Privacy policy

Last updated July 26, 2026

Mintdex collects the minimum needed to run scanning, collection sync and subscriptions. This page says what is processed, why, on what legal basis, how long it is kept, and how to take control of it.

Who processes your data

Mintdex is published by Foosha Studio, a French simplified joint stock company with share capital of 500 euros, registered with the Paris trade and companies register under number 105 865 331, with its registered office at 8B rue Abel, 75012 Paris, France. EU VAT number: FR60 105 865 331. President: Jean-Elie Lecuy.
Foosha Studio is the data controller under the GDPR. It decides what is collected and why, and it is the one you can hold to account for it.
The contact point for anything touching your data is hello@getmintdex.com, under the president’s responsibility.

What is collected, and why

Your account. An account identifier and the email address tied to your sign in, or the private relay identifier if you use Sign in with Apple. It is what lets us recognise you and bring your collection back on your devices. Legal basis: performance of the contract, meaning the service you ask for when you create an account.
Your collection. The cards you declare owning, their conditions, languages, grades, your purchase prices and your binders. This data exists so it can sync across your devices. Legal basis: performance of the contract.
Your scan photos. The image you hold in front of the camera is used to identify the card. It leaves your phone for as long as the identification takes and is not kept. The next section is entirely about it.
Your subscription. Whether your Mintdex+ subscription is active, its type and its dates, so the right features unlock. Legal basis: performance of the contract.
How the app behaves. Crash reports and aggregated usage metrics, to fix bugs. Server technical logs, for security and abuse prevention. Legal basis: Mintdex has a legitimate interest in shipping an app that works and is not abused.
Your support messages. What you write to hello@getmintdex.com, so we can answer. Legal basis: performance of the contract and the legitimate interest in providing support.
Mintdex never asks for your name, your postal address, your phone number or any payment details.

Scan photos

When you scan a card, the image leaves your phone. It goes to Ximilar, a Czech company based in Brno, whose servers sit in Prague in an ISO 27001 certified data centre. Ximilar reads the set, the number, the language and the variant, then sends the result back to the app.
The image is not stored. It is processed in memory for as long as the identification takes, then discarded. Only the result, meaning the card details, is kept and attached to your collection.
Ximilar does not use your images to train, tune or evaluate its models. That is written into its contract with Foosha Studio, and Mintdex has granted no permission to do otherwise.
It all happens inside the European Union: your account and your collection in France, the recognition in the Czech Republic. None of your photos travels to the United States.
Legal basis: performance of the contract. Without that transfer scanning cannot work, and scanning is what you came for.
Aim at the card, not the room. A photo taken on the fly sometimes catches what sticks out: a hand, a face, a corner of a living room. Frame tight when you can, and keep other people out of shot. No facial recognition is performed on these images, by Mintdex or by Ximilar.
No photo is kept, by Mintdex or by Ximilar. So there is nothing to delete, nothing to retrieve, and nothing sitting around somewhere.
The Wrong card button. When you report a mistake, you send the photo and the correct answer so the catalog can be fixed. It is a deliberate action: nothing leaves until you press it.
Your photos are never published, never shared with other users, never sold, never used to profile you.

If you are under 15

Mintdex is not a children’s app and is not listed in the App Store Kids Category. But we know exactly who collects Pokémon cards, so here are the rules.
In France, below the age of 15, anything that relies on your agreement also needs the agreement of one of your parents. In practice: you only create a Mintdex account with a parent’s approval.
The account, the collection and the scanner rely on the contract, not on your consent, so there is nothing extra to accept in order to use them, nothing extra is collected because you are young, and you are offered no option that would need a parent’s approval.
No advertising, no advertising profile, no targeting, no cross app tracking. Not for minors, not for anyone.
Purchases go through the App Store and the Apple Account. If that account belongs to a child in a Family Sharing group, the purchase has to be approved by a parent through Ask to Buy. Mintdex charges nothing directly and cannot bypass that setting.
A parent can write to hello@getmintdex.com to access, correct or delete their child’s data. These requests are handled first.

Your Mintdex+ subscription

Purchase and payment go through the App Store. No payment details pass through Mintdex, and nobody at Foosha Studio ever sees any.
To know whether your subscription is active, Mintdex uses RevenueCat. RevenueCat receives an app identifier tied to your account, the subscription type, its dates and its status. Not your name, not your card, not your collection.
Legal basis: performance of the contract. Without that information there is no way to unlock what you paid for.
Cancelling happens in iOS settings, under Subscriptions. Refund requests go through Apple. Deleting your Mintdex account does not cancel your subscription: those are two separate actions.

What Mintdex never does

No sale of personal data, to anyone, ever.
No advertising profile built from your collection, no targeted advertising, no advertising trackers, no cross app tracking prompt.
No facial recognition, no biometric processing, no attempt to identify anyone in a scan photo.
No model training on your images.
No access to your photo library beyond the images you choose to send.
No automated decision producing legal effects on you. Card recognition is automated, but it decides nothing about you, and you can always correct the result.

