Privacy policy and terms of service for the Logbook iOS app.
Last updated: 15 October 2026
The rest of this page explains the details.
Logbook is published by Romain Lagrange, an individual, based in France.
Romain Lagrange is the data controller for the processing described here, within the meaning of the EU General Data Protection Regulation (GDPR).
This policy covers the iOS app Logbook: OP TCG Card Scanner (bundle identifier com.romainl01.logbook).
To create an account, Logbook collects:
| Data | When | Notes |
|---|---|---|
| Email address | Sign-up with email, or Sign in with Apple | With Sign in with Apple, if you choose “Hide My Email”, we only ever receive an Apple relay address ending in @privaterelay.appleid.com. We never see your real address. |
| Password | Sign-up with email only | Stored only as a cryptographic hash by our authentication provider. We cannot read it. |
| Apple user identifier | Sign in with Apple only | An opaque identifier issued by Apple, specific to Logbook. |
| Name | Sign in with Apple only | Apple offers your name on the first authorisation, and you can edit or decline it on Apple’s own screen. If you provide it, we store it as your display name. Apple never gives it to us again, so if you decline it we simply have no name for you, and nothing in the app requires one. |
| Apple refresh token | Sign in with Apple only | Stored so that we can revoke your Apple authorisation when you delete your account, as Apple requires. It is not used for anything else. |
That is the complete list. We do not ask for your date of birth, your phone number, your postal address or your payment details.
Your phone tries first, and most cards never leave it. Logbook reads the card code directly on your device, using Apple’s on-device text recognition, and matches it against the card catalogue that ships inside the app. When that works, no photo is sent anywhere.
When your phone cannot read the card, the photo is sent to identify it. Since September 2026, a scan that fails on your device is sent, as a single resized photo, to our server and from there to CardSight AI (section 4), a service that recognises trading cards from an image. It is used for that one purpose: to tell us which card is in the picture. We do not store the photo on our servers, and it is not attached to your account. What we keep is a technical record that a recognition request was made — when, from which part of the app, how long it took, and the card code that came back — so that we can limit how many such requests are made. That record carries your account identifier while you have an account, and loses it when you delete your account.
This only happens after a failed on-device read. If you are offline, or if the service is switched off or has reached its daily limit, nothing is sent and Logbook asks you to type the code in instead, exactly as before.
The photo itself stays in your device’s temporary storage, where iOS deletes it. Logbook does not save your scans to your photo library and does not ask for access to it.
Adding the recognised card to your collection is a separate step, and that step does reach our servers, as section 2.3 explains. What travels is the card’s identity and the details you chose to record. The photograph is not part of it.
Once you are signed in, your collection is stored on your account, on our servers, and kept in step with a copy on your device so the app works offline. It covers:
Why we do this. Your collection survives a reinstall, a lost phone or a new device: you sign in and it comes back. This is a change made in August 2026. Before it, the collection existed only on the device and nothing could recover it.
What it means for your privacy. We hold a copy. Your rows are locked to your account in the database itself, so no other user of Logbook can read them, and we use them for nothing other than giving them back to you — with one exception you control: if you create a public profile, the cards, sealed products and wishlist on your shared page are read from these rows, as section 2.10 describes. They are deleted when you delete your account (section 6).
The price data is a separate matter and says nothing about you: the app downloads the same public price file as everybody else and caches it on your device.
Like any app that connects to the internet, Logbook’s requests carry technical connection data: your IP address, the time of the request, and basic device and network information. This applies when:
static.dotgg.gg, and set and sealed-product images from the third-party image CDN tcgplayer-cdn.tcgplayer.com;The requests that carry your session are tied to your account by necessity: that is how the server knows whose collection to hand back. We do not build profiles from any of this, and we do not use it for anything beyond running and securing the service.
Logbook is free up to a limited number of items in your collection, and paid above that. If you subscribe:
Since August 2026, Logbook measures how it is used, so that we can tell which parts work and which parts people abandon. This is done with PostHog, a product analytics tool. It is not advertising, and it does not follow you outside Logbook.
What is sent. One short record per meaningful action, carrying only what is needed to count it:
/cards, /dashboard).On our website, logbooktcg.com. When someone opens a link to a shared collection in a browser, our server records that a link was opened, which of its states the page showed (a collection, an empty or private one, a link that no longer works) and the language it was displayed in. When someone opens the home page, it records that the page was opened and the language it was displayed in. When someone taps the App Store badge on the site, it records that tap, whether it came from a shared collection or from the home page, and on the home page which part of it (the top, the menu bar or the bottom). These records are made by our server, not by your browser. They carry no identifier for the visitor (each record gets a random one that is never reused), no IP address and no location. Since 15 October 2026 they also record where the visit came from: the domain of the referring site (for example tiktok.com, never the full address of the page), and the campaign labels (utm_source, utm_medium, utm_campaign) that we put on our own links. A record of a shared collection being opened also carries the random code of that link, so that we can tell which shared pages are visited most; it never carries the name of the person whose collection it is. Link previews generated by messaging apps are not counted.
