Français · English · Deutsch · Español · Italiano · Nederlands · Português

Privacy Policy

Last updated: 22 October 2026. Paragraphs marked "(if enabled)" apply only when the corresponding feature is switched on.

1. Who we are

Estimeo is an app that estimates the resale price of a second-hand item from a photo and helps you keep track of the items you keep or sell. The data controller is the publisher of Estimeo (contact details in the app, under "Settings"). Contact: contact@estimeo.store.

2. Data we process

• Account (optional): e-mail address or sign-in provider identifier (Apple, Google), creation date. Without an account the app works with an anonymous device identifier.
• Your scan photos: sent to our server to recognise the item; not kept beyond processing, except the ones you save with an item of your collection.
• Scan result: name, category, details read on the item (reference, card number…), estimated price, comparable public listings (title, price, link, thumbnail) as published by the platforms.
• Items of your collection: the ones you choose to keep, with purchase, asking or sale price if you enter them.
• Cards in your binders: game, set, number, name, language, finish, quantity, price at the time you view it and, for a card without an official price, the price found in listings and its date.
• Declared sales (if enabled): when you tap "I sold it", the actual sale price, the date (and the resulting time to sell), the item's category and the price Estimeo had estimated.
• Listing tracking (if enabled): identifiers and prices of public listings comparable to your item, to measure which ones disappear (sales pace). No data about you is attached to them.
• Technical measurements: cost and duration of each scan (no content), server logs kept briefly.
• Notifications (if you accept them): a notification token for your device (an Expo token, delivered through the Apple Push Notification service on iPhone or Google's Firebase Cloud Messaging on Android), with your language and device type, to send you selling reminders; you can turn notifications off at any time in "Settings", and the token is deleted with your account.
• Credits: your balance and the history of its movements (scans, ads watched, purchases, refunds), linked to your account or to your anonymous device identifier.
• Device check (welcome credits): so that free credits are given only once per device, the app obtains a verification token from the system — Apple DeviceCheck on iPhone, Google Play Integrity on Android (with the device's Android ID). Our server has it checked by Apple or Google, who keep two "welcome already given" flags tied to the device for us; on Android we also keep a non-reversible fingerprint of the Android ID (never the ID itself). Nothing else is read, and this information is used neither for advertising nor to track you.
• Advertising and subscription: see § 5.

3. Purposes and legal bases

• Recognising the item and estimating its price (performance of the service you request).
• Keeping your collection and binders (performance of the contract).
• Improving price accuracy from disappearing listings and declared sales (legitimate interest: a more realistic price; this data is aggregated and never used to profile you).
• Security, abuse prevention (anti-bot throttle, welcome credits only once per device), billing (legitimate interest and legal obligations).
• Personalised advertising only with your consent (§ 5).

4. Processors and recipients

We sell no data. The processors below receive only what is necessary:

• Alibaba Cloud (DashScope, Qwen models) — item identification and listing sorting: scan photos (downsized) and public listing texts. European Union / Singapore depending on the endpoint; standard contractual clauses.
• Google LLC (Gemini API, paid tier) — proposing the item's name and reading printed inscriptions from the scan photos; for a trading card, comparing your photo with the official images of its versions; writing the short description and, where applicable, listing texts from textual information about the item. Google does not use this data to improve its products and has no human review; limited retention, for abuse prevention only. United States (standard contractual clauses).
• Google Search (through Gemini) — when no comparable listing is found, the web-based estimate asks Gemini to look up the price on Google ("Grounding with Google Search") from the photos and the item's name; these searches are about the item, never about you, and Google's search suggestions may be shown under the price. United States (standard contractual clauses).
• eBay (Browse API) — searching public listings by keywords and, for a hard-to-identify item, by image of the item. No account data is sent.
• Vinted and Leboncoin — public result and listing pages read from your device, as your browser would; we send them no data about you.
• Public card and price databases — TCGdex, Scryfall, YGOPRODeck, optcgapi.com, LorcanaJSON, swu-db.com, digimoncard.io, Cardmarket's public price guide, Numista, Chrono24, PriceCharting, iDealwine: queried without any data about you. The Yu-Gi-Oh! card images shown in the binders are downsized copies of public images hosted by us; they contain no personal data.
• Supabase — database hosting (European Union). Vercel — server hosting.
• Apple (DeviceCheck) and Google (Play Integrity) — checking that the device and the app are genuine, for welcome credits: the device's verification token; Apple and Google keep the device's "welcome already given" flags for our developer account. United States (standard contractual clauses).
• RevenueCat, Apple, Google — Chineur and Pro subscriptions, credit packs (purchase history, linked to your account's technical identifier). Google AdMob — advertising (§ 5).

5. Advertising and subscription

An ad may be shown in the scan flow (never in the card binders). Without your consent, ads are not personalised; you can withdraw consent at any time in "Settings". The Chineur and Pro subscriptions (Pro: no ad while you wait) are handled by Apple or Google and RevenueCat, linked to your account's technical identifier (never to your email address).

The Google AdMob SDK processes the device's advertising identifier, IP address, usage and diagnostic data (crashes, performance) and an approximate location derived from the IP address, to show and measure ads and prevent fraud. In Europe, your choice is collected by Google's consent platform (UMP); on iPhone, if you decline tracking (App Tracking Transparency), ads are not personalised.

6. Retention

• Scan photos: processing only; photos of saved items: as long as the item is in your collection.
• Account, collection, binders, declared sales: as long as your account exists; deleted with it.
• Per-item result cache: 7 days at most. Listing tracking: 180 days at most (identifiers and prices, not linked to you).
• Cost measurements and technical logs: a few weeks.
• Device fingerprint and welcome flags: kept after the account is deleted, so that the device does not receive the free credits twice (non-reversible fingerprint, not linked to your email address); at Google, the flags are erased after 3 years without use. Credit history: as long as your account exists.

7. Your rights

Access, rectification, erasure, restriction, objection, portability: from the app ("Settings" → "Delete my account", which erases account, collection, binders and declared sales) or by e-mail to the contact address. You may lodge a complaint with your supervisory authority.

8. Security and transfers

Data encrypted in transit; restricted server access; no service key in the app. Transfers outside the European Union (Google, eBay, Alibaba Cloud depending on the endpoint) are covered by the European Commission's standard contractual clauses.

9. In-app notices

• Under the description: "AI-generated description, check it before reusing it in a listing."
• Under an uncertain card version: "version to check".
• Under the price: "Realistic selling price" and "Median listing price"; if a check failed: "Check unavailable: …".