Ekalight Privacy Policy

Effective date: August 12, 2026 · Last updated: August 12, 2026

This policy supersedes the earlier Ekalight privacy policy (June 2026), which predates the social features described below.

1. Who we are

Ekalight — operated by Stephen Chan, an individual sole proprietor doing business as Ekalight ("Ekalight", "we", "us") — runs the Ekalight mobile app (bundle identifier com.ekalight.app) and its backend services (the "Service"). We are the data controller for the personal data described here.

Contact: team@ekalight.com
Postal address: available on written request to the email above.

The Service is operated from the United States and is directed at users in the United States. We have not appointed an EU or UK representative or a Data Protection Officer.

2. What Ekalight does, in one paragraph

Ekalight scans trading cards with your phone camera, identifies them, shows prices and price history, and lets you track a collection and its value. It also has a social layer: public profiles, posts with images, comments, likes, follows, and direct messages. It includes a novelty feature, "Who's That Pokémon", that takes a photo of you and finds the Pokémon you most resemble.

3. Information we collect

3.1 Account information

We also keep a copy of your email address on our own backend, separately from the authentication system, so we can operate the invite/access gate. If you join a waiting list before you have an account, we store the email address you gave us.

Guest sessions. You can start using the scanner without registering. We create an anonymous account identifier for you at that point. A guest session has no email address, no profile, and cannot post, comment, or message.

3.2 Profile information (public)

If you complete a profile, we store and publicly display: display name, handle, bio, location (free text you type — not device location), a link you provide, avatar image, and cover image. See Section 6 for exactly how public each of these is.

We do not display your email address to other users, and there is no email field on the profile record at all.

3.3 Social content

• Posts — the text you write, an optional linked card, and timestamps.
• Post images — the image files you attach.
• Comments — text, and which post or comment you replied to.
• Likes — which posts and comments you liked.
• Follows — who you follow and who follows you.
• Blocks and mutes — who you have blocked or muted (private to you).
• Direct messages — the message text, who sent it, which conversation it belongs to, and read timestamps. DMs are stored in plain text on our servers and are not end-to-end encrypted. A short preview of the most recent message (up to 200 characters) is also stored on the conversation record so that the inbox list can render.
• Reports — when you report someone, we store your identifier, what you reported, and the free-text reason you gave.
• In-app notifications — who did what to which of your items, and whether you have read it. These records contain no message text and no post text, only references.

3.4 Card scans

When you scan a card:

• The captured photograph and a normalised crop of it are uploaded to our servers and stored in a private Google Cloud Storage bucket. They are not public.
• We record a scan event: a scan identifier, your account identifier, timestamps, which card the model predicted, which one you selected, which one you confirmed, model version, confidence, and the full request and response payloads for that scan.
• We record technical capture details such as image dimensions, the camera zoom factor, and the capture source.

We use your scan images to train and improve our card-recognition models. This is a primary purpose of retaining them, not an incidental one.

A small number of authorised human reviewers can view scan photographs, including scans taken by other users, in order to label them correctly for model training. Reviewers are an explicitly configured allowlist of our own people; the review tool is authenticated and is not open to ordinary users. Reviewers see the card photograph and the candidate matches, not your name or email.

The captured image itself is stripped out of the scan record we store, but the rest of the scan request is kept, including text our optical character recognition read off the card and any set or collector-number hints.

Scan images are stored under a date-and-scan-id path that does not contain your account identifier; the link between you and a scan lives in our database.

Multi-angle labelling captures. If you use the deliberate card-labelling flow, the photographs from each angle are stored the same way and are explicitly collected for training.

3.5 Your collection and financial records

Everything you record about your collection is stored on our backend and is private to your account: cards and quantities, condition, grade, grader, certification number, which named collection a card is in, wishlist and likes, cost basis and purchase prices, sales you log (sale price, payment method, profit, notes), a standalone transaction ledger (amount, note, and an optional photo you attach, stored privately), listing URLs and prices you mark, and any spreadsheet you import (we retain the imported rows, including the raw values).

We also record, per card page you open, that you viewed it (once per day) — this drives the "people watching" count. It is not shown to other users as a list of who viewed what.

