Privacy

Your email address and display name, the cards you record, what you paid for them, your transactions, tags, storage locations, wishlists, price alerts and saved searches. That is the product — it is your collection, and it is stored so you can come back to it.

Your password is never stored. Only a one-way hash of it is kept, which cannot be turned back into the password.

When you scan a card, the image is sent to our own matching service, compared against the catalogue, and discarded. What is written down is a fingerprint of the image — a fixed-length hash — so a repeat scan is recognisable in your history. The photograph itself is never written to disk and never leaves our servers.

Nobody. Your collection is not shared, sold, or used to train anything. Trades you choose to share are visible to whoever holds the link you send them, and only to them.

We do not use advertising or third-party analytics trackers.

Prices, card names, set data and images come from third parties, not from us — chiefly TCGCSV, Scryfall, MTGJSON, YGOPRODeck, pokemontcg.io, the Grand Archive index and eBay. Those are read-only: nothing about you is sent to them. Each one is named, with what we take from it, on the credits page.

We send email for one reason: to confirm your address and to let you reset your password. There is no marketing list.

Every account can export everything it owns as JSON or CSV at any time, from the collection page — no request needed, no waiting. The export is the same format the app restores from, so it is genuinely portable rather than a token gesture.

Ask us to delete your account and it goes, along with everything attached to it. Backups containing it age out on their retention schedule.

Twelve Pocket is run by a single person. Questions about any of this, or a deletion request, go to the address on the terms page.

Every data source is named on the credits page.