Privacy Policy
Last updated: September 14, 2026
This Privacy Policy explains how Grailry (“Grailry,” “we,” “us”) collects, uses, and shares information when you use the Grailry mobile app and related services (the “Service”). By using the Service you agree to this Policy.
Your vault is private until you turn on a share page. We do not sell your data, we do not run third-party ad tracking, no photograph you scan is kept or used to train a model, and you can export or delete everything from inside the app.
1. Information we collect
- Account information. When you create an account we store an email address (or, for guest accounts, an anonymous identifier) and authentication data. You may sign in with Apple or Google, which provides us a basic identifier.
- Collection data. The cards you add to your vault, including card identity, condition, your optional purchase price or own value, and valuation history; the cards on your wishlist.
- Card images. When you scan a card, the photo is sent to our servers and to the card-recognition provider listed in section 3, and is discarded as soon as the reply comes back. We keep the identification result — card name, set, and your confirmation — not the photograph. It is never used to train a model, ours or anyone else’s, and never to identify you.
- Purchase data. If you subscribe to Grailry Plus, our payments provider records the transaction and entitlement status. We do not receive or store your full payment card number — that is handled by Apple or Google.
- Usage & device data. Basic app analytics (which features are used, conversion events) and crash diagnostics to keep the app working. We do not collect location data.
- Messages. If you use in-app chat (support, community channels, or direct messages), we store those messages — text and any photo, video or voice recording you attach — to deliver the feature and for safety moderation. Messages you send to the in-app assistant are processed by the AI provider in section 3.
2. How we use information
- To provide the core features: identifying cards, valuing your collection, syncing your vault, and processing purchases.
- To operate gamification (XP, quests, leaderboards) and optional public vault sharing — sharing is off by default and only enabled when you opt in.
- To send you notifications you have enabled, such as price-drop alerts.
- To keep the Service secure, prevent abuse, and comply with law.
- To understand and improve the product through aggregate analytics.
We do not sell your personal information.
3. Who else touches it
The complete list of processors we send anything to, and what leaves with the request.
| Processor | What for, and what we send | Where |
|---|---|---|
| AI provider | Reads the card in a scan photo, and answers the in-app assistant. For a scan: the photo and nothing else. For the assistant: your messages to it and a summary of your vault and wishlist. Never your name or email. | US |
| Managed database, authentication and file-storage host | Hosts the database, sign-in and the private media buckets. Everything in your account. | Australia |
| Crash and error-reporting service | Crash reports. A stack trace, the app version and an account id — no vault contents. | EU (Germany) |
| Product analytics service | Which features are used and conversion events, against an account id. No vault contents, no messages. | EU |
| Transactional email provider | Sends sign-in, confirmation and product email. Your address and the message. | Japan |
| App store billing and push providers | Bill Plus and deliver push. They hold the payment details; we never see a card number. | US |
| Pricing sources | Third-party card catalogue and market-price providers. We ask them about cards, never about you — no personal data leaves with the request. | US |
4. How long we keep it
| What | How long |
|---|---|
| The photograph you scan | Not kept at all |
| A photo you save as a card’s face | Until you delete the card |
| A photo, video or voice recording attached to a message | Until you delete the message or your account |
| A photo attached to a support message | Until the report is closed |
| Your account, vault and price history | Until you delete the account |
| Support and feedback threads | 24 months |
| Crash reports and error traces | 90 days |
| Encrypted backups, after a deletion | Expire within 30 days |
5. Deleting your account
You can delete your account at any time from Settings → Account in the app. It is immediate: your profile, vault and associated data are erased at once, and everything in the table above goes with them, except the encrypted backup copies, which expire on the schedule in that last row. Abandoned empty guest accounts are purged automatically. If you cannot get into the app, contact privacy@grailry.com and we will confirm by email before erasing anything.
6. Your rights
Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise most of these in-app, or email privacy@grailry.com. We will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data protection authority.
7. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.
8. Security
We use industry-standard measures including encryption in transit, row-level access controls so you can only access your own data, and least-privilege server access. No method of transmission or storage is 100% secure, but we work to protect your data.
9. International transfers
Your information may be processed in countries other than your own — the processors in section 3 are in Australia, Japan, the European Union and the United States. Where required, we rely on appropriate safeguards for such transfers.
10. Changes
We may update this Policy. We will post the new version here with an updated date and, for material changes, notify you in-app.
11. Contact
Questions about this Policy? Email privacy@grailry.com.