3.6 "Who's That Pokémon" — your photo

This is the feature where the code and a generic privacy template diverge most, so we are explicit:

• The photo is transmitted from your phone to our servers.
• It is then transmitted to Anthropic, which runs a Claude vision model to determine which Pokémon you most resemble.
• On our servers it is also processed by a person-segmentation model that runs locally on our own machine to cut you out from the background for the reveal animation.
• The photo is never written to disk, never written to a database, never logged, and never retained by us. It exists only in memory for the duration of the request. Our logs record only the image dimensions and how long the request took. The only thing written to disk is a cache of the public official Pokémon artwork.
• The cut-out image and the placement geometry are returned to your phone and are not stored by us either.
• Under Anthropic's commercial API terms, inputs are not used to train Anthropic's models and are retained by Anthropic only for a limited period for trust-and-safety purposes.

So: we do not store your photo, but we do send it to a third party to process it. If you are not comfortable with that, do not use this feature.

3.7 Analytics and crash reporting

We use PostHog (US region) for product analytics. This is what is and is not sent:

Sent as person properties: your display name, whether you have set a display name, whether admin tooling is enabled, whether labelling tooling is enabled, and how many authentication providers are linked to your account.

Your email address is never sent to PostHog. This is a deliberate design decision enforced in code.

Identifier: events are attached to your account UUID.

Also collected automatically: app version and build, platform, device manufacturer, device model, device type, whether it is an emulator, OS name and version, locale, and timezone; app-lifecycle events (opened, installed, updated, backgrounded); coarse screen names (for example scan, portfolio, card_detail); and product events such as sign-in success or failure, scan started/succeeded/failed, artifact upload outcomes, adding a card to inventory, and opening a pricing link.

Session replay is enabled. We record the flow of your session — screens, navigation, and interactions — to understand where people get stuck. All images are masked and all text inputs are masked, so card photos, thumbnails, and anything you type into a field (including email and password) are blocked out in the recording. Network payloads are not captured.

Crash reporting is handled by PostHog rather than a separate service. When the app hits an uncaught error we send the error message and stack trace.

Before an event leaves your device we run a scrubber that redacts values under keys including email, password, token, image data, URLs, prices, card names, and OCR text, and strips any local file path or inline image data.

We do not use advertising identifiers (IDFA), we do not use App Tracking Transparency, and we do not track you across other companies' apps or websites.

3.8 Device permissions

• Camera — required to scan cards and to take a photo for "Who's That Pokémon".
• Photo library — only when you choose an image for a post, avatar, or cover.
• Microphone — not used. The app has no audio feature and never records audio. (A microphone permission declaration inherited from the camera library is being removed from the app.)

We do not request location, contacts, calendar, health data, or push-notification permission.

3.9 What we do NOT collect

• No device location or GPS.
• No advertising identifiers, and no cross-app tracking.
• No push notification tokens — push notifications are not implemented; notifications are in-app only.
• No contacts, calendar, or health data.
• No date of birth (see Section 10).

3.10 Data held by our authentication provider

Our authentication provider (Supabase, built on GoTrue) maintains its own session and audit records, which by default include IP addresses and user-agent strings for sign-in events and sessions. We do not add to or query these for product purposes, but they exist, and Supabase retains them for a limited period under its own policies.

4. Why we use your information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

5. Who we share information with

We use the following service providers. They process data on our behalf under contract, and each has its own privacy policy.

Card data providers. We obtain card catalogue, reference, and pricing data from Scrydex, PokemonPriceTracker, PriceCharting, and eBay, and currency exchange rates from the European Central Bank. These lookups are made by our servers and are keyed on card attributes — set, number, name, grade — or are bulk catalogue syncs. No user data, account identifier, or user content is sent to any of them. Our eBay access uses an application-level credential, not one tied to you.

TCGplayer receives nothing from our servers at all; we only use TCGplayer product identifiers as a key to join pricing data.

Marketplace links. When you tap a link to eBay or TCGplayer, you leave the app and that site receives your request directly, including your IP address and whatever their own cookies tell them. We do not send them anything about you.

Other disclosures. We may disclose information when we believe in good faith that it is necessary to comply with law or a valid legal request; to enforce our Terms; to detect, prevent, or address fraud, abuse, security, or technical issues; or to protect the rights, property, or safety of our users, us, or the public. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will notify you if it becomes subject to a materially different policy.

5.1 International transfers

Our infrastructure is hosted in the United States, and our providers are primarily US-based. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. Where transfers from the EU/UK require a legal mechanism, we rely on our providers' Standard Contractual Clauses and, where applicable, their EU-US Data Privacy Framework certifications.

6. How public is each thing?

One consequence worth knowing: because guest sessions are technically authenticated, "visible to signed-in users" is effectively "visible to anyone who installs the app."

