Privacy Policy

1. Who We Are

Holographic Labs ("we," "our," or "us") is an independent app studio that builds mobile apps for collectors. Our current app, CardQuest TCG, helps Pokémon Trading Card Game collectors track their collections, open virtual packs, and analyze card values. Future apps may cover sports cards and other collectible categories.

We are the data controller for all personal data processed through our apps. If you have any questions, see Section 11 for how to reach us.

2. Information We Collect

2a. Information You Provide

• Account credentials — email address and password (hashed; we never store plaintext passwords) when you create an account via Supabase Auth.
• Card collection data — the names, sets, rarities, and quantities of cards you manually add to your binder or collection log.
• Pack opening logs — records of virtual packs you open, including the cards generated and the date/time.
• Trade notes — any text you enter into the Trade Advisor feature.

2b. Information Collected Automatically

• Device identifiers — anonymous device ID used by our subscription provider (RevenueCat) to manage your purchase status.
• In-app purchase receipts — processed by Apple and relayed to RevenueCat; we do not receive or store your payment card information.
• App usage events — screens visited, features used, and session duration (anonymous, aggregated). Used only to improve the app.
• Crash reports — stack traces sent when the app crashes. These may contain device model and OS version but never personal data.

2c. Information We Do NOT Collect

• Your real name, phone number, or physical address
• Your camera roll, photos, or contacts
• Your location (the app requests camera access only for card scanning, never location)
• Any financial or payment card information

3. How We Use Your Information

• Provide the service — authenticate your account, sync your collection across devices, and deliver app features.
• AI-powered features — text you submit to the Trade Advisor is sent to Anthropic's API to generate trade recommendations. This data is processed under Anthropic's API terms and is not used to train Anthropic's models by default.
• Card pricing lookups — card names and set numbers are sent to the Pokémon TCG API to retrieve market prices. No personal data is included in these requests.
• Subscription management — purchase receipts are shared with RevenueCat to validate and manage your CardQuest TCG Plus subscription.
• App improvement — aggregate, anonymous usage data helps us prioritize new features and fix bugs.
• Legal compliance — we may retain data as required by applicable law.

4. Sharing & Disclosure

We do not sell your personal data. We do not share your data with advertisers. We disclose information only in the following circumstances:

• Service providers — the third-party services listed in Section 5, which process data strictly to deliver the service.
• Legal requirements — if required by a valid court order, subpoena, or applicable law.
• Business transfer — in the event of a merger, acquisition, or asset sale, your data may transfer to the successor entity, subject to the same privacy commitments.
• Safety — if we believe disclosure is necessary to prevent imminent harm to you or others.

5. Third-Party Services

Our apps rely on the following third-party services. Each has its own privacy policy.

6. Data Retention

We retain your account and collection data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

Anonymous, aggregated usage statistics are retained indefinitely because they cannot be linked back to any individual.

7. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request that we delete your account and associated data.
• Portability — receive your data in a structured, machine-readable format.
• Objection / Restriction — object to or request restriction of certain processing.
• Opt-out of sale — we do not sell personal data, so this right is always satisfied.

California residents (CCPA) and EEA/UK residents (GDPR) may exercise these rights by contacting us at the address in Section 11. We will respond within 30 days.

Deleting your account

You can request account deletion at any time by emailing us. We will delete your account and all associated personal data within 30 days of your verified request.

8. Children's Privacy

Our apps are not directed to children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will promptly delete the account and associated data.

9. Security

We use industry-standard measures to protect your data:

• All data in transit is encrypted via TLS/HTTPS.
• Passwords are hashed using Supabase's bcrypt-based auth system — we never see your plaintext password.
• Access to our Supabase project is restricted to authorized developers only.
• API keys are stored server-side and never exposed in our app bundles where possible.

No system is 100% secure. If you discover a vulnerability, please report it to us privately at the email address in Section 11.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you via email or an in-app notice.

Your continued use of our apps after the effective date of a revised policy constitutes your acceptance of the changes.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us: