Privacy Policy

In short

Sleeve reads the set code printed on a trading card using your camera, and opens the matching search page on Cardmarket in your browser. The reading happens on your device. There is no account, nothing to sign in to, and nothing that says who you are.

Sleeve collects no analytics without your permission. If you give it, Sleeve sends a note each time it opens a card on Cardmarket, saying which card and when. Whichever answer you give, it contacts its own server for updated card rules and app settings, and those are the only two things it does on its own. It also has a feedback button, which sends what you write and nothing else, and only when you tap Send. Everything else in this policy is detail.

Your camera and your photos

The camera is used for one thing: reading the code printed on the card in front of it. Recognition runs entirely on your device, using a text recognition library that works offline — no image, frame or crop is ever uploaded, to us or to anyone else.

While scanning, Sleeve may write a small cropped image to your device's temporary cache so the recognition step can read it. Those files are overwritten as you scan and cleared when Sleeve starts. Sleeve does not use your photo library and does not ask for access to it.

Card rules updates

Sleeve does check its own server for updated card rules and app settings whichever you choose. That is how a game whose rules have broken gets fixed or switched off, and how the app knows when a version has stopped working, so it is not optional. It sends nothing about you, though like any web request the server sees your IP address.

The request carries no identifier, no analytics and nothing about what you have scanned. Like any web request it reveals your IP address and the time you made it to whoever serves the file. It runs at most a few times a day, and only when you open the app.

The legal basis is that this is necessary to provide the service you asked for: without it a game whose rules have changed would keep sending you to wrong pages until an app update reached you.

Usage data, only if you say yes

Sleeve asks on first launch whether it may collect usage data, and asks again whenever what it collects changes.

Which card codes you look up, and when: for each Cardmarket page Sleeve opens, which game you picked, the code and the search address, whether it was scanned or typed, how long it took, and what the camera first read if a character had to be corrected. And when you reject a match and scan again.

In full: each time Sleeve opens a card on Cardmarket it notes the game, the card code, the Cardmarket search address it built — which includes the page language you chose — whether the code was scanned or typed and in which capture mode, whether the game was detected automatically, what the camera first read if a character was corrected, how long it was from the camera being ready to the page opening, and, for a typed code, whether it was one Sleeve could not check. When you reject a match it notes the game and the capture mode. Every note also carries the time, the version of Sleeve, the kind of device it is running on, and whether it is a test build.

Usage data never includes card photos, anything from the Cardmarket page you open, your name or email, or any device or advertising id. It carries a random number made up for this installation instead, and turning usage data off deletes that number. There is no account and no sign-in, anywhere in Sleeve.

That number is made up the first time a note is written, not before, and a second one changes after half an hour without scanning, so that one sitting can be told from the next. Sleeve never links either to a name, an email, a device id or an advertising id, and neither is used to track you across other apps or websites. Turning usage data off deletes the installation number and any notes not yet sent; turn it on again later and you get a new number, unconnected to the old one. If you decline, nothing is started at all — this is not a switch that collects and then discards.

What that number does mean, said plainly: the notes from one installation can be read together, so they show which cards were looked up on it over time. That is what makes them useful — it is how we can tell a few cards from a whole binder — and it is why this is a question rather than a default.

Notes wait on your device until there is a connection, then go to a server of our own, hosted by Cloudflare, which passes them to PostHog, an analytics service, to be stored in its European Union region. Your IP address reaches our server, as it does with any web request; the server uses it to limit abuse and to tell which country the notes came from, and passes on the country but never the address. PostHog does not receive it.

The legal basis is your consent. You can withdraw it at any time under Privacy in settings, which stops collection from that moment. Notes are kept for as long as they help improve Sleeve, and no longer than twelve months.

When you send feedback

Sleeve has a feedback button. Nothing leaves your device until you write a message and tap Send: there is no background reporting, and no part of this happens on its own.

A message carries what you typed, which of the optional boxes you ticked, the version of Sleeve you are running, the kind of device it is running on, and whether it is a test build. The composer prints those last three on screen before you send, so what travels is never more than what you can see.

It carries your email address only if you chose to type one. That is optional, it is there so we can reply, and it is the only part of a message that could identify you — leave it empty and the message is anonymous.

It carries nothing about your scanning. No photo, no crop, no card code, nothing the camera read, not even which game you had selected. Sleeve attaches no identifier of any kind either: no device id, no installation id, nothing that would let two messages be recognised as coming from the same person.

The message is sent to a server of our own and reaches us as an email. A random reference for each message is kept on that server for a day, so that one sent twice by a phone with a poor connection is not delivered twice; it holds nothing else and says nothing about you. If your phone has no connection at all, the message waits on your device and sends itself when there is one — and Reset everything discards it if you do that first.

The legal basis is your consent, given by the act of sending. Messages are kept while they are still useful — a bug report until the bug is fixed, an idea until it is decided — and no longer than twelve months. If you gave an email address you can ask for your message to be deleted, using the contact address below; without one there is nothing to look you up by, which is the same honest limit as everywhere else in this policy.

What stays on your device

Your game, capture mode, scan frame, control layout, page language, lens and zoom, your answer to the privacy question, a cached copy of the card rules and app settings, a small random number used to stage config updates gradually, and a tally of how many cards you have opened, on how many days, and which of its occasional prompts Sleeve has already shown you — so that it shows them rarely, and never before you have used it. All of it is stored by Sleeve on your device only. The settings are never uploaded as settings — though if you allow usage data, the game, capture mode and page language in use when a page opens are part of that page's note, as described above. The config-staging number is never sent anywhere at all: it is compared locally and nothing else, and it is not the number usage data carries.

If you allow usage data, that number is kept here too, until you turn usage data off. And two things can wait here briefly before leaving on purpose: usage notes, until there is a connection to send them, and a feedback message you have written and sent while the phone had no connection. Each is deleted from the device once it has been sent.

Reset everything in settings clears all of it. Deleting the app removes it with the app.

When you open a card on Cardmarket

Sleeve never fetches, stores or shows anything from Cardmarket. It opens a search page in your own browser, and the page loads in your own session.

That means the page is loaded by your browser, not by Sleeve, using whatever session and cookies your browser already has. Cardmarket receives the search term — the card code Sleeve read — because it is in the address, along with the ordinary information any website receives from a browser. What happens after that is between you, your browser and Cardmarket, under their privacy policy rather than this one.

Sleeve is not affiliated with, endorsed by, or connected to Cardmarket.

Your rights, and the honest limit on them

Under the GDPR you can ask to access, correct, delete or export your personal data, to object to processing, and to complain to your data protection authority.

The honest part: Sleeve holds no account and collects nothing that says who you are. Usage data is tied only to a random number that Sleeve never shows you and that we have no way to connect to you, and a feedback message sent without an email address carries nothing to find it by. So if you ask us to find your data, we will normally not be able to identify it, and the law does not require us to collect more information in order to be able to. A feedback message you sent with your email address can be found, and deleted if you ask. What you can always do without asking anyone is withdraw consent in settings, which deletes the number and anything not yet sent, and clear everything Sleeve has stored by resetting it or deleting the app.

Children

Sleeve is not directed at children and collects nothing that would identify a child, or anyone else. It does not ask for a user's age, because it has no reason to know it.

Changes to this policy

If what Sleeve collects changes in a way that matters, the version below changes with it and you will be asked the privacy question again rather than being carried over on an answer you gave to a different description. Corrections that do not change what is collected will simply update the date.

Who to contact

Bluecoon, Rok Firšt s.p. is responsible for the handling described above. Questions, or a request about your data, go to info@sleeve-app.com.