Effective date: 27 October 2026
About this notice
This notice applies to the Aureon Cards Android app, operated by Aureon Medical GmbH, Feldmark 12B, 46419 Isselburg, Germany. Contact: info@aureoncards.com. The app is intended for users aged 13 and over.
Your collection, camera and files
Your collection, imported CSV files, card quantities and saved price observations are processed and stored on your device. Camera recognition and text recognition take place on the device. We do not upload scan photographs or recognised card text to a recognition server. No separate Aureon user account or collection cloud backup is provided. You choose where exports and backups are saved and whether to share them. Uninstalling the app or clearing its data may delete the local collection; restoring a purchase does not restore it.
Technical information from Google ML Kit
The app uses Google's bundled on-device text recognition SDK. Google states that input images and recognised outputs are not sent to its servers. The SDK does send device and app information, per-installation identifiers, feature events, processing timings, configuration information and error codes for diagnostics and usage analytics. These transmissions use HTTPS. Details: Google ML Kit data disclosure and ML Kit terms and privacy information.
Google Play purchases and licence verification
Google Play handles payments and payment credentials. The app does not receive your bank or card details. Our verification service sends the Play purchase token to Google's Android Publisher API to confirm purchased access, expiry and receipt acknowledgement. A pseudonymous SHA-256 purchase reference, package, expiry and import-operation identifiers and quantities are stored to enforce access and prevent duplicate import charges. Your collection, card names and CSV contents are not sent to this service. Access codes provided for app review are checked by the same service and do not require a purchase.
The verification service runs on Cloudflare Workers; its D1 licence database is configured for the EU jurisdiction. Requests pass through Cloudflare's network, which receives technical connection information such as an IP address. The app database does not store IP addresses or payment credentials. Provider security and operational logs may be processed according to Cloudflare's service arrangements, including processing outside the EEA where applicable. Google processes purchase and SDK information under its applicable terms and privacy policies.
Card images, prices and exchange rates
Network requests are made to TCGdex, Cardmarket, Pokémon TCG image hosting, Scrydex image hosting, Frankfurter and Aureon Cards or their delivery providers when the corresponding resources are loaded. They receive the requesting IP address and requested resource, such as a card image or reference ID. Individual resource requests are not an upload of your whole collection. Cardmarket is a price reference in both FREE and PRO; reference values are not guaranteed selling prices.
Why information is processed
Local collection processing and purchased access provide the service you request. Purchase verification, security and import accounting support service delivery, fraud prevention and reliable operation. Technical diagnostics and usage analytics are used for maintenance and improvement. Depending on the processing and applicable law, the legal basis is performance of the requested service, legitimate interests in security and reliable operation, a legal obligation, or consent where required. There is no advertising SDK intentionally included in the app and we do not sell collection data.
Retention and deletion
Local collection data remains on your device until you remove it or clear the app data. Technical licence and associated import records become eligible for deletion 60 days after access expires; the service checks for expired records when handling requests. This does not delete Google's payment records or records we are legally required to retain separately. Google and other providers apply their own retention policies to their records.
To request access, correction or deletion of server-side licence information, contact info@aureoncards.com. We may ask for information sufficient to identify and verify the relevant purchase; do not send passwords or full card or bank credentials. We will explain if information must be retained for a legal obligation. Where applicable, you may request restriction or portability, object to processing, withdraw consent, and complain to a competent data protection authority.
Age, external links and changes
The app is intended for ages 13 and over and is not directed at children under 13. Contact us if you believe a child has supplied information to us. Shop and other external links are subject to those services' privacy notices. We update this page when relevant processing changes and identify the effective date above.