Privacy Policy

This Privacy Policy describes how ZEBOX (“ZEBOX,” “we,” “us,” or “our”) collects, uses, and shares information when you use the ZEBOX iOS application and the website at zebox.ai (together, the “Services”). We build ZEBOX around a simple idea: your collection is yours. We collect the minimum needed to make the app work.

Information we collect

Camera images. ZEBOX uses your device camera to detect and identify trading cards. Card detection and text recognition run on your device. When you save a card to your collection, the captured card image is stored with your inventory entry.

Photo library imports. If you choose to import photos instead of using the camera, we access only the photos you select.

Account information. If you create an account to sync your collection, we collect your email address and authentication credentials, managed by our backend provider (Supabase).

Collection data. The cards you index — including card identity, variant, condition, language, quantity, and the associated card image — are stored on your device. If you enable sync, this data is also stored on our servers so it can follow you across devices.

Purchase and subscription data. If ZEBOX offers paid features, purchases are processed by Apple. Our monetization partners (RevenueCat and Superwall, when enabled) receive purchase receipts and pseudonymous identifiers to manage entitlements and paywalls. We never see your payment card details.

Usage and diagnostics. We may collect basic, aggregated usage and crash information to keep the app reliable.

How we use information

• To recognize cards and build and sync your collection index.
• To show market price snapshots for cards in your index.
• To authenticate you and secure your account.
• To process purchases and manage subscriptions.
• To fix bugs, improve recognition quality, and operate the Services.

What we don’t do

• We do not sell your personal information.
• We do not use your camera feed for anything other than card recognition.
• We do not show third-party advertising in the app.

Third-party services

ZEBOX relies on a small number of service providers to operate:

• Supabase — authentication, collection sync, and our card catalog backend.
• Card catalog and pricing sources (such as the Pokémon TCG API, TCGdex, and TCGplayer market data) — card metadata, reference images, and market price snapshots. Catalog queries include only card-identifying text, never your personal information.
• RevenueCat and Superwall (when enabled) — subscription entitlements and paywall presentation.
• Apple — App Store distribution and payment processing.

Each provider processes data under its own privacy policy and only as needed to provide its service to us.

Data retention and deletion

Collection data stored only on your device is deleted when you delete the app. If you use sync, we retain your account and collection data until you delete your account. You can request deletion of your account and all associated data at any time by contacting us at support@zebox.ai, and we will complete the deletion within 30 days.

Security

Data in transit is encrypted with TLS. Synced collection data is protected by row-level security so that only your authenticated account can access it.

Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. To exercise any of these rights, email support@zebox.ai. We will respond within the timeframe required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app.

Contact

Questions about this policy or your data: support@zebox.ai