Privacy Policy

Last updated: 2 November 2026

Scrolyx is a trading card price and collection app. It is currently in testing. It is run by Forbes, an individual based in Scotland, United Kingdom, who is responsible for your data (the "controller"). You can contact me at forbes.g.bryce@gmail.com.

The short version

• You can use Scrolyx without an account. Your collection then stays on your phone.
• If you create an account, your collection, watchlists and sets are saved to it, so they are safe if you change phones or reinstall.
• Usage statistics and crash reports are anonymous and are not linked to your account or email.
• The app shows sponsored posts from card-related companies. At most they are matched to your country or region; they are not targeted using your personal data.
• I do not sell your data.
• You can delete your account, and everything saved with it, in the app at any time.

What I collect, and why

Account details. If you create an account, I receive your email address and a user ID from the sign-in method you choose (Apple, Google, or email and password). If you use Sign in with Apple and hide your email, I only receive Apple's private relay address. I use these to sign you in. Why I am allowed to: to provide the account you asked for.

Your collection, if you have an account. When you are signed in, the cards you add (with any grade, condition, quantity, purchase price, purchase date, cert number and notes you enter), your watchlists, the sets you track and your collection's daily value history are saved to your account, so they are kept safe and appear on any phone you sign in on. Why: to provide the feature you asked for. If you use the app without an account, this stays on your phone and I never receive it.

Card scans. When you scan a card, the photo is sent through my server to Scrydex, a card data provider, which identifies the card. I do not keep the photo. I keep a short record that a scan happened (your user ID, the time, and whether a card was found) so I can apply the daily scan limit. Scanning needs an account. Why: to provide scanning, and to keep it fair and affordable.

Anonymous usage statistics. The app records which features are used (for example, a scan, a search, or opening an eBay link) and how long the app is open, using PostHog. These are tied to a random identifier created for each install, never to your account, name or email, and are stored in the EU. Why: to learn which features help people and fix what does not (legitimate interests).

Popularity counts for Trending. To show which cards collectors are interested in, the app counts views, likes and similar actions per card. These counts are anonymous: the app sends a code that is scrambled with a secret and changes every day, so it cannot be used to identify you or follow you over time. Why: to provide the Trending feature (legitimate interests).

Crash reports. If the app crashes, a report of what went wrong (the error, the app version and the type of device) is sent to Sentry, stored in the EU. Personal data collection is switched off. Why: to fix bugs (legitimate interests).

Price lookups and server logs. When you view a card, the app asks my server for its price. The request includes the card's identifier, not your name or collection. My hosting provider, Supabase, keeps standard server logs, such as IP address and request time, for security and to keep the service running.

Sponsored posts

Scrolyx shows sponsored posts from card-related businesses, such as conventions, marketplaces and grading companies, mainly in the Discover feed. They are always labelled as sponsored. Sponsored posts may be matched to your general region, such as your country, using the region set in the app, so that you see events and shops near you. I never use your precise location for this, and I do not use your personal data, collection or activity to choose which ones you see. I do not share your data with advertisers. If you tap one, you leave the app and that business's own privacy policy applies. Advertisers may receive anonymous totals, such as how many times a post was seen or tapped, never anything that identifies you. If this ever changes, I will update this policy first.

Information from Google, Apple and email sign-in

If you choose Sign in with Google, Google shares your name, email address and profile picture with the app through Supabase's sign-in service. I use your email address and user ID to create your account and recognise you when you come back. Your name and picture, if provided, are stored in your account record with that sign-in service and are not used for anything else. I do not ask for access to your Google contacts, calendar, Drive, Gmail or any other Google data.

Scrolyx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: I only use Google user data to provide and improve the sign-in feature you asked for, I do not sell it, I do not use it for advertising, and I do not allow humans to read it except where you ask me to for support, where it is needed for security, or to follow the law.

If you use Sign in with Apple, Apple shares your name and email (or a private relay address if you hide your email). If you sign up by email, I store the email address and a securely hashed password. I never see your password.

Who I share data with

I do not sell or rent your data. These services process data on my behalf, only to run the app:

• Supabase: sign-in, database (including saved collections) and the price service.
• Scrydex: identifies scanned cards and supplies card data and prices.
• PostHog: anonymous usage statistics (EU).
• Sentry: crash reports (EU).
• Apple and Google: sign-in, if you choose them. Their own privacy policies apply to that step.

eBay. Some screens link to eBay searches. When you open one, you leave the app and eBay's policies apply. Links may include an affiliate code, which means I may earn a small commission if you buy something, at no extra cost to you. Prices shown in the app come from third-party market data and are estimates, not offers to buy or sell.

Some of these providers may process data outside the UK. Where they do, they use the safeguards UK data protection law requires, such as standard contractual clauses. I may also disclose information if the law requires it.

How your data is protected

Data sent between the app and my servers is encrypted in transit (HTTPS). Saved collections are protected so that only you can read or change your own data; the database enforces this, not just the app. Access to the systems is limited to me. No system is perfectly secure, so I cannot guarantee absolute security.

Keeping and deleting your data

I keep your account and the collection saved to it until you delete your account. You can do that in the app under Profile, Delete account. This permanently removes your sign-in record, your saved collection, watchlists, sets and value history, and your scan records. Signing out clears your collection from that phone; it stays safe in your account. If you use the app without an account, delete the app to remove your data from your phone. Anonymous usage statistics and crash reports cannot be linked back to you, and are kept by PostHog and Sentry for their standard retention periods.

Your rights

If you are in the UK or EU you can ask what I hold about you, ask me to correct or delete it, ask for a copy, or object to how I use it. Email me at the address above. You can also complain to the Information Commissioner's Office (ico.org.uk).

Children

Scrolyx is not aimed at children under 13, and I do not knowingly collect their data. If you believe a child under 13 has created an account, contact me and I will delete it.

Changes

If this policy changes, I will update the date at the top and tell testers in the app or by email.