Privacy Policy

1. Who is responsible for your data

HitDex is the controller of your data under Brazil's General Data Protection Law (Law 13.709/2018).

Contact for any privacy matter: contato@hitdex.cards.

2. What we collect

Three kinds of information, for different reasons.

• •Account data: name, email and password (stored only as a hash, never in clear text). If you sign in with Google we receive your name, email and profile picture — never your Google password.
• •Content you create: card photos, identified cards, breaks, your customers' names, products, messages exchanged with other users, and your profile information (bio, city, channel, schedule, links).
• •Usage data: how many scans you ran, which model processed them, how many tokens were consumed and when. This measures your quota and our cost.
• •Payment data: when you buy a pack, Stripe processes the card. We never see or store card numbers — only the Stripe customer id, the pack bought, the amount and the date.
• •Cookies: a session cookie (to keep you signed in), one for your chosen currency, one for language, and a temporary one during Google sign-in. No advertising or third-party tracking cookies.

3. Photos and other people's names

Two situations deserve special attention because they involve data about people who are not you.

The photos you upload are kept as proof — that is what lets a customer check later which card was pulled and in what condition. They are accessible to you and, for a break, to anyone holding that break's link. If your collector profile is public, your cards' photos are visible too.

When you add customers to a break you are recording another person's name. Use only an identifier that person would accept seeing on a public page, and avoid data that is not needed to run the live. Telling your customers about this record is your responsibility.

4. Why we process each item

• •Performance of the contract: keeping your account, identifying cards, storing your portfolio, processing payments and delivering break results.
• •Legitimate interest: measuring usage to size cost, preventing abuse and improving identification.
• •Legal obligation: keeping purchase records for the period tax law requires.
• •Consent: making your profile public and posting break summaries to your Discord — both off by default and revocable at any time.

5. Who we share with

We do not sell your data and never hand it to advertising. We share only with what the service needs to run:

• •Anthropic (USA) — processes photos to identify cards. Images are sent for analysis and are not used to train models.
• •Stripe (USA/Ireland) — processes payments and receives card data directly from you.
• •Vercel (USA) — hosts the application and stores the photos.
• •Neon (USA) — hosts the database.
• •Google (USA) — only if you choose to sign in with a Google account.
• •pokemontcg.io — receives a card name and number to look up a price. None of your data is sent.
• •open.er-api.com and frankfurter.dev — queried for the dollar rate. No personal data travels.
• •Discord — only if you configure a webhook, and only the break summary you asked us to send.

6. International transfer

The providers above operate outside Brazil, mostly in the United States. By using HitDex you acknowledge your data is processed abroad, under the contractual safeguards those providers offer.

7. How long we keep it

• •Account data and content: for as long as your account exists.
• •Photos: until you delete the card or break they came from. A photo is deleted once no card points at it.
• •Purchase records: kept after account deletion for the period tax law requires, without content data.
• •Usage records (scans): kept in aggregate for cost control.

8. Your rights

Brazilian data protection law lets you, at any time:

• •Know what data we hold about you and get a copy.
• •Correct incomplete or outdated data — most of it you can edit yourself in your profile.
• •Delete your account and the content attached to it.
• •Withdraw consent, such as the public profile or Discord delivery.
• •Object to a specific processing activity or ask us to explain it.

9. How to exercise them

Write to contato@hitdex.cards from your registered email. We answer within 15 days. For account deletion we confirm before executing, because it is irreversible and takes your breaks, portfolio and messages with it.

10. Security

Passwords are stored with bcrypt. Sessions use an HttpOnly cookie that JavaScript cannot read. All traffic is over HTTPS. Administrative access is restricted to a closed list of emails defined outside the database.

No system is immune. If we identify an incident that could pose a relevant risk to you, we will notify you and the Brazilian data protection authority, as the law requires.

11. Minors

HitDex is not directed at people under 18. If you are between 16 and 18, use it only with a guardian's permission and supervision. If we learn an account belongs to someone under 16 without guardian consent, it will be removed.

12. Changes to this policy

When something relevant changes we update the date at the top and notify you in the application. If a change requires new consent, we ask before applying it.