Privacy Policy
Last updated: October 21, 2026
Dekvi ("we", "us" or "our") operates the Dekvi mobile application and related services. This policy explains how we process information when you identify trading cards, review reference prices or condition insights, organize a collection, use PackLens or the AI card assistant, sign in, subscribe, or contact us. Contact us at hi@dekvi.app.
Card recognition and AI features use cloud processing. Your selected photos, messages and necessary card or report context are sent to our service and external processing services. We also keep our own operational data and backups. Passing a request through our service does not mean the information stays only on your device.
1. Information we process
- Account information: an email address when you choose email sign-in; a nickname or avatar you provide; authentication provider identifiers, sessions and security records. Passwords, where offered, are handled by our authentication service. Apple sign-in, where available, can supply the account information you choose to share. A guest session also has an internal identifier.
- Photos and card information: photos you capture or select for recognition, front/back condition review, PackLens, the assistant or an avatar; card identifiers, selected variants, quantities, notes, corrections, reference values and saved results.
- Assistant and feedback content: prompts, conversation messages, attached photos, card/report context, AI responses, votes, reports of a problem, and any contact information you voluntarily include.
- Service and device information: app and operating-system versions, device model, language, region and timezone, a generated installation/visitor identifier, session identifiers, network information, request metadata, diagnostics, performance and interaction information. Network requests also expose an IP address to the receiving service; an approximate region may be derived from it. The App does not request precise-location permission.
- Subscriptions: product identifiers, purchase and renewal history, transaction status and membership entitlements supplied by the app store and RevenueCat. We do not receive your full payment-card number or bank-account credentials from store purchases.
- Exports and communications: your chosen export destination email, collection data included in an export, delivery status, and messages you send to support.
The Android App sends an available advertising identifier and a Facebook anonymous identifier to RevenueCat for analytics and attribution. Android builds also include Firebase and Facebook integrations; app-instance and other identifiers are processed where those integrations operate. This is separate from the presence of ads in the App. System advertising-ID controls can limit the availability of that identifier. Our own generated visitor identifier is not the Android advertising ID.
Dekvi does not provide health, medical or fitness tracking features or request access to health data. Do not submit unnecessary sensitive personal information in photos, notes or prompts.
2. Why we use information
We use information to provide identification, reference market data, condition insights, PackLens, conversations, collection backup/synchronization and exports; manage guest and registered accounts; verify purchases and restore entitlements; respond to support and content reports; diagnose failures and improve performance; secure the service and prevent abuse; and comply with applicable obligations. We retain request, response, result and task records to recover interrupted work and avoid duplicate submissions.
Photo uploads, formal sign-in, assistant messages and support submissions occur when you choose those features. You may use available search and browsing features without providing a card photo or creating a formal account. A guest identity and necessary technical information are still processed during normal online use. Revoking camera or photo access does not erase information already uploaded.
3. Cloud processing and other recipients
- Our services: Better Auth handles identity and sessions; our Dekvi backend handles business records. Azure Cosmos DB stores operational records, and Cloudflare R2 stores private uploads, exports and request/response or result archives used for backup and recovery.
- External card, image and AI services: selected photos, queries, messages and necessary card/report context are forwarded to processing services to return recognition, reference data or AI answers. These services may keep their own records under their applicable terms and policies. We cannot describe an unconfirmed upstream deletion as completed.
- App stores and RevenueCat: Apple or Google handles store payment, and RevenueCat processes purchase history, app-user identifiers and entitlement information. A configured network proxy may carry RevenueCat requests. Store and subscription providers have their own records and retention obligations.
- Diagnostics and integrations: Sentry receives error and performance data and an internal user identifier. Our App configuration disables automatic screenshots, view hierarchies and log collection and filters sensitive fields in supported events. This does not mean all diagnostic or network data is anonymous or that receiving services cannot process an IP address. Firebase/Facebook integrations, where operating, process analytics or attribution information according to the relevant configuration and provider practices.
- Email, hosting and support providers: information needed to send authentication messages, deliver a requested export, host the service or answer a support request may be processed by providers assisting us.
We may disclose information when necessary to comply with law, protect users and the service, or complete a genuine reorganization or transfer of the business, subject to applicable protections. We do not sell your personal information. We do not present card photos or private assistant conversations as a public social feed.
