Privacy Policy

Poke AI, Version 2026.06.02

Draft for review. This is the public draft of the Poke AI Privacy Policy ahead of the v1.1 launch. It is reviewed by counsel in each launch jurisdiction (UK, Ireland, New Zealand, Canada ex-Quebec, US ex-Washington, Australia) before commercial use. The version in force at the time of your transaction controls; we re-prompt you on material changes.

1. Who controls your data

The operating entity (the “Sponsor”) is the data controller (UK / EU GDPR), the agency under PIPEDA (Canada), the agency under the Privacy Act 2020 (NZ), an APP entity under the Privacy Act 1988 (AU), and a business under CCPA (California) and equivalent state privacy laws.

2. What data we collect

Account

  • Apple user ID (opaque hash from Sign in with Apple)
  • Email address (may be Apple relay)
  • Date of birth (for the 18+ age gate)
  • Country of residence + sub-region attestation
  • Accepted Terms version + timestamp

Subscription + payments

  • Apple subscription state
  • Stripe customer ID + last4 of payment method
  • Billing address (for tax + geo-block)
  • Payment Intent IDs + amounts + timestamps
  • IAP refund flags

Scanner + vault

  • Scan images, cached locally; processed server-side for card identification then permanently deleted within 24 hours
  • Identified cards in your vault (identity, condition, grading, acquisition date, source)
  • Locked acquisition FMV for pulled cards
  • SwiftData local persistence on your device

Packs + Sweepstakes

  • Pack purchase history
  • Pack pulls history with verifiable seed
  • Sweepstakes entries (source: subscription auto / amoe_web / amoe_postal, jurisdiction, IP hash for rate limiting)
  • Winner status + KYC status + provider ref

Shipping

  • Shipping address (full name, street, city, region, postcode, phone, country)
  • Shippo tracking IDs + status events
  • Photos of items shipped (our records)

KYC artefacts (sweepstakes winners + high-value shipments)

Government ID + selfie + liveness check are uploaded directly to our KYC partner (Onfido or Veriff) on your device. We do not store these on our servers. We receive only the KYC status (pending / submitted / passed / failed) via webhook.

Analytics + diagnostics

  • PostHog product analytics events (EU hosted)
  • Sentry crash + breadcrumb traces (no PII deliberately captured)
  • IP hashes (rotated; for AMOE rate limiting)

3. Why we use it

Provide the product (contract); tax + accounting (legal obligation); fraud / abuse prevention (legitimate interest); marketing communications (consent); sweepstakes + KYC (contract + statute); analytics (legitimate interest). We do not engage in automated decision-making with legal effects, do not sell data, and do not run targeted advertising.

4. Who we share with

Apple (subscription + sign-in), Stripe (payments + Tax + Radar), Supabase (database + edge functions, EU hosted), Shippo (shipping), PokemonPriceTracker (anonymous queries), PostHog (analytics, EU hosted), Sentry (crashes, EU hosted), Onfido or Veriff (KYC, EU / UK hosted; DPA + SCCs in place), the UK 3PL partner (fulfilment), Help Scout (support).

5. International transfers

UK / EU ↔ Australia transfers use EU SCCs (2021/914/EU) and the UK Addendum where applicable. Apple and Stripe data flows use the EU-US Data Privacy Framework where applicable. We assess every sub-processor and apply an appropriate transfer mechanism.

6. How long we keep it

  • Account + subscription: lifetime + 12 months (tax audit)
  • Pack pulls + sweepstakes entries: lifetime + 24 months (regulator audit)
  • Scan images: 24 hours from upload
  • Payment metadata: 7 years (tax statute)
  • KYC artefacts: 90 days post-completion (held by KYC partner)
  • Customer support: 24 months from last contact
  • Sentry: 90 days
  • PostHog: 24 months
  • IP hashes: 6 months

On account deletion, identifying fields are rotated to a non-recoverable hash; financial / audit records survive without identifying you.

7. Your rights

Universal across markets: access, correction, deletion, portability, objection, marketing opt-out. Exercise via Settings → Privacy in the app, or bruno@pokeaiapp.com. We respond within 30 days (45 days under CCPA).

Per jurisdiction: UK ICO, Irish DPC, OPC NZ, OAIC Australia, federal / provincial commissioners in Canada, state attorneys general / DPAs in the US. Complaint addresses are listed in each jurisdictional schedule.

8. Security

TLS 1.3 in transit. AES-256 at rest. iCloud Keychain for device identifiers. Stripe handles PCI-DSS scope. KYC partner handles identity-document scope. Two-step confirm on account deletion.

9. Children

18+ gated at signup. We do not knowingly collect data from under-18s. If you believe we have, email bruno@pokeaiapp.com for immediate deletion.

10. Cookies + tracking

iOS app: we currently decline App Tracking Transparency use entirely; no cross-app tracking. Website: functional cookies only (session + locale + Stripe Checkout); a cookie banner appears for EU / UK visitors per the ePrivacy Directive / PECR.

11. Marketing

Email marketing requires opt-in (box unchecked by default at signup). Push notifications scoped per category. No targeted advertising.

12. Sub-processor changes

We update section 4 of this policy and email account holders 30 days before new sub-processors are activated.

13. Complaints + escalation

Email bruno@pokeaiapp.com. Lodge complaints with your jurisdiction's data protection authority. Per-jurisdiction addresses are in the applicable schedule.

14. Contact

bruno@pokeaiapp.com for data protection. bruno@pokeaiapp.com for legal. bruno@pokeaiapp.com for product support.