Contents
1 Overview
CardKick ("we", "our", or "us") operates the World Soccer Cardbin (WSCB) mobile application (the "App"). We are committed to protecting your privacy and being transparent about the very limited data our App touches.
WSCB is designed with a privacy-first approach: no user account or registration is required to use the App. You do not need to provide a name, email address, or any personally identifiable information to access the App's core features.
2 Information We Collect
2.1 Information You Provide
WSCB does not require you to create an account, log in, or submit any personal information. You may optionally use your device's camera or photo library to add images to your card collection. Those images remain on your device and are not transmitted to our servers.
2.2 Automatically Collected Data (Analytics)
We may collect anonymous, aggregated usage analytics to understand how the App is used and to improve its performance. This data does not identify you personally and may include:
- App session frequency and duration
- Feature usage patterns (e.g., which screens are visited most)
- Crash reports and error logs
- Device type, operating system version, and app version
- General country-level location (not precise GPS)
2.3 Purchase Information
If you purchase the one-time Pro upgrade, the transaction is processed entirely by Apple App Store or Google Play. CardKick does not receive or store your payment card number, billing address, or other financial information. We receive only a confirmation that a purchase was made, via our payment management provider RevenueCat.
2.4 Information We Do NOT Collect
3 How We Use Information
| Data | Purpose | Legal Basis (GDPR) |
|---|---|---|
| Anonymous analytics | Improve App performance and user experience | Legitimate interest |
| Crash/error logs | Identify and fix bugs | Legitimate interest |
| Purchase confirmation | Unlock Pro features; prevent fraud | Performance of contract |
| Device permissions (camera/photos) | Allow you to add card images (opt-in only) | Consent |
We do not use your data for targeted advertising or to build individual profiles.
4 Third-Party Services
The App integrates the following third-party services. Each service operates under its own privacy policy:
4.1 eBay API
WSCB connects to the eBay API to retrieve publicly available football card listings and price data. This connection is read-only. No personal data about you is sent to eBay through the App; only anonymous requests for card data are made. eBay may log API call metadata (e.g., IP address) in accordance with their own policy.
eBay's Privacy Notice: ebay.com/help/policies/privacy-policy
4.2 RevenueCat
We use RevenueCat to manage in-app purchase entitlements (e.g., tracking whether you have purchased the Pro upgrade). RevenueCat may receive an anonymous app-user identifier and purchase receipt data from Apple/Google. This information is used solely to manage subscription and purchase status.
RevenueCat's Privacy Policy: revenuecat.com/privacy
4.3 Apple App Store / Google Play
When you download the App or make an in-app purchase, Apple or Google collects data according to their respective privacy policies. CardKick has no control over that data collection.
5 Device Permissions
| Permission | Why Requested | Required? |
|---|---|---|
| Camera | Allows you to photograph a card and add it to your collection | Optional |
| Photo Library | Allows you to select an existing photo to attach to a card | Optional |
| Network access | Required to fetch card listing data from the eBay API | Yes (for live data) |
You may revoke optional permissions at any time via your device's Settings. Revoking camera or photo access does not affect your ability to use the core features of the App.
7 Data Retention & Deletion
Because we do not collect personally identifiable information, there is no personal data account to delete. Your local card collection data is stored entirely on your device and is removed when you uninstall the App.
Anonymous analytics data is retained in aggregated, non-identifiable form for up to 24 months for trend analysis, after which it is automatically deleted or anonymised further.
If you believe we hold any personal data about you and wish to request its deletion, please contact us at the address in Section 13. We will respond within 30 days (or within the timeframe required by applicable law).
8 Children's Privacy
WSCB is not directed at children under the age of 13 (or under 16 where required by applicable law, such as in certain EU member states). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, please contact us immediately at cardkick.wscb@gmail.com and we will take steps to delete such information promptly.
Parents and guardians who discover their child has accessed the App without consent should contact us via the details in Section 13.
9 GDPR Rights (EU / EEA Users)
If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):
- Right of Access – Request a copy of any personal data we hold about you.
- Right to Rectification – Request correction of inaccurate data.
- Right to Erasure – Request deletion of your personal data ("right to be forgotten").
- Right to Restriction – Request that we limit processing of your data in certain circumstances.
- Right to Data Portability – Request a machine-readable copy of your data.
- Right to Object – Object to processing based on legitimate interest.
- Right to Withdraw Consent – Where processing is based on consent, you may withdraw at any time.
Given that we collect no personal data that links back to you individually, most of these rights will be fulfilled by confirming that we hold no such information. We will respond to all verified requests within 30 days.
You also have the right to lodge a complaint with your national data protection authority (supervisory authority) at any time.
10 CCPA / CPRA Rights (California Users)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights:
- Right to Know – Request disclosure of personal information collected, used, disclosed, or sold.
- Right to Delete – Request deletion of personal information we have collected.
- Right to Correct – Request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing – We do not sell or share personal information, so this right is satisfied by default.
- Right to Non-Discrimination – We will not discriminate against you for exercising your rights.
To exercise your CCPA rights, contact us at cardkick.wscb@gmail.com. We will acknowledge your request within 10 business days and respond within 45 calendar days (extendable by a further 45 days with notice).
Because we do not collect personal information as defined under CCPA (no names, emails, or persistent identifiers linked to individuals), your rights are largely satisfied by our data-minimisation practices.
11 Security
We implement commercially reasonable technical and organizational measures to protect any data processed through the App, including:
- Encrypted data transmission over HTTPS/TLS
- Anonymization of analytics data before storage
- Access controls limiting who can access backend systems
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect data, we cannot guarantee absolute security.
12 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of the page and, where changes are material, notify users via an in-app notice or an update note in the App Store/Play Store listing.
Continued use of the App after any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.
13 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your privacy rights, please contact us:
We aim to respond to all privacy-related enquiries within 30 days.