Since the same date, the site also runs Vercel Web Analytics, a small script from our hosting provider, to count visits. It sets no cookie and stores nothing on your device. It records the page address (for a shared collection, that includes the link’s random code), the referring site, the country derived from the IP address, and the type of device, browser and operating system. To count a visitor once per day, it computes an identifier from the request that is discarded after 24 hours; it never stores the IP address. These figures are aggregated: we see totals per page, per referring site and per country, not individual visitors.
What is never sent. Your email address. Your name. The prices you enter for your own cards, whether you paid them or sold at them: those are sent as “a price was recorded”, never as a figure. The total value of your collection leaves only as a broad band (for example “250 to 1000 euros”), never as an amount. No photograph, no advertising identifier, and nothing that follows you into another app.
Why we do this. Legitimate interest, Art. 6(1)(f): a project this small cannot otherwise tell whether the scanner works on real cards, or whether people give up before their first one. We have kept the data minimal precisely so that this basis is honest, and we treat it as measurement of the product rather than knowledge about you.
How to object. Because this rests on legitimate interest and not on your consent, you have the right to object to it (GDPR Art. 21). Write to logbook.ugc@gmail.com and we will stop collecting these events for your account and delete the ones already recorded. There is no switch inside the app: the app does not ask you, and it does not let you turn it off by yourself.
Settings has a Send feedback screen where you can report a bug, tell us a card or a price is wrong, or suggest something. Nothing here is collected unless you write a message and tap send.
What is sent:
The screen states all of this on itself, above the send button, before you send anything.
What is never sent. Your photographs. Your cards themselves. Any price you entered for something you own. Your location.
Where it goes. The message is stored in our database (section 4, Supabase) and a copy is emailed to us so that we read it. The email is delivered by Resend, and it carries your email address in its reply-to field, which is what lets us answer you directly. If you would rather write to us without any of this context attached, email logbook.ugc@gmail.com instead: it reaches the same person.
Why we do this. Legitimate interest, Art. 6(1)(f): we cannot fix what we are not told about, and a report without a version number and a device model usually cannot be acted on at all. You are never asked for feedback and never prompted for it: every message here exists because somebody chose to write it.
Every card in the app carries a market price we did not set: it comes from Cardmarket, matched to the card by us, and the matching is sometimes wrong. On a card’s price, the ? opens a sheet explaining where the figure comes from, and at the bottom of that sheet you can tell us the price looks wrong. Nothing here is collected unless you pick a reason and tap send.
What is sent:
The sheet states all of this on itself, above the send button, before you send anything.
What is never sent. Your collection. Your photographs. Any price you entered for something you own. Your location. The figure you give us here is what you think a card is worth on the open market, which is a public fact about a product; it is not, and is never confused with, what you paid.
Where it goes. The report is stored in our database (section 4, Supabase) and a copy is emailed to us by Resend, exactly as feedback is.
Why we do this. Legitimate interest, Art. 6(1)(f): a price we display wrongly is a defect in the product, and users holding the actual cards are the only people who can catch a whole class of them. A report without the card and the price file it came from cannot be acted on at all. You are never asked to report a price and never prompted to: every report here exists because somebody went looking for the form.
Since September 2026, Logbook can tell you when a card reaches a price you chose, for the cards you asked us to watch. It can also send a summary of your collection and a few reminders, which have their own switch (see Summaries and reminders below). None of them is advertising, and none of them names a price or the subscription’s cost.
To reach your phone while the app is closed, we have to hold three things about the installation itself.
What is sent:
What a notification itself carries. The card’s code, and which way its price moved. Never a figure: not your threshold, not the price. That is a deliberate product decision and not an oversight — the app shows prices on a marketplace, a price basis and an edition that you chose and that live only on your phone, so any amount we wrote on your lock screen could contradict the one you read three seconds later when you opened the app.
What is never sent. Your email address, your name, your collection, your location. A notification token is not an advertising identifier: it cannot be read by any other app, it identifies nothing outside Logbook, and we never share it with anyone but the delivery services below.
