Privacy Policy
Sleeved — trading card game collection tracker. Last updated 5 August 2026.
Sleeved is a companion app for trading card game players: it tracks the cards you own, the decks you
build, the cards you want, and the trades you agree with other players. This policy explains exactly
what it stores and what it does not. It is written to describe the app as it actually behaves.
What is stored about you
Only what an account needs in order to work:
- Account — your username, your email address, and a password that is stored only
as a PBKDF2 hash, never as text anyone can read. If you sign in with Google or a passkey instead,
an identifier for that sign-in method is stored in place of a password.
- What you record in the app — your collection, decks, wishlist, folders, and
trades.
- Preferences — display currency, card-art language, and who may see your
collection and wishlist.
- Push token — if you allow notifications, a device token so a notification can
reach your device. See below for what it is used for.
What is never collected
- Photos of your cards. The card scanner works entirely on your device: the app
downloads a small index of card fingerprints and matches the camera image against it locally.
Images from your camera are never uploaded and never leave your phone.
- Location, contacts, files, or your other apps. The app requests only internet
access, network state, camera, and notification permissions.
- Advertising or tracking data. There are no advertising, analytics, or
crash-reporting SDKs in the app, and none of your data is sold or shared for advertising.
Notifications
Push notifications are sent for one thing only: when another player sends you a trade offer. There
are no marketing, promotional, price-alert, or re-engagement notifications. Declining the
notification permission does not restrict any other part of the app.
What other people can see
Your collection and wishlist are private by default. You choose, per list, whether
to keep them private, share them with signed-in users, or make them public; you can change or revoke
that at any time in Settings. When you send or accept a trade, the other party sees your username
and the cards involved in that trade.
Services the app relies on
- Google Firebase Cloud Messaging delivers push notifications. Google handles the
device token and the message in transit.
- Sign in with Google, only if you choose it, so Google can confirm who you are.
- Cardmarket supplies the market prices shown in the app. Price data is fetched
to the server on a schedule; nothing about you is sent to them.
Keeping and deleting your data
Your data is kept while your account exists. You can delete your account from the app or the
website, which removes your account and the collection, decks, wishlist and trade records attached
to it. Signing out of a device removes that device's push token.
Sleeved is not directed at children, and no account is knowingly created for a child under 13.
Contact
For any question about this policy, or to ask what is held about your account, contact
dudedbz@gmail.com.