Privacy Policy
Effective 2026-08-18
OWNED is operated by Eros Media LLC, 1000 Brickell Ave, Suite 715, Miami, FL 33131 (“OWNED”, “we”, “us”).
This policy explains what we collect, why, who else sees it, and what you can do about it. We have tried to write it so that it describes this software, rather than describing a category of software.
1. The short version
- You photograph a card. We send that photo to an AI service to read what card it is. We do not keep the photo.
- We keep your email address, the cards you save, and counters that stop the service being abused.
- We do not run advertising, analytics, or trackers, and we do not sell your information.
- You can export everything you have saved at any time, and delete all of it.
Detail follows. Where something is a limitation rather than a feature, we have said so rather than leaving it out.
2. Where OWNED came from
We acquired this software from a different company that ran a Pokémon card business. No user data came with it. OWNED starts with an empty database. Nobody’s account, collection, or email address was carried over, and no information about you exists here unless you gave it to us yourself.
3. Card photographs
What happens. When you scan a card, your device sends the photograph to us, and we immediately send it to OpenRouter to identify the card. What comes back is text — the card’s name, set, number, and any grader label it can read. We keep that text. We do not store the photograph in our database, in our record of your scan, or in the holding we create when you save the card.
How OpenRouter handles it. OpenRouter is a routing service: it selects an artificial-intelligence model provider to handle each request, and may use different providers at different times. Those providers process the image on OpenRouter’s behalf and act as our subprocessors. OpenRouter publishes the providers it uses and their data policies, and we configure our account to restrict routing to providers whose terms are consistent with this policy.
What they do with it. OpenRouter selects a model provider for each request, and that provider handles your photograph under its own retention policy. Our account is configured so that no provider may use what we send to train its models. We do not require providers that guarantee zero retention, so an image may be held for a period before deletion. We do not keep the photograph ourselves, and we do not send your account or your identity with it.
What else might be in the photo. We ask for a picture of a card, and our system is built to read cards only. But a photograph captures whatever you point the camera at — your hand, your desk, whatever is behind the card. We do not detect, remove, or analyse anything other than the card. Please frame the card and not something you would rather not share.
Your control. Scanning is always something you start. The app never opens your camera on page load, and nothing is sent until you explicitly choose a photo or press the capture button.
4. What else we collect
Your account
Your email address, and whether you are signed in. We sign you in with a link emailed to you.
Your collection
The cards you save: which card, how many, what condition, when you added it, and optionally what you paid. This is your record of things you own, and we treat it that way.
Operational data
| What | Why |
|---|---|
| Whether a scan succeeded, which model ran, roughly how large the image was, what it cost us | Keeping the service running and affordable |
| Rate-limit counters keyed to your IP address | Stopping automated abuse |
| A guest-scan counter | Giving you one scan before you make an account |
| Your answer to “Is this the right card?” | Measuring how accurate our identification is |
- The guest counter does not store your IP address. It stores a one-way cryptographic hash of it. We can tell that the same visitor came back; we cannot read the address out of it.
- Scan feedback is anonymous. When you tell us we got a card wrong, we store the verdict and which card we showed you. We do not attach your account, your IP, or the image.
5. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
owned_session | Keeps you signed in | Session-based, HttpOnly |
owned_guest_v1 | Tracks your one free guest scan | 30 days, HttpOnly, opaque random value |
We do not run analytics, advertising pixels, or third-party trackers. There is no advertising network in this product.
6. Who else sees your data
| Who | What they do | What they see |
|---|---|---|
| Google Cloud | Hosts the service and stores our data | Everything we store |
| OpenRouter | Routes your card photographs to a model provider it selects | The photograph, and the text extracted from it |
| Model providers OpenRouter selects | Read your card photographs on OpenRouter’s behalf | The photograph, and the text extracted from it |
| Cloudflare | Delivers and protects the site | Traffic in transit, including your IP address |
| Resend | Sends sign-in emails | Your email address |
| TCGplayer, eBay | Marketplaces we link to | Only what your browser sends them if you click through |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Where your data is processed. the United States
7. How long we keep things
| What | How long |
|---|---|
| Card photographs | Not stored by us at all |
| Your account and collection | Until you delete it |
| Save records that stop duplicate entries | 30 days |
| Guest scan counters | 30 days |
| “Is this the right card?” answers | 180 days |
| Rate-limit counters | Minutes to 24 hours |
8. Your choices
Export. You can download your entire collection as CSV or JSON at any time, from your collection page. It is your data and it leaves in a format you can use somewhere else.
Correct. You can edit or remove any card in your collection.
Delete your account. You can delete your account and everything in it from your account settings. We show you exactly what will be removed first, and point you at the export — deletion is immediate and we cannot undo it.
We keep nothing after a deletion request.
Sign-in email. We only email you for sign-in and essential service notices unless you opt in to more.
How to reach us. support@owned.app
9. Children
You must be at least 13 to have an OWNED account. We ask for your date of birth when you sign up.
We do not keep your date of birth. We use it to work out whether you meet the minimum age, store only the answer and the date we checked, and discard the rest. If you are under the minimum we do not create an account and we keep nothing about you at all.
This is an age check, not age verification — we cannot confirm what you enter.
10. Security
Sessions are signed. Administrative access requires both an allowlisted address and a verified session, and the admin surface is disabled rather than open when that allowlist is unset. Credentials live in Google Secret Manager, not in configuration files. Our database is not directly reachable by any client; every read and write goes through our server.
No system is perfectly secure, and we will tell you if something happens that affects you.
11. Changes
If we change this policy materially, we will say so here and update the date. If the change affects how we handle card photographs, we will tell you directly rather than only updating this page.
12. Contact
Eros Media LLC, 1000 Brickell Ave, Suite 715, Miami, FL 33131. Privacy enquiries: support@owned.app.
See also our Terms of Service.