Privacy Policy

Effective: October 26, 2026

This privacy policy explains what personal data we collect when you use the OneDex iOS app (the “App”) and the getonedex.com website (the “Website”), why we collect it, how we use it and the choices you have.

Who Is Responsible

The controller of your personal data is:

Information We Collect in the App

• Account information: your email address and your OneDex account identifier. We use your email address to create your account and send you one-time sign-in codes.
• Profile and preferences: your display name, display currency and account time zone.
• Collection data: your portfolios and the card printings and quantities you save in them.
• Portfolio history: daily records of your portfolio’s estimated value, which we calculate using your account time zone.
• Plan usage: records of your use of features that have plan allowances.
• Subscription information: your purchase and subscription history (such as products, purchase, renewal and expiry dates and subscription status) and your Pro access status.
• Scanner and search requests: card numbers recognized by the scanner and the catalogue searches you make, which are sent to our catalogue service to find matching cards.
• Support messages: what you send us when you contact us.
• Technical information: our infrastructure providers process information such as IP addresses, device and app details, request times and logs when your device connects to them.

Information Kept on Your Device

Some information stays on your device and is not sent to us, such as your signed-in session, the portfolio you last selected, display settings and cached data. Deleting the App removes this App data from your device, but it does not delete your account.

Camera and Card Scanning

The scanner uses your camera only with your permission. Card images are processed on your device; the scanner does not upload them or save them to your photo library. To find a matching card, OneDex sends card details recognized by the scanner, such as a card number, to our catalogue service. You can deny or revoke camera permission in iOS Settings at any time and still search for cards manually.

Subscriptions

We use RevenueCat, Inc. to provide OneDex Pro subscriptions: processing and restoring purchases, verifying access to Pro features, preventing fraud and subscription analytics. RevenueCat processes your OneDex account identifier, which is linked to your account, your purchase and subscription history, and app and device information. This starts when you open the Pro screen while signed in, and continues while your account uses subscription services. Opening the Pro screen does not purchase anything.

Apple processes App Store payments. Your payment card details are handled by Apple; OneDex does not receive them.

Information We Collect on the Website

The Website does not have user accounts. When you visit it, our hosting provider (Vercel) and our storage provider (Supabase) process technical information such as your IP address and browser details to serve and protect the Website. We use DataFast analytics to understand how visitors use the Website, such as pages viewed, referring sites, device type, approximate location and clicks on App Store links. DataFast uses cookies, some of which last up to one year; you can block or delete them in your browser settings. Apple may also report App Store visits and downloads that come from the Website to us in aggregate.

Analytics

In the App, RevenueCat provides subscription analytics as described above. The App does not include a separate product-analytics service. Apple may also give us aggregated statistics about App Store visits, downloads and app usage from people who choose to share this information with developers. Website analytics are described in the previous section.

What We Do Not Collect

OneDex does not collect your precise location, contacts, photo library, microphone recordings, health data, payment card details or advertising identifiers. We do not show advertising, and we do not track you across apps or websites owned by other companies.

How We Use Information and Our Legal Bases

• To provide the Service you request (performance of our contract with you): signing you in, saving and syncing your portfolios, showing collection values and portfolio history, card scanning and catalogue search, applying plan allowances, and providing, restoring and verifying OneDex Pro subscriptions.
• To keep the Service secure and working (our legitimate interest in protecting OneDex and its users): preventing abuse and purchase fraud, troubleshooting and maintaining logs.
• To understand and improve OneDex (our legitimate interest in improving the App and Website): subscription analytics and Website analytics.
• To answer you (performance of our contract, or our legitimate interest in responding): support, privacy and feature requests.
• To meet legal obligations (compliance with a legal obligation): for example, responding to lawful requests and keeping records the law requires.

Where we rely on legitimate interests, you can object, as described under Your Rights.

Service Providers and Sharing

These providers process information on our behalf to run OneDex:

• Supabase, for authentication, database storage and APIs.
• Resend, which delivers one-time sign-in code emails through Supabase.
• RevenueCat, for subscription services and subscription analytics.
• Vercel, for Website hosting.
• DataFast, for Website analytics.

Apple distributes the App and processes App Store purchases and billing under its own terms and privacy policy.

We do not sell your personal information. We share information only when needed to run the Service, work with the providers listed above, comply with law, protect people or the Service, or follow your direction.

International Transfers

Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. When personal data is transferred outside the EEA, we rely on the safeguards required by the GDPR that are set out in each provider’s data processing terms. Contact us at info@getonedex.com for more information about the safeguards that apply.

Security

Your account and collection data are stored in Supabase. OneDex uses Supabase Row Level Security so that signed-in users can access only their own profile and portfolios. Public card catalogue and pricing data can be read without an account because it is not user-specific.

No online service can guarantee perfect security, but we use reasonable safeguards to protect the information we process.

Data Retention

• We keep your account, profile, collection, portfolio history and plan usage data while your account exists, and delete it when you delete your account.
• When you delete your account, deletion of the associated RevenueCat customer data is queued and retried, because OneDex account deletion can complete before RevenueCat’s deletion does. The retry record contains your account identifier and operational retry information and is kept for up to 30 days. This is a limit on how long we keep the retry record, not a guarantee that RevenueCat completes erasure within 30 days, for example during a provider outage.
• We keep minimal records of processed subscription notifications (webhooks) for up to 30 days. Deleting your account removes their link to your account.
• Server and request logs, database backups, email delivery records and support correspondence are kept only as long as needed for their purpose (operating and securing the Service, recovering from failures, delivering sign-in codes or handling your request) under our providers’ standard retention, or longer where the law requires it. The 30-day limits above do not apply to these records.
• Apple may keep transaction records under its own policies and legal obligations. DataFast cookies expire as described above.

Deleting Your Account

You can delete your account in the App under Profile → Delete Account, or contact us at info@getonedex.com for help. Uninstalling the App or logging out does not delete your account. Deleting your account does not cancel an Apple subscription: manage or cancel it in iPhone Settings → your name → Subscriptions → OneDex (see Apple’s instructions).

Your Rights

You can update your display name and display currency in the App and log out at any time. Under the GDPR and other applicable laws, you may have the right to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw any consent you have given. To exercise these rights, email info@getonedex.com. We may need to confirm your identity before acting on a request.

You can also lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) or with the data protection authority where you live or work. Depending on where you live, you may have additional rights under local law.

Children

OneDex is not intended for children under 13, or under the age required by local law to use online services without parental consent. If you believe a child has provided personal information to us, contact us and we will take appropriate action.

Changes

We may update this policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, tell you in the App or by email.

Contact Us

If you have questions about this privacy policy or how OneDex handles your information, contact Gomuno SRL at info@getonedex.com or by post at 61 avenue du Derby, 1050 Ixelles, Belgium. See also our Terms of Use and End User License Agreement.