Last updated: 4 August 2026 · Applies to the iOS app “The Collectors Finest” and this website.
The short version. This app sells nothing, shows no ad banners, and uses no third-party tracking or analytics. There is no advertising identifier, no advertising profile, and nothing is passed to data brokers. You can use the app without signing in and without giving a name or an email address. Everything stored about you can be exported and deleted from inside the app at any time.
The controller under the General Data Protection Regulation (GDPR) is:
Johannes Kloda
Rissener Landstr. 78
22587 Hamburg, Germany
Email: contact@thecollectorsfinest.com
No data protection officer has been appointed; the legal requirements for appointing one (§ 38 BDSG) are not met.
On first launch the app automatically creates an anonymous account on our server. That account is a random access token — it contains no name, no email address and no advertising identifier. The token is stored in the iOS keychain on your device and sent with each request; our server only holds a one-way hash of it.
Purpose: without an account we could not tie your collection, your purchases and your photos to you, nor protect them from others. The legal basis is Art. 6(1)(b) GDPR (performance of the user relationship).
When the account is created we also store your IP address once, to limit automated mass creation of accounts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the service from abusive automation.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Access token (hashed), time of account creation | attributing and protecting your data | Art. 6(1)(b) | until account deletion |
| IP address at account creation | protection against mass creation | Art. 6(1)(f) | until account deletion |
| Alias and avatar, if you set one | how you appear to other collectors | Art. 6(1)(b) | until account deletion |
| Purchases: card, search text, price, currency, date | your personal purchase log | Art. 6(1)(b) | until account deletion |
| Registered cards (“pulls”): card, serial number, grade, photo | your collection | Art. 6(1)(b) | until account deletion |
| Card photos you upload | the shown image of that card | Art. 6(1)(b) | until account deletion |
| Showcase entries (with alias or anonymous) | the public ranking | Art. 6(1)(b) | until account deletion |
| Collectors you follow or block | your lists | Art. 6(1)(b) | until account deletion |
| Price alerts: search pattern, maximum price, note | notifying you of matches | Art. 6(1)(b) | until account deletion |
| Reports: reported content, reason | reviewing reported content (Art. 16 DSA) | Art. 6(1)(c) | until the reporter’s account is deleted |
| Voluntary training samples (photo of a card surface with your verdict) | improving surface detection | Art. 6(1)(a) | until account deletion |
| Server logs: IP address, time, requested address, status code, user agent | operation, debugging, defence against attacks | Art. 6(1)(f) | see section 7 |
Providing this data is neither required by law nor by contract. You do not have to provide anything — but without an account the app cannot technically function, and without the respective entries the related features (collection, purchase log, alerts) are not available. No further disadvantage arises for you.
This is the most important section of this policy, which is why it is spelled out:
Your purchases and prices paid, your registered cards including grades, your price alerts, your following and block lists, and your reports.
The app never shows real names. Only the pseudonym is ever public.
Centering measurement, text recognition on the card and edge analysis run entirely on your iPhone. These results are not transmitted to us. Also kept locally: your access token in the keychain, your recent search terms, a cache of your purchases, your binder ordering and your selected sports.
Camera — only when you scan or photograph a card. The image is measured on the device; it is only uploaded if you explicitly save or upload it.
Photo library — only when you pick an image yourself. The app receives only the image you selected, not access to the rest of your library.
Local network — used exclusively for a developer mode that lets the operator test the app against their own machine on the same Wi-Fi. It is not used in normal operation.
Before any image leaves your device we strip its metadata (EXIF), in particular the location and time of capture.
Our server and the web server in front of it log every request with IP address, time, requested address, status code and user agent. For searches, the search term can be part of the requested address and therefore appear in the log. The purpose is technical operation, finding faults and defending against attacks; the legal basis is Art. 6(1)(f) GDPR with our legitimate interest in a functioning and secure service.
Logs are overwritten on a rolling basis and deleted after 30 days at the latest. These logs are not combined with your account.
We back up the databases hourly so that a defect does not cost you your collection. These backups roll over: hourly states for 48 hours, daily states for 30 days. If you delete your account, your data disappears from live operation immediately; it falls out of the backups as those periods expire. Should a backup ever have to be restored, deletions made in the meantime are re-applied.
The server is operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. Hetzner processes the data solely on our behalf; a data processing agreement under Art. 28 GDPR is in place. The data does not leave Germany.
You may voluntarily sign in with your Apple ID. We request neither your name nor your email address — the sign-in only serves as a confirmation towards your device and is recorded locally only. Nothing is transmitted to our server. The provider is Apple Distribution International Ltd., Hollyhill, Cork, Ireland.
The app displays images from public eBay listings. Those images are loaded directly from eBay’s servers. In doing so, eBay learns your IP address and technical details of your device — just as if you had opened an eBay page. We transmit no data from your account to eBay. When you open a listing you leave our app for eBay; from that point eBay’s privacy policy applies. eBay also processes data in the United States.
The legal basis for loading those images is Art. 6(1)(b) GDPR — without the image the market view would lose its purpose.
Obtaining the app itself happens through the App Store. What data Apple processes in that context is outside our control; Apple’s privacy policy applies.
There are no other recipients. In particular we use no analytics, crash-reporting or advertising services, and we pass no data to third parties.
The app contains no ad banners and no advertising network. It does not ask for permission to track you across apps and uses no advertising identifier (IDFA). No third-party packages or SDKs are embedded at all.
We currently earn nothing from links to eBay listings — they are plain links. Should we ever join a partner programme, links will be labelled as advertising directly at the link, and this policy will say so before it happens.
All data named in section 3 is stored until you delete your account. There is no retention beyond that; we deliberately did not introduce automatic deletion periods for individual data types, so that your collection does not vanish unasked.
Delete your account: in the app under Settings → Delete account & data. This deletes your account, your profile, your avatar, your purchases, your registered cards, your photos including the files, your Showcase entries, your following, block and report lists and your price alerts. Your access token becomes invalid. Your contributions to the public sighting list remain as catalogue knowledge but are separated from your alias and thereby anonymised. On the device, all local data is removed.
Export your data: in the app under Settings → Export my data. You receive everything stored about you as a JSON file.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Access and portability you can exercise yourself right away using the export function; for anything else an informal email to us is enough.
Where we base processing on your consent (voluntary training samples), you may withdraw it at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.
You have the right to object at any time, on grounds relating to your particular situation, to processing of your data that we base on a legitimate interest under Art. 6(1)(f) GDPR (in our case: the IP address at account creation and the server logs). We will then stop processing that data unless we can demonstrate compelling legitimate grounds which override your interests (Art. 21 GDPR). An informal email suffices.
You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Phone +49 40 428 54-4040 · mailbox@datenschutz.hamburg.de
You may instead turn to the supervisory authority of your place of residence or of your workplace (Art. 77 GDPR).
No automated decision-making or profiling producing legal effects concerning you within the meaning of Art. 22 GDPR takes place. The app does compute assessments about cards (such as a centering range or a price range), but those concern objects, not people.
The app is not directed at children. For the optional sign-in with Apple you confirm that you are at least 16 years old. Use without that sign-in is equally possible; it creates the anonymous account described in section 2, which contains no information about your person.
As the app develops we will adapt this policy. The version published here, with the date given above, is the applicable one. We will point out substantial changes in the app.