Vendr privacy policy
Last updated: 4 October 2026
Vendr is a collection, pricing and trading app for Pokémon and One Piece cards. It is run from Greece ("we"). Questions about your data go to support@vendr.pro.
Without an account
Your collection, binders, lists, deals and watchlist are stored only on your phone. To show prices, the app asks our servers for card and price data. Like any web request, these carry your IP address, which our hosting provider keeps in technical logs for up to 7 days to keep the service secure.
If you set a price alert, we store your phone's push notification token, the card and your target price so we can notify you. Clearing the alert or unwatching the card removes the target.
Vendr has no ads, no analytics and no tracking across apps.
With an account
Accounts are optional. When you create one, we process:
| Data | Why |
|---|---|
| Your Apple or Google account identifier and the email it shares (Apple can give a private relay address), or the email address you sign in with by code | To sign you in. We never see your Apple or Google password. |
| Handle, avatar card and, if you add it, your country | Your public profile |
| Collection, binders, lists, deals, watchlist and settings | To back them up and sync them between your devices |
| Trade binder and wants | To show them to other collectors, as you choose |
| Offers, counter-offers, trade messages, shipping status and ratings | To run trades between you and other collectors |
| Follows and blocks | To show people you follow and keep blocked people away from you |
| Push tokens for your devices | To notify you about offers, messages and price alerts |
| Reports you make or receive, and moderation decisions | To keep the community safe |
Who can see what
- Everyone signed in: your profile (handle, avatar card, country if you add it, member since, completed trades and rating), your trade binder and your wants, unless you limit them to followers or hide them.
- Only you: the rest of your collection (unless you open it to followers or everyone), what it's worth, what you paid, your vendor deals, lists and watchlist.
- The two people in a trade: the offers, their versions, the trade chat and the shipping status.
- People you block see nothing of yours and can't contact you.
Legal bases
- Running your account, sync, profile and trades: performance of our contract with you (GDPR Art. 6(1)(b)).
- Security, preventing fraud and abuse, and handling reports: our legitimate interest in a safe service (Art. 6(1)(f)).
- Push notifications: your consent, given and withdrawn in iOS Settings.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, sign-in, server functions | Stored in the EU (Frankfurt, Germany) |
| Resend | Sending sign-in codes by email | EU sending region; the company is in the United States |
| Expo (650 Industries) | Delivering app updates; sees your IP address when an update downloads | United States |
| Apple | Push notifications, TestFlight and App Store distribution | Global |
When you sign in with Apple or Google, they handle that step under their own privacy policies and tell us only who you are.
Supabase Pte. Ltd. is bound by the EU Standard Contractual Clauses. Resend and Expo are certified under the EU–US Data Privacy Framework and also use the Standard Contractual Clauses.
The services our prices come from (Cardmarket data via TCGGo, TCGdex, eBay and others) receive no personal data from you.
How long we keep it
- Account data: until you delete your account.
- When you delete your account: your profile, collection, lists, deals, watchlist, follows, blocks, push tokens and the trade messages you wrote are deleted. Trades you completed stay visible to the other person, with your name replaced by "deleted collector", because they are part of that person's history too.
- Reports and moderation decisions: up to 12 months, then deleted.
- Technical logs: up to 7 days.
Your rights
You can:
- See and take your data. Account → Export collection gives you a copy at any time. For everything else, email us.
- Correct it. Most of it you can edit in the app.
- Delete it. Account → Delete account removes it immediately.
- Object, restrict or ask anything else. Email support@vendr.pro. We answer within one month.
- Complain. You can complain to the data protection authority where you live, or to ours: the Hellenic Data Protection Authority (dpa.gr).
Age
Accounts are for people aged 16 and over. Mail trades with other collectors are for people aged 18 and over.
Changes
If this policy changes in a way that matters, the app will tell you before the change applies.