How HitoTCG handles your data
Effective date: May 29, 2026
Short version: HitoTCG is designed to be local-first. You do not need an account to use the app. Your collection, decks, scan history, notes, purchase prices, and most settings are stored on your device. Card scanning is processed on your device and we do not upload your camera images for identification. We collect limited data needed to deliver catalog updates, purchases, support, security, and optional price alerts.
1. Who we are
HitoTCG ("Hito", "we", "us", or "our") provides a mobile app and website for scanning, organizing, valuing, and building decks for One Piece Card Game collections. For privacy questions or data requests, contact us at [email protected].
2. Scope
This Privacy Policy applies to the Hito mobile apps for iOS and Android, the HitoTCG website, and our backend services, including catalog sync and optional price alerts. Third-party stores, purchase providers, push notification providers, card data providers, and linked websites have their own privacy practices.
3. Information stored on your device
The app stores the following information locally on your device so the app can work offline and without an account:
- Collection entries, including card IDs, variants, quantities, folders, condition, language, purchase price, purchase date, grading details, notes, and added date.
- Decks, deck names, leaders, cards, quantities, colors, and deck notes.
- Portfolio snapshots and value calculations generated from your local collection and catalog prices.
- Scan queue and scan tracking data, such as cards identified during scanning and scan limits for free or paid access.
- App settings, including currency, language, onboarding status, and cached catalog metadata.
- Cached card images and catalog data used for faster loading and offline access.
Local app data stays on your device unless you choose to export it, include it in a support request, restore it through device-level backup features, or use a feature that specifically sends data to us, such as price alerts.
4. Camera and photo access
Hito asks for camera access so you can scan trading cards. The scanner uses on-device recognition, text extraction, and card matching to identify cards. We do not upload camera frames or photos to our servers for card identification.
If you grant photo library access to import card images where available, the selected image is used for the feature you requested. We do not receive your photo library or upload imported images for scanner matching.
5. Information sent to us
| Feature | Information processed | Purpose |
|---|---|---|
| Catalog and price sync | Current catalog version, request metadata such as IP address, user agent, timestamps, and device/network technical data processed by our hosting infrastructure. | Provide card catalog updates, prices, images, hashes, and sealed product data; operate, secure, debug, and rate-limit the service. |
| Optional price alerts | Device push token, platform, variant ID, target price, alert direction, creation time, and related technical request metadata. | Register your device for price notifications and send alerts when a watched card crosses your target. |
| Purchases | Purchase entitlement status, product identifiers, transaction receipts or purchase tokens handled by the App Store, Google Play, and RevenueCat. We do not receive your full payment card number. | Unlock paid features, validate purchases, restore purchases, prevent fraud, and provide customer support. |
| Support | Email address, message content, attachments, and any app data or screenshots you choose to send us. | Respond to support requests, troubleshoot issues, and maintain service quality. |
| Website | Technical request data processed by our hosting provider. The website also loads Google Fonts, which may cause your browser to send technical request data to Google. | Deliver the website, keep it secure, and render the site typography. |
6. Information we do not collect for advertising
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not run third-party advertising SDKs in the app. We do not currently use Firebase Crashlytics, Google Analytics, Meta SDK, AppsFlyer, Adjust, Mixpanel, Amplitude, PostHog, or similar advertising or analytics SDKs in the mobile app.
7. App permissions
| Permission | Why it is used |
|---|---|
| Camera | To scan and identify trading cards on your device. |
| Internet | To download catalog and price updates, load card images, validate purchases, contact support links, and manage optional price alerts. |
| Notifications, where requested by the operating system | To deliver optional price alerts. You can disable notifications in your device settings. |
| Photos, where requested | To let you choose images for import or scanner-related features, if available. |
8. Legal bases for EEA, UK, and Swiss users
| Purpose | Legal basis |
|---|---|
| Provide the app, catalog sync, local collection features, deck tools, import/export, and support for offline use. | Performance of a contract with you, or steps taken at your request before entering into a contract. |
| Validate purchases, restore purchases, and manage paid access. | Performance of a contract; compliance with legal obligations for tax, accounting, fraud prevention, and consumer protection where applicable. |
| Send optional price alerts and register push tokens. | Performance of a contract for a requested feature; consent where required for notifications. |
| Respond to support messages. | Performance of a contract or legitimate interests in helping users and improving the service. |
| Security, abuse prevention, rate limiting, diagnostics, and service reliability. | Legitimate interests in protecting users, the app, and our services. |
| Comply with legal requests and enforce legal terms. | Compliance with legal obligations and legitimate interests. |
9. Service providers and third parties
We use service providers and platform services to operate Hito. These may include:
- Apple App Store and Google Play for app distribution, in-app purchases, subscriptions, refunds, and store account controls.