A related detail: our sign-up flow can check whether an email address already has an account, and that check can be made without being signed in. This means someone could test whether a given email address is registered with Ekalight. This is a deliberate product trade-off made so that sign-in can route you to the right flow.

7. Content moderation — your content is scanned

To keep the Service safe, content you submit is reviewed automatically and by humans:

1. A wordlist prefilter checks every post, comment, and direct message against a blocked-terms list at the instant you submit it, and applies rate limits.
2. An AI moderation pass sends the text of posts and comments, and the image bytes of post images, to OpenAI's moderation model for classification. It runs continuously, typically within minutes of submission. Images stay hidden from other users until they are approved. Direct messages are not sent to the AI pass.
3. Community reports from other users can hide content automatically once enough distinct people report it.
4. Human moderators review flagged and reported content and take action — removing content, suspending, shadowbanning, or banning accounts. We act on reports of objectionable content within 24 hours.

We keep records of reports and of moderator actions, including free-text notes written by the reporter and by the moderator, so that we can enforce our rules consistently and defend against abuse of the reporting system.

8. How long we keep information

We do not log your IP address in our own application logs — request logging is suppressed and our structured logs are limited to a whitelist of technical fields. Our hosting infrastructure may keep its own access logs.

9. Deleting your account

You can delete your account inside the app: Account → Delete Account. You may also email team@ekalight.com, or use the instructions at https://stmchan93.github.io/ekalight-legal/delete-account/.

What is deleted:

• Your authentication record, which cascades to your profile, posts, comments, likes, follows, blocks, mutes, direct messages you sent, conversation memberships, and notifications.
• Your collection and holdings, sale records, transaction ledger, wishlist, card-view records, scan events, scan artifact records, and portfolio imports.
• Your stored image files — scan photographs and normalised crops, transaction photos, post images, and your avatar and cover images. The deletion sweep removes the files themselves, not just the records that point at them. For very large accounts the sweep is bounded per request; anything it could not reach is recorded and removed by us afterwards.

What is not deleted, and why:

• Reports filed about you and moderator actions taken against you, including the free-text notes — retained so that a banned user cannot erase their enforcement history by deleting their account.
• The archived text of comments you soft-deleted, in the restricted archive described above.
• Your email address in our access-gate and waiting-list records, retained so that the invite/access system keeps working and so that a banned user cannot trivially re-invite themselves.
• Copies of scan images already exported into a model-training snapshot before your deletion may persist inside that snapshot.
• Backups. Point-in-time database backups retain your data as it stood before deletion, until the backup window expires.
• Aggregate and de-identified statistics that cannot be linked back to you.
• Anything we are required to retain by law.

If a step of the deletion fails for a technical reason (for example, a storage service being briefly unreachable), the deletion of your account still completes, the failure is recorded on our side, and we finish removing the remaining data afterwards.

Deletion is permanent and cannot be undone.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. We do not currently ask for a date of birth or operate an age gate. If you believe a child under 13 has provided us personal information, email team@ekalight.com and we will delete it.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal information; to data portability; and to withdraw consent. You may also have the right to lodge a complaint with your local supervisory authority.

In the app you can already: edit or clear your profile fields, delete your posts and comments, block and mute other users, report content, and delete your entire account.

To exercise any other right, email team@ekalight.com. We will respond within the time the applicable law requires. We may need to verify your identity first.

To object to your scan images being used for model training, email us. Note that in practice this means we will need to stop retaining your scans, which may limit the scanner.

We do not sell your personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

California and other US state laws. We honour access, deletion, and correction requests from all users regardless of whether a given state law's applicability thresholds are met. Requests go to team@ekalight.com.

12. Security

We protect information with encrypted transport (HTTPS/TLS), row-level access controls in our database so that users can only read what they are permitted to read, private storage buckets for scan images and post images, and authenticated proxies for serving private images. Your session token is stored in the device's secure keychain; in the rare case that the device keychain is unavailable, the app may fall back to storing the session token in ordinary app storage on your device.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

13. Changes to this policy

We may update this policy. If we make a material change we will give reasonable notice — for example, in the app or by email — and update the "Last updated" date above.

14. Contact

Ekalight (Stephen Chan, sole proprietor)
Postal address available on written request to the email below.

Email: team@ekalight.com

Privacy Policy · Terms of Service · Delete your account · Last updated Aug 12, 2026