SuperRod Dex
Privacy policy

What the Dex does

SuperRod Dex lets you scan Pokémon cards with your phone or on the web, review what it found, and keep your collection in binders and lists. You can share a list and talk with other collectors about a trade. This policy covers the Dex mobile app and the Dex web app. The Dex is in development; this policy describes how it works today.

Your account

You can use the Dex as a guest or with an email address and password. A guest has no email; the collection belongs to that guest session, and it cannot be reopened after you sign out. An account stores your email address and a hash of your password, never the password itself. You stay signed in on a device until you sign out.

If you ask to reset your password, we send a one-time link to your email through our email provider, Resend.

What we store

• Your collection: the cards you own with their quantity, edition, language, condition, grading, purchase price, where you got them, notes, where you keep them, and a history of changes; your binders, lists, favorites, wishlists, and personal covers.
• Purchases: the planned purchases and their costs you enter.
• Photos: the scan photos you keep as evidence and the photos you take of your own copies. They are private: only you can open them.
• Value snapshots: once a day we record a market price for each card you own, so the Dex can show how your collection changes. We keep 90 days.
• Usage counters: request counts that limit how often image readings and price lookups can run. They are purged within a day.

This data is stored with our backend provider, Convex. We do not use it for advertising and we do not sell it. The Dex contains no analytics or advertising trackers.

Camera and photos

The mobile app asks for camera access to scan your cards and photograph your copies, and for photo access to add pictures to a card. Cards are identified inside the app. The original photo of a scan is uploaded to our storage; if you do not keep it as evidence of a card, it is deleted automatically after 24 hours.

When images leave the app

While you are signed in, the Dex can send small parts of a scan to our backend for an assisted reading, which passes them to an AI provider and returns the answer. The backend does not save them as a photo history.

• Name and number: image strips with the printed card name or number can be processed by Google Gemini, or through OpenRouter when the backend is configured to route Gemini that way.
• Print language: a reduced card image can be processed by OpenAI to identify the language printed on the card.

Those providers receive the submitted image and normal network metadata, and their own policies apply: Google, OpenAI, and OpenRouter. Crop out faces, addresses, and anything unrelated to the card before you scan.

Shared lists and trades

A share link is deliberate, read-only, and revocable. It shows the copies you marked as offers and the cards you still want: card name, set, number, and edition. It does not show your account, prices, notes, private photos, or where you keep a card. Anyone with the link can open it until you revoke it.

A trade conversation is a private exchange between two collectors. Both need an active shared list, and the second person must accept it. We do not store contact details in it and it creates no binding trade, payment, or shipment. Messages are deleted 30 days after a conversation is closed. A report about a conversation is kept for 180 days so abuse can be reviewed with the minimum evidence.

Catalog and prices

Card data and market prices come from third-party sources and are refreshed by our backend. Those requests contain card identifiers, not your account or collection. Prices are references, not completed sales.

Your device and your controls

To work offline, the Dex keeps a copy of your collection on your device. In Account you can back up and restore your collection, export it as a CSV, revoke a share link, and sign out. You can remove cards and photos at any time. Files you export stay wherever you save them.

Retention and deletion

We keep your data while your account exists. To delete it, open Account in the app and choose Delete account, as a guest or with an email. Every login ends at once, and your collection, binders, lists, photos, shared links, and trade conversations are erased shortly after. Reports about a conversation are the exception: they are kept for the period described above so abuse can be reviewed. Backups and exports you saved stay wherever you saved them. Third-party providers keep their own copies under their own policies; deleting your account does not recall requests already sent to them.

If you cannot sign in, or you want a copy or a correction of your data, email cardochoo@gmail.com from the address you signed in with. A guest collection has no email, so we may not be able to find or verify it. Never send your password or session tokens.

Service providers

Convex (database, file storage, and authentication), Resend (password recovery email), and, for assisted readings, Google, OpenAI, and OpenRouter. See their policies: Convex and Resend.

Questions or changes

SuperRod is operated by James Cardona. We will update this page and its date when our practices change. Get help with the Dex or write to cardochoo@gmail.com.