Where it goes. The token is stored in our database (section 4, Supabase). To deliver a notification we hand it to Expo, whose push service relays it to Apple’s Push Notification service, which delivers it to your phone. Expo therefore sees the token and the text of the notification; it sees no account of yours, because we identify the device and never the person.
Summaries and reminders. Besides the alerts you arm yourself, Logbook can send a summary on Sundays when your collection has moved, and a few reminders. They are governed by their own switch, Summary and reminders, independent from price alerts. If you stop opening the summaries, we slow them down to one a month, and the switch says so.
How to stop it. Turn the switches off in Logbook’s Settings → Notifications, or turn Logbook’s notifications off in iOS Settings, which overrides everything. Signing out releases the token immediately, so a phone you have signed out of stops receiving anything for that account — this matters on a shared device. Deleting your account deletes the token with it. And because iOS only ever asks the question once, refusing it the first time is a definitive answer as far as the app is concerned: only a trip to iOS Settings can reopen it.
Why we do this. Performance of the service you asked for, Art. 6(1)(b): an alert you armed yourself cannot be delivered without an address to deliver it to.
Since October 2026, you can share your collection with a link. Nothing is shared until you create a public profile, and creating one is optional: the rest of the app works the same without it.
What you give us.
nakama-1234. It is unique across Logbook and it is public: it is the name on your page.The photo is checked before it is published. A photo you add is sent from our server to OpenAI’s moderation service (section 4), which tells us whether it contains violent, sexual or otherwise inappropriate content. That is its only use: it is sent without your name, your email or your account identifier, and under OpenAI’s terms for its API, what we send is not used to train its models. A photo that is refused is not stored anywhere, and if the moderation service cannot be reached, the photo is not published either: you are asked to try again. An accepted photo is stored on our servers under a random file name that does not contain your account identifier.
What anyone with your link can see. Your page lives at logbooktcg.com/c/ followed by a random code that we generate. It can be opened in the Logbook app by a signed-in user, or in any web browser, by anyone who has the link, so treat it the way you would treat any link you post. It shows:
What it never shows: your email, your Apple name, your account identifier, the price you paid for anything, whether you bought or pulled a card, its condition or grade, and products you have opened. A private account shows neither your cards nor your wishlist. Our server only ever releases the fields listed above; the rest never leaves the database.
The page is marked so that search engines do not index it, and the code in the link is long enough that it cannot reasonably be guessed. It is still a public page: anyone you send the link to can forward it.
How to control it.
Reporting a page. A signed-in user can report someone else’s page from the app, with an optional reason (up to 1,000 characters). We record who reported which page, when, and the reason, and we receive it by email so that a person reviews it. The page owner is not told who reported them. We may remove a nickname or photo that breaks our terms.
On the website. The page is served by our hosting provider, Vercel (section 4). Like any web server, it receives the visitor’s IP address in order to answer; we use it only to limit how many pages a single address can request per minute, and we do not record it ourselves; Vercel’s own request logs keep it briefly, under its policy. What our server records about visits is described at the end of section 2.6.
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account, letting you sign in | Email, password hash, Apple identifier, name | Performance of a contract, Art. 6(1)(b) |
| Storing your collection so it survives a reinstall or a new phone, and keeping your devices in step | The collection data listed in section 2.3 | Performance of a contract, Art. 6(1)(b): this is the service |
| Revoking your Apple authorisation when you delete your account | Apple refresh token | Performance of a contract, Art. 6(1)(b), and our legitimate interest in meeting Apple’s platform requirements, Art. 6(1)(f) |
| Selling a subscription, and recognising it on your other devices | Store transaction data, your account identifier | Performance of a contract, Art. 6(1)(b) |
| Keeping the service available and secure (technical logs, abuse prevention) | Technical connection data | Legitimate interest, Art. 6(1)(f) |
| Understanding how the app is used, so we can improve it | The usage events listed in section 2.6 | Legitimate interest, Art. 6(1)(f). You can object at any time, see section 2.6 |
| Reading and answering feedback you send us | The message and context listed in section 2.7 | Legitimate interest, Art. 6(1)(f) |
| Correcting the prices we display when a user reports one as wrong | The report and context listed in section 2.8 | Legitimate interest, Art. 6(1)(f) |
| Showing your public profile and shared collection to the people who have your link | Nickname, profile picture, and the collection data listed in section 2.10 | Performance of a contract, Art. 6(1)(b): sharing is a feature you switch on |
| Checking a profile photo before publishing it, and handling reports | The photo, and the report listed in section 2.10 | Legitimate interest, Art. 6(1)(f): keeping public pages free of inappropriate content, and meeting App Store requirements for user-generated content |
| Telling you when a card you asked us to watch reaches your price | The notification token, time zone and language listed in section 2.9 | Performance of a contract, Art. 6(1)(b): the alert is the service you asked for |
We do not process any special category data, and we do not use your data for automated decision-making with legal effects.
