This page explains what PokeSlab collects, why, and who else handles it. The short version: an email address to sign you in, the reports you save, and anonymous page statistics. We don't store your card photos and we don't sell data.
Who is responsible
The controller is Alexandros Kougentakos, trading as Mytikas, Dudenweg 7, 22117 Hamburg, Germany, reachable at hello@pokeslab.app. See the imprint.
What we collect
Your account
Your email address, and your name and Google account ID if you sign in with Google. We need these to run your account (GDPR article 6(1)(b)). They stay until you delete the account.
Reports
For each report we keep the card we matched, the centering measurements, the condition notes, the grade estimate and the prices used. Not the photo. Reports stay until you delete them or your account.
Card photos
The centering checker runs in your browser; its photos never reach us. When you ask for a full report, the photo goes through our server to Anthropic, whose Claude model reads the card. We don't save it. Anthropic processes it as our processor, doesn't train on it, and deletes it after a short retention period under its commercial terms.
Payments
Stripe handles card details; we never see them. We keep the Stripe customer ID, your plan, its renewal date and your credit balance. Stripe keeps payment records as the law requires.
Statistics
We count page views and a few product events (such as “report finished”) with PostHog, hosted in the EU, in cookieless mode. No cookies or local storage are used for this and you aren't identified across visits. Our legitimate interest in knowing which pages work is the basis (article 6(1)(f)).
Server logs and abuse limits
Our host keeps standard request logs for a short time. To stop abuse we count sign-in emails per address and per IP address for an hour.
Cookies
One cookie, ps_session, keeps you signed in for 30 days. A second one, ps_in, only tells the page to show “Account” instead of “Sign in”. During Google sign-in, three short-lived cookies (10 minutes) protect the login. All are strictly necessary, so there is no consent banner. A draft of an unfinished scan can sit in your browser's storage for up to a day so it survives the sign-in step; it never leaves your device.
Who else handles data
- Anthropic (card reading), United States
- Stripe (payments), Ireland and United States
- Resend (sign-in emails), United States
- PostHog (statistics), EU
- Cloudflare (hosting, database in Western Europe, email forwarding), EU and United States
- Google, only if you choose Google sign-in
Transfers to the United States rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can see, correct, export or delete your data, object to processing and restrict it. Deleting your account from the account page removes your account and reports immediately. For anything else, write to hello@pokeslab.app; we answer within a month. You can also complain to the Hamburg Commissioner for Data Protection and Freedom of Information (datenschutz-hamburg.de) or the authority where you live.
Changes
If this page changes in a way that matters, we'll say so on the site and, for account holders, by email.