When you use the system share sheet or follow an external link such as a card marketplace, you choose to interact with another application or website. Its handling of information is governed by its own policies.
4. Storage and security
Our services and providers may process information outside your country, including in the United States and other regions. Storage and processing are not limited to Asia or to your device. Where applicable, international transfers are subject to the safeguards required by law.
Our online service endpoints use HTTPS. We apply access controls and other reasonable safeguards, but no system guarantees absolute security. Transport protection is not end-to-end encryption: the receiving services must process the information, and our operational backup system retains applicable records.
5. Account deletion and retention
You can request account deletion in Settings → Account → Delete account or at https://ac.dekvi.app/delete-account. The website uses normal account authentication and confirmation. If you cannot sign in, contact hi@dekvi.app from your registered email so that we can verify the request; providing another person's email is not sufficient authorization.
After a verified request is accepted, the account and its merged guest identities are disabled, private-media access is blocked and new business work is refused. A durable background process cancels queued work. It waits at least 15 minutes for in-flight work and then removes owned private database records, uploaded photos, exports, task inputs/results and related archives in batches. We aim to complete our own cleanup within 24 hours; temporary service failures may require retries. Acknowledgment of a request is not a guarantee that every cleanup stage has already finished.
| Record | Deletion / retention handling |
|---|---|
| Account-linked private business data | Kept as needed to operate your account and requested features; removed through the verified account-deletion process, including its private backup objects. Removing a history item is not the same as deleting the account and every archive. |
| Business cleanup completion receipt | A random receipt without the account's plain identifiers is kept for 7 days after completion, then scheduled for cleanup. |
| Token-revocation record | A keyed HMAC value and limited status/time data, without a plain email, business owner ID or original authentication subject, is kept for up to 181 days to reject old tokens. It is not used to restore the account. |
| Authentication deletion-recovery receipt | After authentication deletion completes, the stored user association is removed. A random operation ID, status and times support recovery after a lost response. The existing cleanup threshold is 400 days and is applied during later successful deletion processing; this is not a guaranteed 400-day hard expiry. |
| Upstream deletion retry | If an existing external processing account can be addressed, we request deletion using its original identity. A failure does not stop our own cleanup. Only credentials needed to retry that request are kept for at most 30 days; if completion cannot be confirmed, those credentials are removed and the outcome remains unconfirmed. |
| Public/shared data and independent third-party records | Shared card catalogs, public articles/prices and other users' records are not erased by your account request. App stores, RevenueCat and diagnostic/processing providers may retain independent records under their policies or legal duties; our own database cleanup does not certify their physical deletion. |
Only information reasonably necessary for a specific legal, security or deletion-recovery purpose is retained for that purpose. If an applicable obligation requires additional retention, we limit the affected information and explain the relevant exception when required.
Deleting an account does not cancel an Apple or Google Play subscription. Manage renewal and cancellation through the store that billed you. Store refund and payment records are handled under the store's policies.
6. Your choices and rights
You can choose whether to upload a photo, send an assistant message, register, change your profile, subscribe or provide optional contact information. Device settings control camera, selected-photo and notification access and available advertising-ID settings. Necessary authentication, subscription verification and diagnostics do not currently have a separate App-wide opt-out switch.
Depending on your location, you may have rights to access, correct, export, delete or restrict certain information, object to processing, or withdraw consent where consent is the relevant basis. Contact hi@dekvi.app. We may verify identity before acting. Where applicable, you may complain to your local data-protection authority. Exercising a right does not remove obligations or rights that applicable law requires us to preserve.
7. Age and younger users
Dekvi is intended for users aged 13 and over, including teenagers and adults. If you are below the legal age of majority in your location, use the service with your parent or guardian's permission where applicable law requires it.
The service is not intended for children under 13. If we learn that we have processed information from a child below the permitted age without an applicable legal basis or required authorization, we will take appropriate steps, including restricting use or deleting the affected information. Parents or guardians may contact hi@dekvi.app. Age-related permissions and rights may differ by country.
8. Changes and contact
We may update this policy as the service or our practices change. The date above identifies the current version. We will provide additional notice where required. For privacy, access or deletion requests, email hi@dekvi.app.