We use a small number of service providers (“processors”). They act on our instructions and for no other purpose.
| Provider | Role | Where | Data involved |
|---|---|---|---|
| Supabase, Inc. (United States) | Hosts the accounts database, your collection, your public profile and profile photo, and our server functions | Project hosted in the EU (Paris, France) | Account data, collection data, nickname and profile photo |
| RevenueCat, Inc. (United States) | Tells the app whether your subscription is active, and validates App Store receipts | United States | Store transaction data, your account identifier, device information |
| Apple Inc. | Sign in with Apple, App Store distribution, subscription payments | United States | Your Apple sign-in, your purchase |
| PostHog, Inc. (United States) | Product analytics: tells us which screens are used and whether scans succeed | United States | The usage events listed in section 2.6, and your account identifier |
| Resend (Plus Five Five, Inc.) (United States) | Delivers the notification email when you send feedback, report a price, or report a shared page, from the app | United States | The feedback message and context listed in section 2.7, the price report listed in section 2.8, the page report listed in section 2.10, and your email address |
| CardSight AI, Inc. (United States) | Recognises a card from a photo when your phone could not read it (section 2.2) | United States | The photo of the card, sent without your name, email or account identifier |
| OpenAI, L.L.C. (United States) | Checks a profile photo for inappropriate content before it is published (section 2.10) | United States | The photo you chose, sent without your name, email or account identifier. A refused photo is not stored by us |
| Vercel Inc. (United States) | Hosts our website, including the shared collection pages (section 2.10) | United States, served from the network location nearest the visitor | The visitor’s IP address, as for any website; the content of a shared page while it is being displayed; the visit counts of Vercel Web Analytics described at the end of section 2.6 |
| Expo (650 Industries, Inc.) (United States) | Relays a price-alert notification from our servers to Apple’s Push Notification service | United States | The notification token described in section 2.9, and the text of the notification. No account of yours: we address the device, never the person |
Transfers outside the European Union. All nine companies above are established in the United States. Our Supabase project itself runs in the European Union (Paris), so your account and your collection are stored on EU servers, but Supabase’s American parent company can access them for support and operations. Subscription data goes to RevenueCat in the United States. Those transfers are covered by the standard contractual clauses and safeguards published by each of those providers.
Card images displayed in the app are loaded from the third-party CDN static.dotgg.gg, and images of sets and sealed products from the third-party CDN tcgplayer-cdn.tcgplayer.com. Both receive your IP address as part of any ordinary image request. Neither is a processor acting on our instructions: they are simply the hosts your device requests an image from.
We never sell, rent or trade your data, and we never share it for advertising purposes. We only disclose data where the law requires it.
| Data | Retention |
|---|---|
| Account data (email, password hash, Apple identifier, name) | For as long as your account exists. Deleted when you delete your account. |
| Apple refresh token | Same as above. Used once during deletion, to revoke the authorisation, then deleted. |
| Your collection, your sealed products, your wishlist | For as long as your account exists. Deleted when you delete your account. Removing a card removes it from your other devices too, and leaves behind only a marker saying it was removed, which is how your devices learn about the removal. That marker goes with the account. |
| Scan photos | Not retained by us. A photo your phone could read never leaves it; a photo sent for recognition (section 2.2) is not stored on our servers. |
| Nickname, profile photo, privacy setting, share link (section 2.10) | For as long as your account exists, or until you change them: a replaced photo is deleted, a cancelled link stops working immediately. All of it is deleted when you delete your account. |
| A photo refused by moderation | Never stored by us. |
| Reports of a shared page (section 2.10) | For as long as both accounts exist: a report is deleted when either the person who sent it or the person it concerns deletes their account. The notification email we received stays in our mailbox. |
| Subscription data at RevenueCat | For as long as RevenueCat needs it to recognise your subscription and honour a restore, in line with its own retention policy. A purchase record necessarily outlives a cancellation, otherwise restoring a subscription could not work. |
| Technical logs of our server functions | Short-lived, in line with Supabase’s own log retention. They contain error messages and technical metadata. |
| The local copy on your device | Until you delete the app, or until you delete your account, which wipes it. |
| Feedback you sent (section 2.7) | For as long as your account exists: the record is attached to your account and is deleted with it. The notification email we received is a separate copy and stays in our mailbox, like any email anybody sends us. |
| Price reports you sent (section 2.8) | The same, and for the same reason: the record is attached to your account and is deleted with it, and the notification email is a separate copy that stays in our mailbox. |
| Notification token, time zone and language (section 2.9) | For as long as your account exists, and only while the installation is alive and signed in: signing out releases it. A token that Apple tells us no longer exists — you deleted the app, or turned notifications off at the system level — is marked dead and stops being used. Deleting your account deletes it. |
| Usage events at PostHog (section 2.6) | Kept while they are useful for reading trends. They are not stored with your account, so deleting your account does not automatically erase them: ask us and we will delete them. |
You can delete your account from inside the app, in Settings → Account → Delete account. No email, no form, no waiting period.
