Privacy Policy

Last updated: July 2026

This page is maintained by the InMySet team to explain how the app handles your data. InMySet is a personal Pokémon TCG collection tracker. It is not affiliated with The Pokémon Company.

Data controller

The data controller responsible for your personal data is:
Mitchrix
CVR: 30317645
Contact: privacy@inmyset.com

What we collect

• Account info: your email address. That's it — we don't ask for your name, address, phone number, or any other profile details.
• Collection data: which cards you've marked as owned and your chosen cover cards.
• Photos you upload: card photos and scan photos you submit, stored privately and only accessible to you.
• Scan history: the results of card scans you perform.
• Payment information: if you subscribe to InMySet Pro, Stripe processes your payment details directly. We never see or store your card number, billing address, or bank details — only a subscription status flag.

What we don't collect

• No names, phone numbers, addresses, or demographic data.
• No analytics, tracking pixels, or behavioural profiling.
• We don't sell your data.
• We don't use third-party advertising trackers.
• We don't read your card photos for any purpose other than identifying the card you submitted.

Legal basis for processing

Under GDPR, we process your data based on the following legal grounds:

• Performance of a contract: to provide your account, collection tracker, and Pro subscription.
• Consent: for optional features such as uploading photos and using the card scanner. You can withdraw consent by deleting the uploaded content or your account.
• Legitimate interests: to keep the app secure, prevent fraud, and improve the service.
• Legal obligation: to comply with accounting, tax, or other applicable laws.

How your data is stored

Data is stored on Lovable Cloud (backed by Supabase) with row-level security, meaning each row in the database is scoped to the user who created it. Photos are stored in private buckets and accessed only through short-lived signed URLs while you are signed in.

International transfers

InMySet is operated from Denmark. Your data may be transferred to and processed in the United States by our subprocessors (Lovable Cloud, Supabase, Stripe, Google). These transfers are safeguarded by the Standard Contractual Clauses or other adequacy mechanisms required by GDPR.

AI card identification

When you use the scan feature, your photo is sent to the Lovable AI gateway (Google Gemini) for the sole purpose of recognising the card. The image is not used to train models.

Subprocessors

We rely on the following service providers to operate the app. Each is contractually bound to handle data only for the purposes listed below:

• Lovable Cloud — hosting and database infrastructure
• Supabase — authentication, database, and storage
• Stripe — payment processing for InMySet Pro
• Google Gemini (via Lovable AI gateway) — card image recognition

Cookies

InMySet only uses essential cookies and local storage to keep you signed in and to remember your preferences. We do not use advertising or analytics cookies.

Retention

We keep your account and collection data for as long as you maintain an active InMySet account. Uploaded photos and scan history are retained until you delete them or delete your account. When you delete your account, your personal data is removed from active systems within 30 days, except where we are required to keep it longer by law.

Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: delete your account and data. You can do this yourself at any time from Account → Delete account.
• Portability: request your data in a machine-readable format.
• Restriction: ask us to limit how we process your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: stop optional processing such as photo scanning.

To exercise any of these rights, email us at privacy@inmyset.com. We aim to respond within 30 days.

Contact

Questions about this policy or your data? Email privacy@inmyset.com.