This Privacy Policy explains how Slabby (“we”, “us”) collects, uses, and protects your information when you use the Slabby mobile application (the “App”), published by Yacine Kahlis. By using the App you agree to the practices described here.
The short version: Slabby has no account, no login, and never asks for your name or email. Your binder, your card photos and your settings are stored on your iPhone. When you scan a card, the photo is sent over an encrypted connection to our server and our AI provider to be read; our server never stores it. Our server looks prices up with the card's name, number or catalogue id, never with anything about you. No ads, we never sell your data, and we do not track you across other apps.
Your anonymous identifier
The App has no accounts. The first time you open it, it creates a random, anonymous identifier on your iPhone. It is not tied to your name, email or Apple Account. The App sends it with its requests to our server, which uses it to check your plan, count your trial and onboarding scans, and apply fair-use limits. The same identifier is used by RevenueCat, which manages subscriptions for us, and by our analytics provider, both described below.
Deleting the App deletes the identifier; if you reinstall, the App creates a new one. “Delete all my data” in the App's Settings also replaces it with a new one.
Information stored on your iPhone only
Your binder: the cards you saved, the print you chose for each, and their latest prices.
Card photos: for a card that has no picture in the catalogue (for example a card of a game in beta), the App keeps the photo you scanned as the card's picture. Other scan photos sit in the App's temporary files and are not kept with your binder.
Settings: your currency, your display and haptics preferences, and your trial reminder.
Onboarding answers: why you collect and which games you have, used to set up the App (they are also sent to analytics, see below).
App state: your plan as the App last saw it, your camera mode, and simple counters (when you first opened the App, how many cards you saved, how many times you saw the plans), used to choose when to ask for an App Store review; the plans count is also shared with RevenueCat (see Purchases).
Public data: the latest public exchange rates, so prices can be converted offline, and the list of games Slabby can read. Neither says anything about you.
This data lives in the App's local storage on your iPhone. It may be included in the device backups you configure with Apple (iCloud or local backups). Those backups are managed by Apple under your Apple Account; we have no access to them.
Card photos sent for reading
The camera looks for the card on your iPhone; only the photo it takes (or a photo you pick from your library) is sent. When you scan a card, the App sends that photo over an encrypted connection to our server. Our server holds it in memory only and passes it to our AI provider, which reads the card's game, name, number, set, language and print; our server then looks the card up and returns the result to the App. If that first reading does not find the card, our AI provider may run a web search limited to card databases to confirm the card's name and number. Our server never stores your photos.
Our AI provider runs the reading on models made by other AI companies, so the photo may also be processed by the company whose model reads it. These providers handle the photo under their own terms for business customers; how long they keep a request is set by those terms, not by us.
Card lookups and prices
Card data and price providers: our server looks cards and their market prices up with card data providers, using only the card's name, number, set or catalogue id. Nothing that identifies you is sent to them.
Searching by name: the name and number you type are sent to our server, which looks them up the same way. The catalogue's answers are cached by search, never with your identifier.
Card pictures: the App loads catalogue pictures of Pokémon cards directly from a card data provider's image servers, which, like any website, see your iPhone's IP address when they send a picture.
Price refreshes: to keep your binder's prices current, the App sends our server the catalogue ids of the cards in your binder. The server answers with their prices and does not keep a list of your cards.
Exchange rates: our server reads the European Central Bank's reference rates from a free public exchange-rate service. No information about you is sent to it.
Information kept on our server
Scan records: for each scan our server reads, we record your anonymous identifier, the time, whether you are on the yearly plan, the AI model used, how long it took, what it cost us and the outcome (found, not found, unusable photo, cancelled…). Never the photo, and not the card. These records enforce fair-use limits and control costs; they are kept for 45 days, then deleted automatically.
Your onboarding scan: a record, linked to your anonymous identifier, that your iPhone used its one free onboarding scan. It is kept until you delete your data (see below).
Trial scan counter: the number of scans used during a free trial. It is linked to the App Store purchase of the trial (the product, the original purchase date and, when the store gives it, the transaction number), not to your identifier, so the trial's scans stay with the purchase: reinstalling the App, restoring it on another iPhone or deleting your data does not reset them. It is deleted 30 days after the trial ends. In the rare case the store gives no purchase date, the counter is linked to your identifier instead, and Delete all my data erases it.
A reading kept for “Try again”: when the card catalogue cannot be reached after your photo was read, our server keeps the reading (the card's name, number, set, language and the AI model used) with a fingerprint of the photo, never the photo itself, in its memory for 10 minutes, so that trying again with the same photo does not need a new reading.
Short-lived memory: your plan as RevenueCat last reported it (24 hours at most) and your request counts for the current minute and day (until midnight UTC at the latest).
Technical logs: our server's logs record events such as a scan's outcome and the card it found. They do not contain your identifier itself, only a pseudonym computed from it. They are kept by our hosting provider for a limited time under its own retention rules.