Deleting your account:
It takes effect immediately and cannot be undone. There is no “deactivated” state and no soft delete: your data is not archived somewhere in case you come back.
Deleting the app is not the same thing. It removes the local copy from that device, but your account and your collection stay on our servers until you delete the account itself, and signing in again on any device brings the collection back.
Deleting your account does not cancel a paid subscription. An App Store subscription is managed by Apple, not by us, and has to be cancelled in your Apple account settings. Do that first if you are subscribed.
Under the GDPR you have the right to:
How to exercise them: email logbook.ugc@gmail.com. We answer within one month.
Two practical notes, so you know what to expect:
If you believe your data is being handled improperly, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the supervisory authority of the EU country where you live.
To be explicit, because a lot of apps in this category do the opposite:
Logbook is not intended for children under 13, and we do not knowingly collect data from them. If you are below the age of digital consent in your country (15 in France), you need a parent or guardian to agree on your behalf. If you believe a child has created an account, contact us at logbook.ugc@gmail.com and we will delete it.
We may update this policy as the app evolves. The date at the top always reflects the most recent version, and significant changes will be announced in the app before they take effect.
The 15 October 2026 version records one change: the website now measures where its visitors come from. Our server adds the referring domain and our own campaign labels to the visits it already counted, and the code of a shared link to the record of that link being opened. The site also runs Vercel Web Analytics, a cookieless visit counter from our hosting provider. The app itself is unchanged. Section 2.6 describes both.
The 10 October 2026 version records one change: you can now share your collection. It is optional and off until you create a public profile. Section 2.10 lists what a shared page shows (never what you paid), how to make it private or cancel the link, and how reports work. It adds two processors to section 4: OpenAI, which checks a profile photo before it is published, and Vercel, which hosts the website the shared pages are served from. It also corrects section 5, which still said scan photos never leave your phone after the 22 September version had changed that.
The 22 September 2026 version records one change: a card your phone cannot read can now be sent to a recognition service. Until now, recognition ran only on your device and a failed read meant typing the code in. Now, only after a failed read, the photo is sent to CardSight AI to identify the card (section 2.2), which adds a seventh processor to section 4. Cards your phone reads itself — most of them — still never leave it.
The 20 September 2026 version records one change: the app can now send you notifications. It could not before, and an earlier version of this policy did not mention them at all. What is new on our side is that we hold a notification token — an identifier for the installation of the app on your phone — together with your time zone and the app’s language, and that a sixth processor (Expo) appears in section 4 because it is what relays a notification to Apple. Section 2.9 describes all of it, including the two things it is worth knowing without reading it: we never send anything before 9am or after 9pm in your own time zone, and a notification never carries a price figure. Nothing here happens unless you arm an alert yourself, and iOS asks its own question before any of it is possible.
The August 2026 version records four such changes. Card recognition became entirely on-device, so no photo is sent anywhere any more. Collections started being stored on your account rather than on the device alone, so we now hold a copy of something we previously did not. And the app began measuring its own use, described in section 2.6, which an earlier version of this policy said it did not do: that sentence was true when it was written and is not any more, and replacing it rather than quietly deleting it is the point of this paragraph. You can object to the measurement at any time by writing to us, as section 2.6 explains. And the app gained a feedback screen, described in section 2.7: it collects nothing unless you write a message and send it, and the screen itself lists what travels with it before you do. That is the announcement this paragraph would otherwise owe you: there is no way to reach it by accident. A second form of the same kind was added at the end of August, described in section 2.8: it lets you tell us a card’s price is wrong, it sits behind the ? on that card’s price, and it too collects nothing unless you fill it in and send it. It carries more than the feedback screen does, because a price we cannot reproduce is a price we cannot fix, and section 2.8 lists every field of it.
Questions about this policy, or about your data: logbook.ugc@gmail.com.