- RevenueCat for purchase validation, entitlement management, and purchase support.
- Apple Push Notification service and Firebase Cloud Messaging, where configured, to deliver optional price alert notifications.
- Hosting, database, infrastructure, and email providers for our website, API, catalog snapshots, security, and support.
- Card catalog, image, and market data providers, such as TCGplayer-linked data sources, OPTCG data sources, or similar providers. Card images may be loaded from third-party image URLs in the catalog, and those hosts may receive technical request data from your device.
- Google Fonts for website font delivery.
We require service providers to process information only as needed to provide their services to us, subject to their own legal obligations and terms.
10. International transfers
We may process information in countries other than your country of residence, including the United States and countries where our providers operate. Where GDPR, UK GDPR, Swiss data protection law, or similar laws require safeguards for international transfers, we rely on appropriate mechanisms such as standard contractual clauses, adequacy decisions, or other lawful transfer safeguards where available.
11. Retention
- Local app data remains on your device until you delete it in the app, clear app data, delete the app, or delete device backups that contain it.
- Price alert records and device push tokens are retained while needed to provide alerts, until you delete related alerts, disable the feature where available, request deletion, or the data is no longer needed.
- Purchase and entitlement records are retained as needed to provide paid access, restore purchases, resolve disputes, prevent fraud, and meet legal, tax, and accounting requirements.
- Support messages are retained as long as reasonably needed to respond, maintain support history, improve the service, and handle legal or security obligations.
- Security logs and rate-limiting data are retained for a limited period appropriate to protect and operate the service, unless longer retention is needed for abuse prevention, legal compliance, or dispute resolution.
12. Your choices
- You can use Hito without creating an account.
- You can deny or revoke camera permission in your device settings. Scanning will not work without camera access.
- You can disable notifications in your device settings or delete price alerts in the app where available.
- You can delete local collection, deck, and price alert data in the app where deletion tools are available, or by clearing app data or uninstalling the app.
- You can export collection data with the app's CSV export feature where available.
- You can contact us at [email protected] to request access, deletion, correction, or other privacy help for personal information we process on our servers.
13. GDPR, UK GDPR, and Swiss privacy rights
Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing of your personal information, and the right to data portability. Where processing is based on consent, you may withdraw consent at any time. You also may have the right to complain to your local data protection authority.
Because Hito is local-first and does not require accounts, we may need information such as your device push token, purchase support details, support email address, or other identifiers you provide to locate server-side records connected to you.
14. California and other U.S. state privacy rights
This section is intended to serve as our California Notice at Collection and state privacy disclosure where applicable.
| Category | Examples | Purpose |
|---|---|---|
| Identifiers | Email address if you contact support, device push token for price alerts, IP address and online identifiers in server requests. | Support, alerts, security, fraud prevention, and service delivery. |
| Commercial information | App purchase and entitlement information from stores and RevenueCat. Your collection purchase prices are stored locally unless you send them to us. | Paid access, purchase restoration, support, accounting, and fraud prevention. |
| Internet or electronic network activity | Website and API request metadata, catalog sync requests, technical logs, and interactions with linked card image hosts. | Operate, secure, maintain, and improve the service. |
| Approximate location | Approximate region inferred from IP address by hosting or security providers. We do not collect precise GPS location. | Security, fraud prevention, regional compliance, and service operation. |
| User-provided content | Support messages, attachments, or screenshots you choose to send us. | Support and troubleshooting. |
| Sensitive personal information | We do not intentionally collect sensitive personal information as defined by California law. We do not use sensitive personal information to infer characteristics. | Not applicable. |
We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of users under 16. We will not discriminate against you for exercising privacy rights.
California residents and users in other U.S. states with applicable privacy rights may request to know, access, delete, correct, or receive a portable copy of personal information we process about them, subject to legal exceptions. To make a request, email [email protected]. We may need to verify your request before responding.
15. Children
Hito is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it. Users under the age required by their country or app store rules should use Hito only with permission from a parent or guardian.
16. Security
We use reasonable technical and organizational measures designed to protect information processed by our services, including transport security for network requests, limited collection, local-first storage, rate limiting, and restricted backend data use. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
17. Changes
We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users, such as updating this page, changing the effective date, or providing an in-app notice where appropriate.
18. Contact
For privacy requests or questions, contact [email protected].
Hito is an unofficial companion app and is not affiliated with, endorsed by, or sponsored by Bandai Namco Entertainment, Toei Animation, Eiichiro Oda, Shueisha, or TCGplayer.