MonScan
MonScan Privacy Notice
This notice explains how the MonScan app (package card.value.scanner) handles data. It supplements the Control INC Privacy Policy, which explains who we are, the legal bases we rely on, international transfers, your rights and how to contact us. The controller is BILLION MILLION INTERNATIONAL LIMITED (Control INC), Hong Kong · [email protected].
Summary
- MonScan has no account or login. We do not ask for your name, email address or phone number.
- Your collections, scan history, grade history, favourites, drafts and profile nickname are stored only on your device.
- Card photos you scan or grade are uploaded to our server for recognition and deleted right after processing.
- AI chat messages and search terms are processed only to return a result and deleted right after processing. AI features use third-party AI service providers acting on our behalf, which are contractually not permitted to retain your content or use it to train models.
- Custom cards you share to the community are public.
- The app uses advertising, analytics and attribution SDKs that receive device identifiers such as the Advertising ID.
What data leaves your device, and why
| Data | When | Sent to | Purpose | Retention |
|---|---|---|---|---|
| Card photo (compressed JPEG) and device language | When you scan or grade a card (camera or gallery) | Our recognition server (la006-pokemon-card-scanner.controlsolution.org) | Identify the card, return details and prices, produce a grade estimate (grading uses third-party AI service providers acting on our behalf) | Processed only to return the result and deleted right after processing; not retained and not used to identify you |
| AI chat message and earlier messages in the same chat | When you use AI chat | Our server, then third-party AI service providers acting on our behalf | Generate the answer | Not saved on your device after you leave the chat; on our side processed only to generate the answer and deleted right after processing; not retained |
| Search terms, currency choice | When you search or convert prices | Our server | Return results and converted prices | Processed only to return results and deleted right after processing; not retained |
| Custom-card images, card text (name, HP, skills, weakness, illustrator name), likes and downloads | When you share a custom card to the community, or like or download one | Our upload and community servers (upload-services.controlsolution.org, la006-pokemon-card-scanner.controlsolution.org) | Publish and show the card to other users | Until you delete it or it is removed |
| Purchase token, product ID, purchase type, order ID, price and currency, Advertising ID, Adjust ID, installation ID | When you buy Premium or an in-app product | Google Play; our purchase-verification service (tracking-server.controlsolution.org) | Verify the purchase, unlock what you bought, prevent fraud | As long as needed to provide the purchase and as required by tax and accounting law |
| App ID and the plan you bought (weekly, monthly, yearly or one-time) | When a purchase is completed | Our purchase statistics service (appletracking.controlsolution.org) | Count sales per plan for business reporting; no device or advertising ID is sent | Up to 24 months, in aggregate |
| Android ID and purchase token | When the app checks your Premium status, scan credits or custom-card quota | Our server | Apply the right entitlement and limits to your device | While you use the app |
| Random app-generated device ID, mission and pack-opening events | When you use missions, coins and virtual packs | Our pack service (la006-pokemon-card-scanner.controlsolution.org) | Keep your coins, missions and opened packs in sync | While you use the feature |
| Push token, Android ID, device manufacturer and model, app and OS version, locale, notification-open events | When you allow notifications, and when you open one | Firebase Cloud Messaging; our notification service (tracking-server.controlsolution.org) | Send notifications in your language and region, and measure whether they are opened | Until the token expires or you ask us to delete it |
| Network country | At app start | Used on the device to choose a notification topic and regional offers; the topic is registered with Firebase | Regional notifications and offers | Not stored by us separately |
| Advertising ID, App Set ID, device and app information, app activity, ad and purchase events, crash and performance data, IP address | While you use the app | The SDK partners listed below | Ads, attribution, analytics, crash reporting, remote configuration | According to each partner's policy (see the Privacy Policy) |
Card photos
When you scan or grade a card, MonScan crops the photo to the card frame, compresses it and uploads it over HTTPS to our recognition server. Recognition happens on the server, not on your phone. The photo is processed only to return the result and is deleted from our servers right after processing; we do not retain it or use it to identify you. Please photograph only the card, without people, documents or other personal details in the frame. A copy of the photo is kept in the app's private storage on your device so you can see it in your history.
The camera is used only when you open the scanner or the custom card maker. Pictures from your gallery are chosen through the Android system picker, which gives MonScan only the picture you select; MonScan does not ask for access to your photo library.
AI features
AI chat sends the message you type, together with earlier messages in the same conversation, to our server and to third-party AI service providers acting on our behalf. AI grade estimates are generated from the card photo by our servers with the help of those providers. AI price forecasts are produced on our servers from price data. The providers are contractually not permitted to retain your content or use it to train models. Chat messages and grading photos are deleted right after processing; we do not retain them. Do not enter personal or sensitive information into the chat. AI output can be wrong; see the MonScan terms.
Community
Custom cards you choose to share are public. Other MonScan users can view, like, download and share them. The illustrator name you enter is shown with the card, so do not use your real name unless you want it to be public. You can delete a card you shared from within the app (deleting the collection that contains it also deletes the shared card), or ask us to remove it. Please read the community guidelines.
Purchases
Payments are processed by Google Play. We never see your card or bank details. To unlock Premium and other purchases, the app sends the purchase token and related details listed above to our verification service, which checks them with Google Play. When a purchase completes, the app also sends the app ID and the plan type (no personal or device identifiers) to our purchase statistics service.
SDKs used in MonScan
MonScan includes the following third-party SDKs. What each receives, and a link to each privacy policy, is listed in section 7 of the Privacy Policy.
- Google AdMob (Google Mobile Ads SDK) with mediation partners Meta Audience Network, AppLovin, Mintegral and Pangle: ads, including rewarded ads.
- Google User Messaging Platform: consent message where required.
- Firebase Analytics, Crashlytics, Performance Monitoring, Remote Config and Cloud Messaging: analytics, crash reports, performance, remote settings and notifications.
- Adjust: install attribution and campaign measurement.
- Meta (Facebook) SDK: app events for advertising measurement.
- TikTok Business SDK: install and in-app event measurement.
- Google Play Billing: purchases and subscriptions.
Premium subscribers do not see ads. To reset your Advertising ID or change consent choices, see Advertising and Consent in the Privacy Policy.
Data stored only on your device
The following stays in MonScan's private storage on your phone and is not sent to us: your collections and the cards in them, scan history, grade history, favourites, custom-card drafts, the optional profile name and avatar you set during onboarding, and settings such as language, currency and scan counts. Questions shown during onboarding that are not needed by the app are not stored. Clearing the app's storage or uninstalling MonScan deletes this data. If Android backup is turned on, Android may include it in your Google account backup.
Permissions
- Camera: to photograph a card to scan or grade, or a picture for a custom card.
- Notifications: to send you notifications. You can turn this off at any time.
- Internet and network state: to reach our servers and detect when you are offline.
- Advertising ID: used by the ad and attribution SDKs.
MonScan does not request location, contacts, microphone, phone or storage permissions.
What MonScan does not collect
Name, email address, phone number, contacts, precise location, health data and payment card details.
Support, refund and issue forms
If you use the Refunds or Report an issue form, we receive your name, email address, the reason you select, your Google Play order ID (if you enter it) and your description. The request is stored in our support database hosted by Cloudflare and emailed to our support team through our email delivery provider, which also sends you a confirmation email. We store a one-way hash of your IP address for one hour of rate limiting to prevent spam. We use this information only to answer your request and keep it for up to 24 months.
Children
MonScan is not directed to children under 13 and is not designed for children. See Children in the Privacy Policy.
Your choices and deletion
To delete your data, see Delete your MonScan data. For your other rights, see Your rights. Contact: [email protected].