Privacy policy

Last updated 7 October 2026

First Cards is made for children and the grown-ups who help them. It has no accounts, no adverts and no tracking, and we never sell or share anyone's information. This page explains, in plain words, exactly what the app and this website keep, why, and how to have it removed.

The short version

• No sign-up: no email address, phone number or password is ever asked for.
• Photos of cards are read on the phone and deleted straight away. They are never sent to us.
• We keep each collector's chosen nickname, badge and colour, and their collections, so they work across visits and can be shown to friends they add.
• We count which parts of the app get used, without names or anything a child types.
• No adverts, no outside analytics companies, no tracking across other apps or websites.
• A grown-up can delete everything from the app at any time.

Who we are

First Cards is run by [Name of the person or company responsible, and their postal address]. Questions about privacy, or any request about your family's information, go to help@first.cards. A real person reads every message.

What stays on the phone

• Card photos. When a child taps to scan, the app takes a few photos of the card, reads them on the phone, and deletes them once the card is found. The camera is only used on the scan screen, and only after you allow it.
• The app's own copies. The app keeps a copy of the family's collections and recently viewed cards, so it works without internet. It also downloads the list of cards and a picture-recognition model (about 50 MB) so it can recognise cards on the phone.

What we keep on our servers

• The family. When the app is first opened it creates a random identifier for the family. The phone keeps a secret key for it; we only keep a scrambled (hashed) form of that key. There is no name, email or phone number attached.
• Collectors. For each collector: the first name or nickname typed in (we suggest not using a full name), the badge and colour chosen.
• Collections. Each collection's name and colour, which cards are in it, which finish (plain, holo and so on), how many, and favourites.
• Friends. When two collectors swap friend codes, we record that they're friends, so each can see the other's nickname, badge, collections and newly added cards. Friend codes run out after a short time, and only work when typed into the app. Collectors can remove a friend at any time.
• Notifications. If a grown-up turns on notifications, we keep the phone's notification address (a token from Apple or Google) to tell the collector when a friend adds cards. Turning notifications off removes it, and none are sent once the family's data is deleted.
• Usage counts. Which screens and features are used (for example, "opened a collection", "a scan found a card, in under a second"), the app version and whether it's iPhone or Android. These are linked to the family's random identifier, never to names or anything typed. We use them to see what works and what to improve. They are deleted after about 13 months.
• Purchases. If a grown-up buys the unlock, we keep Apple's record of it (its transaction number, the date, and whether it was refunded), linked to the family, so the unlock works and can be restored on another phone. Apple handles the payment: we never see card or Apple account details.
• Error reports. If something goes wrong, the app sends a technical description (the error message, which screen, the app version), so we can fix it. These are deleted after 90 days.
• Messages to us. If a grown-up sends a question or idea from More, then Help & ideas, we keep the message, and it's emailed to us. The form doesn't ask for an email address: to get an answer, write to help@first.cards.
• Keeping things safe. To stop anyone guessing friend codes or overloading the app, we count attempts using a scrambled (one-way hashed) form of the phone's internet address, never the address itself, and delete these counts after a day.

When a card is scanned

To find which card was photographed, the phone sends our server what it read on the card: the words and numbers printed on it, the colour of a Basic Energy card, short codes describing the card's picture, and the cards the phone's own picture recognition thinks it might be. The photo itself is never sent. We use this only to answer, and keep nothing from it beyond a count that a scan happened.

What we never do

• Show adverts, or use advertising identifiers.
• Track anyone across other apps or websites, or use outside analytics or tracking companies.
• Sell, rent or share information with anyone for their own use.
• Ask for or collect email addresses, phone numbers, location, contacts, photos or birthdays.
• Let anyone message a child. Friends only see nicknames, badges and cards.

Who helps us run First Cards

These companies process information only on our behalf and only to provide the service:

• Cloudflare hosts the app's servers, database, storage and email, and this website. The database is in Western Europe.
• Apple and Google deliver notifications (Apple Push Notification service, Firebase Cloud Messaging) and run the App Store and Google Play, which have their own privacy policies.

Card information and pictures come from the open TCGdex project, copied onto our own servers: the app never contacts TCGdex.

Children and grown-ups

First Cards is designed to be used by children with a grown-up's help. The parts meant for grown-ups (sending us a message, deleting data, links that leave the app) sit behind a grown-up check. We don't ask children for personal information, and the only thing a child types that we keep is a nickname. If you think a child has given us something they shouldn't have, email us and we'll remove it.

Deleting your family's information

A grown-up can go to More, then Delete all data. It is removed from the app straight away: the family's collectors and collections disappear for everyone, friend codes stop working, and no more notifications are sent. We keep the records, marked as deleted, so they can be restored if it was a mistake. To have them erased completely, email help@first.cards and we'll do it. Deleting the app from the phone removes everything kept on the phone.

Your rights

You can ask us for a copy of your family's information, to correct it, to erase it, or to stop us using it, by emailing help@first.cards. We may need to check the request comes from the family's phone. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ico.org.uk) in the UK, or the data protection authority where you live.

We use the information above to provide the app you've chosen to use, and for our legitimate interest in keeping it working, safe and improving. We keep each kind only as long as described here.

This website

first.cards uses no cookies and stores nothing on your device. To know roughly how many people visit, the website counts page views by day, page, language, the website that linked to it, country and whether it's a phone or a computer. It keeps no internet addresses or anything else that could identify a visitor.

Changes

If we change what we keep or how we use it, we'll update this page and the date below, and tell you in the app if the change matters.