Privacy Policy

Last updated: July 17, 2026

Espyo ("we", "us") is a mobile application for browsing Pokémon Trading Card Game card data, tracking prices, and managing your card collection. This policy explains what personal data Espyo collects, why, and what your choices are.

Data we collect

• Account data. When you create an account we store your email address, your first and last name if you provide them, and a securely hashed version of your password. If you sign in with Google or Apple, we store the account identifier those services provide and the name, email address, and avatar they share with us.
• Your content. Collections, binders, wishlists, and price alerts you create in the app are stored on our servers so they can be synced to your devices.
• Push notification token. If you enable notifications, we store the device push token needed to deliver them (via Expo's push notification service, which forwards to Apple and Google).

We do not collect your location, contacts, photos, or advertising identifiers, and we do not use third-party analytics or advertising SDKs.

How we use your data

• To provide the service: authentication, syncing your collections and binders across devices, and sending price alert notifications you set up.
• To send transactional email, such as password reset codes.

We do not sell your data, and we do not share it with third parties except the service providers needed to run Espyo (cloud hosting on Google Cloud, Expo for push notifications, and our email delivery provider).

Data retention and deletion

Your data is kept for as long as your account exists. You can permanently delete your account at any time in the app under Profile → Delete Account. Deletion removes your account and all associated data — collections, binders, wishlists, alerts, and push tokens — from our servers, and revokes your Sign in with Apple authorization if you used it.

Your rights

You can access and update your account data in the app. If you are in the European Economic Area, you additionally have the rights provided by the GDPR, including access, rectification, erasure, and data portability. To exercise any of these rights, use the in-app tools or contact us at support@espyo.app.

Security

Passwords are stored only as salted bcrypt hashes. All traffic between the app and our servers uses HTTPS. Authentication tokens on your device are stored in the operating system's secure keychain.

Children

Espyo is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

Changes

If this policy changes, we will update this page and the date at the top. Material changes will be announced in the app.

Contact

support@espyo.app