Privacy Policy

TAS is operated by TAS. We decide how and why the personal data described here is used, and you can reach us at kyleyeung6@gmail.com about anything in this policy.

Your browser finds the card in each photo, trims the photo to it and takes a few measurements of the image. Nothing is uploaded until you ask for a grade.

When you do, the photos and those measurements are sent to our server. The photos, and the card name if you typed one, go on to OpenRouter, which passes them to Z.ai’s GLM vision model to produce the prediction. We ask OpenRouter to use only providers that don’t retain prompts or train on them. If that route is unavailable, they go to Google’s Gemini API instead, under Google’s API terms. Our server doesn’t store the photos as part of the scan.

Google’s unpaid tier. While TAS is new it may use Google’s unpaid Gemini API tier. Under Google’s terms for that tier, Google may use what is submitted — your card photos and the card name — to improve its products, and people at Google may review it. Only photograph the card itself. We’ll remove this paragraph when TAS moves entirely to a paid tier.

If you save a card to your collection, a preview copy of the photo is stored with it so you can see it later. Deleting the card or your account deletes that copy.

TAS runs a small experimental model on its server. After each scan it learns from the scan’s numerical measurements and the resulting grades — a list of numbers, not your photo, name or email — and it doesn’t affect your grade. What it learns is shared across all users and can’t be used to identify you.

• Sign-in cookies — keep you signed in and protect the sign-in form against forgery. They’re strictly necessary, so there’s no banner for them.
• Session storage — briefly holds a scan result while you sign up, so it isn’t lost. Cleared when the tab closes.
• Security check — the sign-up and waitlist forms load Cloudflare Turnstile, which runs in its own frame to tell people from bots. It isn’t used for advertising or tracking.

We don’t use advertising cookies, analytics trackers, or cross-site tracking of any kind.

We don’t sell or rent personal data, and we don’t share it for advertising. We use these service providers to run TAS, and they process data only on our behalf:

• Vercel — hosting and serving the website.
• Supabase — database hosting: your account, scans, collection and billing status.
• Cloudflare — the Turnstile security check on the sign-up and waitlist forms, which sees your IP address and browser details to tell people from bots.
• OpenRouter — routes your card photo to the GLM vision model (by Z.ai) that produces predictions, through providers that don’t retain or train on it.
• Google — the Gemini AI model used as a backup for predictions, and Google sign-in if you choose it.
• Stripe — payments, invoices and the billing portal.
• Resend — sending waitlist emails.

Card images and folder icons load directly from the Pokémon TCG API, TCGdex and PokeAPI (via GitHub). Like any website, those services see your IP address when your browser fetches an image.

We may also disclose data if the law requires it, to protect people’s safety, or as part of a sale or reorganisation of the Service, in which case this policy continues to apply.

• Account, scans and collection — until you delete them or your account.
• IP-based counters — 24 hours.
• Waitlist entries — until you unsubscribe using the link in any waitlist email.
• Payment records — Stripe keeps invoices and payment records for as long as financial and tax law requires, even after your TAS account is deleted.

From Account settings you can:

• Export your account, scans, folders and collection as a JSON file.
• Correct your display name and change your password.
• Delete your account, which permanently removes your profile, scans, collection, folders, corrections and API keys. Cancel any paid plan first.

Depending on where you live (for example under the GDPR, UK GDPR or California law) you may also have rights to object to or restrict processing, to data portability, and to complain to a data protection authority. To exercise any right you can’t use from the account page, email kyleyeung6@gmail.com. We’ll answer within 30 days.

Where the GDPR applies, our legal bases are: performing our contract with you (running your account and plan), our legitimate interests (preventing abuse and improving predictions), and your consent where we ask for it (the waitlist).

Traffic is encrypted over HTTPS, and so is the connection between our servers and the database. Passwords are stored as salted scrypt hashes and API keys as one-way hashes, so neither can be read back — not even by us. Your data is only ever read through our own server, which checks that it belongs to you; only that server holds the database password, and the database’s public data API is switched off for every table. Card details never reach us — Stripe handles them. Changing your password signs out your other sessions. No system is perfectly secure; if we learn of a breach affecting your data, we’ll tell you as the law requires.

Our providers may process data in the United States and other countries. Where the law requires it, those transfers rely on safeguards such as the providers’ standard contractual clauses.

TAS isn’t for children under 13, and we don’t knowingly collect their data. If you believe a child under 13 has created an account, contact us and we’ll delete it.

If we change how we handle personal data, we’ll update this page and its date, and tell you by email before a material change takes effect where we have your address.