Price and catalogue caches: card prices, card lists, graded prices and exchange rates, stored by card, language or date. They contain nothing about you.
Our server sees the IP address your requests come from, as any server does. It uses it only to limit the number of requests one address can make and does not store it. Our hosting provider's network may record it in its own logs for a limited time.
Purchases
Subscriptions are bought and paid through Apple; we never see your name, email or payment details. RevenueCat manages subscriptions for us: it receives your anonymous identifier, your purchase and subscription status from the App Store, and how many times the App showed you its plans. Our server asks RevenueCat whether your identifier has an active plan, and RevenueCat notifies our server when a subscription changes.
Analytics
We use an analytics provider, whose servers are in the United States, to understand how the App is used. It receives product-usage events tied to your anonymous identifier: the screens you view and the actions you take (for example a scan started, its result and how long it took, a card saved with its catalogue id and price, a filter used, the plans viewed, a purchase or a restore), your onboarding answers, your plan, and the technical details its library adds (device model, iOS version, App version and language). It may use the IP address of a request to estimate an approximate location. It never receives your photos, your name, the words you type in a search or the feedback you write. There are no session recordings.
The same analytics project is shared by the apps of the same developer; each event says which app it comes from.
Permissions
Camera: used only to find and photograph your cards.
Photo library: used only when you choose to pick a photo of a card instead of taking one; only the photo you pick is read.
Notifications: one local reminder, the day before your free trial ends, if you turn it on. It is scheduled on your iPhone and not sent through a server.
Motion: the App reads your iPhone's motion sensors to tilt the card on screen. This stays on your iPhone.
Third-party services
Apple: processes App Store payments. Apple may also collect standard diagnostics (such as crash reports) according to your device settings and Apple's privacy policy.
An AI provider: reads your card photos, as described above, with models made by other AI companies.
Card data and price providers: give our server card details and market prices, queried without any information about you; one of them also serves the Pokémon card pictures to the App.
A public exchange-rate service: gives our server the European Central Bank's reference rates.
An analytics provider: receives the usage events described above.
An app update service: delivers App updates. When the App checks for an update, its servers receive standard technical information about the request, such as the App version.
A cloud hosting provider: runs our server and its database, and keeps our server's logs.
We do not show ads, we do not sell your personal information or share it for cross-context behavioral advertising, and we do not track you across other companies' apps or websites.
Where your data is processed
Our service providers, including our AI provider, RevenueCat and our analytics provider, process data in the United States and possibly in other countries. Your information may therefore be processed outside Quebec and outside Canada, under the laws of those places.
Deleting your data
In the App, open Settings → Your data → Delete all my data. It needs an internet connection: our server is asked first, and if it cannot be reached, nothing is deleted.
On our server, it deletes the record of your onboarding scan, and a trial scan counter linked to your identifier if there is one, and anonymises your scan records: your identifier is replaced by a random code, so they can no longer be linked to you. They still count toward our overall daily limits and are deleted after 45 days like all scan records. The server also forgets what it holds in memory for your identifier: the copy of your plan, the day's request counts and any reading kept for “Try again”. The per-minute request counts expire on their own within a minute.
On your iPhone, it erases your binder, your card photos, your settings, your onboarding answers, the App's state and counters, its temporary files and cached pictures, and turns off your trial reminder. The App then gets a new anonymous identifier and starts over as on its first launch. The public exchange rates and the list of games are kept.
What it does not erase: your subscription, which stays with Apple (cancel it in your Apple Account, see below); your purchase history at Apple and RevenueCat; the trial scan counter linked to your App Store purchase, deleted 30 days after the trial ends; analytics events already sent to our analytics provider, which stay under your old identifier (the App does not link them to the new one); and technical logs, which expire under our hosting provider's retention rules. To get Pro back afterwards, tap Restore.
Deleting the App removes all the data stored on your iPhone, including your anonymous identifier, but not the records on our server: use Delete all my data first if you want those erased too. Cancelling a subscription is done in your Apple Account (Settings → your name → Subscriptions); neither deleting the App nor deleting your data cancels it.
You can also ask us by email to delete the records tied to your anonymous identifier on our server, at RevenueCat or at our analytics provider. Because the App has no accounts, we will reply with what we need to find your data.
Your rights
Depending on where you live (including under Quebec's Act respecting the protection of personal information in the private sector, PIPEDA, the GDPR, the UK GDPR and the CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to withdraw your consent. Most of your data is on your iPhone, so you can exercise most of these rights directly in the App. For data held on our server or by our providers, or for anything else, contact us below. If you live in Quebec, you may also contact the Commission d'accès à l'information du Québec.
The person in charge of protecting personal information for Slabby is Yacine Kahlis, reachable at hello.yk.apps@gmail.com.
Children
The App is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes
If this policy changes, the updated version will be posted at this address with a new effective date.
Contact us
Questions about this policy? Email us at hello.yk.apps@gmail.com. If you email us, we receive your email address and what you write, and use them only to reply.