlight and App Store distribution; turning a town you type into a place on the map (Apple's geocoding, from your phone); the store finder's map search and place cards (Apple Maps, from your phone) | Global |
| Cloudflare | Hosting the website vendr.pro and the links Vendr shares; sees visitors' IP addresses | Global |
When you sign in with Apple or Google, they handle that step under their own privacy policies and tell us only who you are.
Supabase Pte. Ltd. is bound by the EU Standard Contractual Clauses. Resend and Expo are certified under the EU–US Data Privacy Framework and also use the Standard Contractual Clauses.
The services our prices come from (Cardmarket data via TCGGo, TCGdex, eBay and others) receive no personal data from you.
The website. vendr.pro has no cookies, analytics or trackers. Cloudflare, which hosts it, processes visitors' IP addresses to deliver the pages and keep them secure.
How long we keep it
- Account data: until you delete your account.
- When you delete your account: your profile, collection, lists, decks, deals, watchlist, follows, blocks, push tokens, the reviews you wrote and the trade messages you wrote are deleted, and your open offers close. Your trades stay visible to the other person, with your name replaced by "a deleted account", because they are part of that person's history too.
- If a trade was unfinished or disputed when you deleted: when a trade was still in progress, a trade failed on your side in the last 12 months, or a report about you was open, we keep your handle, your email, those trades and your messages in them for 12 months, then delete them. For that time the other trader still sees your handle on those trades. This lets us settle disputes and deal with fraud.
- If your account was suspended when you deleted: we keep a scrambled (hashed) copy of your email address and sign-in identifiers, so the suspension also applies if you sign up again. Nothing readable is kept.
- Reports and moderation decisions: up to 12 months, then deleted. A suspension lasts until it is lifted.
- Photos in a trade chat: as long as the message they were sent with. A photo whose message is deleted (for example because its sender deleted their account) is deleted within a day or two.
- Shops: while the shop is open. A closed shop, or an application that wasn't approved, is deleted 12 months after its last change, with its listings and drops; until then only Vendr's moderators can see it.
- Store claims: like shop applications. A claim that wasn't approved is deleted 12 months after its last change.
- Problems reported with a place: until a moderator has dealt with them.
- Restock sightings and votes: shown for 48 hours, deleted after 30 days.
- Map town, drop follows, stores you follow and "Drops near me": until you turn them off, unfollow, or delete your account.
- Inbox notifications: 90 days.
- Technical logs: up to 7 days.
- Error reports: 30 days.
Your rights
You can:
- See and take your data. Account → Export collection gives you a copy at any time. For everything else, email us.
- Correct it. Most of it you can edit in the app.
- Delete it. Account → Delete account removes it immediately.
- Object, restrict or ask anything else. Email support@vendr.pro. We answer within one month.
- Complain. You can complain to the data protection authority where you live, or to ours: the Hellenic Data Protection Authority (dpa.gr).
Age
Accounts are for people aged 16 and over. Mail trades with other collectors are for people aged 18 and over.
Changes
If this policy changes in a way that matters, the app will tell you before the change applies.