Who else sees your data

Mintdex relies on a handful of providers. They act as processors: they only process your data on Foosha Studio’s instructions, for the stated purpose, and nothing else. Each is bound by a processing agreement compliant with Article 28 of the GDPR.
Supabase Pte. Ltd. (Singapore). Database, accounts and authentication, including Sign in with Apple. It holds your account identifier, your email address and your whole collection. The Mintdex project runs in the eu-west-3 region, in Paris: your data is stored and primarily processed in France, even though the company operating the service is established in Singapore.
Ximilar s.r.o. (Czech Republic). Card recognition. Receives your scan photos, processes them in memory, does not store them. For its infrastructure Ximilar relies on providers including Amazon Web Services in Frankfurt. Any change of processor is notified to us 30 days in advance and can be objected to.
RevenueCat, Inc. (United States). Subscription status. Receives an app identifier, the subscription type and its dates. Sees neither your collection nor your photos.
Vercel Inc. (United States). Hosting for the getmintdex.com site you are reading. Processes request logs, including your IP address. Sees neither your account, nor your collection, nor your photos.
Cloudflare. Delivery of the catalog card images, stored on its R2 service under European jurisdiction. Receives the IP address requesting an image. Sees neither your account, nor your collection, nor your scan photos.
Apple. The App Store charges the subscription and provides Sign in with Apple. For those operations Apple acts on its own behalf, under its own privacy policy, not on Mintdex’s instructions.
Beyond these providers, your data may be disclosed to an authority where the law requires it. In that case Mintdex checks that the request is valid and tells you whenever it is allowed to.

Where your data lives

Your account, your email address and your whole collection are stored and primarily processed in France, in Paris.
Your scan photos are processed in the Czech Republic, in Prague, by a European company, and are not stored. None of your photos leaves the European Union.
Some providers are established outside the European Union. Supabase, operating from Singapore the database that sits in Paris. RevenueCat and Vercel, in the United States, for subscription status and for hosting this website. Cloudflare, in the United States, whose image storage used by Mintdex is restricted to European jurisdiction. None of them except Supabase sees your collection or your photos.
These transfers rely on the European Commission standard contractual clauses, which those providers incorporate. For Vercel and Cloudflare, an EU-US Data Privacy Framework certification comes on top.
You can ask for a copy of those safeguards by writing to hello@getmintdex.com.

How long it is kept

Your account and your collection: as long as your account exists. On deletion, data is erased from live systems within 30 days, then from backups as they rotate.
Your scan photos: they are not kept. They live for as long as the identification takes, then they are gone.
Crash reports and usage metrics: 12 months.
Technical and security logs: 12 months.
Your support conversations: 3 years after the last message.

How your data is protected

Everything travelling between the app and the servers is encrypted in transit. Data is encrypted at rest at the hosting provider.
Database access is partitioned per user: your account only sees your collection. Administrative access is limited and protected by two factor authentication.
The data centre that processes scan photos is ISO 27001 certified.
No system is bulletproof. In case of a data breach likely to create a risk for you, the CNIL is notified within 72 hours and you are told directly whenever the risk is high.

Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict its processing, to object to processing based on legitimate interest, and to withdraw at any time a consent you have given. Withdrawing consent does not undo what was lawfully done before.
You also have the right to data portability: getting back the data you provided, in a machine readable format. There is no export button in the app. That request is therefore handled manually: write to hello@getmintdex.com and you get your file.
Under French law you can also leave instructions about what happens to your data after your death, and name who may enforce them.
To exercise any of these rights, write to hello@getmintdex.com from the email address of your account. The answer comes within one month. If the request is complex, that deadline can be extended by two months, and you are told before it is.
Where there is serious doubt about who is asking, an additional confirmation may be requested. It is used only to verify the request and is not retained.

Deleting your account

Deletion happens in the app settings, without going through support and without having to justify yourself.
What is erased: your account, your email address, your collection, your binders, your purchase prices, and any scan photos you had agreed to let us keep.
If you use Sign in with Apple, the authorisation granted to Mintdex is revoked at the same time.
What may survive for a while: security logs, until they expire normally, and transaction records held by Apple, which Mintdex does not control.
There is no way back and there is no export. Note down whatever you want to keep before you confirm.
Your Mintdex+ subscription does not cancel itself when the account goes. Go to iOS settings, under Subscriptions, or it keeps being charged.
If you can no longer reach the app, write to hello@getmintdex.com and the deletion is done for you.

Affiliate links

Some buy links to third party marketplaces are affiliate links. The price you pay stays the same, and a commission may go to Mintdex.
Opening one of these links sends no account or collection data to the marketplace. The link carries an affiliate identifier, not an identifier of you.
Once you are on the merchant’s site, their privacy policy applies, not this one.

The getmintdex.com website

This site sets no analytics cookie and no advertising tracker. There is no banner to click because there is nothing to accept.
Only your light or dark theme choice is stored in your browser, on your device, and it is sent nowhere.
The site host, Vercel, records technical logs containing your IP address, for security and for the site to work. Legal basis: legitimate interest. Retention: 24 hours, or 30 days if extended observability is enabled on the project.

Changes to this page

The date at the top of the page tells you when it was last updated.
If a change actually alters what is done with your data, you are told in the app or by email before it applies.

Contact and complaints

For anything about your data, write to me.
If the answer does not satisfy you, you can lodge a complaint with the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr. If you live in another EU country, you can also complain to your own national authority.

hello@getmintdex.com