Legal
Privacy Policy
HaveFun scans Pokémon cards, prices them, keeps your collection, and runs a marketplace where collectors list cards and agree prices with each other. This page explains exactly what that involves for your data. It describes what the app actually does, not a generic template.
HaveFun does not sell your data, does not show ads, and does not track you. There are no third-party scripts in the app, with one exception: when you choose to verify your identity, Didit's verification screen loads from Didit (see below).
Clicks to shops
When you tap a link to a shop in the marketplace, HaveFun counts it so the shop can see how
many visitors we send them. We record the shop, the card, which screen the tap came from and the
time, plus a code that changes every day and only tells one tap from another on that day. We do
not record who you are, your account or anything that follows you from day to day. Shops see
totals only. Links to shops also carry utm_source=havefun, so the shop's own analytics
can see the visit came from HaveFun.
What is stored about you
| Data | Why | Where |
|---|---|---|
| Email address | Signing in, and resetting a forgotten password | Supabase |
| Password | Signing in. Stored hashed, never in readable form, and never visible to us | Supabase |
| Handle and banner colour | Your display name in the app | Supabase |
| Your collection | The cards you have scanned, their quantities and condition, so the collection follows you to another device | Supabase |
| Number of scans used | Counting against the free allowance | Supabase |
| Subscription status | Knowing whether Pro is active | Supabase |
| Profile picture (optional) | Shown on your profile and your listings | Supabase |
| Marketplace listings | The card, your asking price, its condition, the photos you add and the province and country you give. Other collectors can see them | Supabase |
| Messages and offers | Conversations with other collectors, the offers in them and any photos you attach. Only the two of you can see them | Supabase |
| Bank details (optional) | Shown only to the buyer of an offer you accept, so they can pay you directly. HaveFun takes no part in the transfer | Supabase |
| Watchlist, chase list and price alerts | Telling you when a card is listed or reaches a price you set | Supabase |
| Blocks and reports | Keeping people you have blocked away from you, and looking into reports | Supabase |
| Support messages | What you send to HaveFun Support, including any screenshots | Supabase |
| Notification token (iPhone or Android app, if you allow notifications) | Sending the notifications you have switched on | Supabase |
| Identity verification result (Pro members who choose to verify) | Showing the verified mark. We keep the result and a reference, not your documents | Supabase |
Card photos
When you scan a card, the photo is sent to Anthropic's API so the card can be read and identified. Normally the photo is not kept: it exists only for the moment it takes to identify the card. The one exception is when you tell the app it picked the wrong card: that photo is kept in private storage, with the card it actually was, and used only to improve card recognition. It is never shown to anyone else. Ask us and we will remove it. Anthropic's handling of API data is governed by their own commercial terms.
Photos you add to a marketplace listing or send in a message are different: they are stored so other collectors can see them, and they are removed when you delete your account.
Identity verification
Anyone can choose to verify so buyers can see a real person was checked. Verification has two steps, and you are verified only when both are done.
Your ID and face. This is done by Didit: a photo of your ID document and a face scan go from your device straight to Didit and never to HaveFun. We receive only the result and a reference to the check. From the ID we keep a one-way fingerprint of the ID number (so the same ID cannot verify two accounts) and its last four digits. We do not keep the full ID number or the document. Didit processes the document and scan under its own privacy policy.
Your bank account. You type your ID number, bank and account number. We send them to Didit's account-holder check, which asks the bank whether the account is held by that ID. The ID number is used for that check and is not stored. The bank and account number are saved to your account so payouts can be made to you. A verified account can be changed twice.
Verification is free with Pro. Otherwise it is a once-off fee, which our payment provider takes.
HaveFun for Chrome
The optional browser extension marks, on any card shop's page, which cards you already own or are chasing, and shows their market value. Its one request goes to app.havefundex.com, to fetch an index of your own collection (card names, numbers, quantities and whether you chase them). That index and your currency are kept in the extension's own storage in your browser, refreshed once an hour, and every match is made in the browser. The extension does not send the pages you visit, their text, their addresses or your browsing history anywhere, and it has no analytics. It never shows what you paid.
If you press PRICE MY BASKET, the extension reads the card names and prices in the basket on the page you are on, and opens HaveFun with them in the web address's fragment, which your browser never sends to a server. HaveFun reads it in your own browser and puts the cards in your review queue, so you can save what you paid. Nothing is read or handed over until you press the button. Removing the extension deletes what it stored.
Who else receives data
- Supabase, hosts the accounts database and your collection.
- Anthropic, reads the card from your photo, as described above.
- Scrydex, the card database and prices. Card identities are looked up here; nothing about you is sent.
- Apple, if you subscribe, Apple handles the billing. HaveFun never sees your card details. Apple tells us only that a subscription exists and when it renews. Apple also delivers notifications to the iPhone app, and signs you in if you choose Sign in with Apple.
- Paystack, if you subscribe on the web, Paystack takes the payment. It receives your email address and your card details; HaveFun never sees your card. Paystack tells us that a subscription exists, which plan it is and when it renews.
- Google, if you choose to sign in with Google, Google tells us your email address. Google (Firebase Cloud Messaging) also delivers notifications to the Android app; it receives the notification's text and your phone's notification token, nothing else about you.
- Didit, identity and face verification, and the bank account-holder check, for anyone who chooses to verify, as described above.
- Resend, delivers the app's account emails, such as sign-up codes and password resets, and passes reports to our moderators. It receives your email address and the message.
- eBay and JustTCG, recent sale prices for cards. Card identities are looked up; nothing about you is sent.
- Card shops, shop prices shown in the app come from the shops' own listings. Opening one takes you to the shop's website, which has its own privacy policy.
- Frankfurter, public exchange rates for the currency switcher. No personal data is sent.
Your device
The app keeps a copy of your collection in your browser or device storage so it works
offline and feels instant. Signing out removes it. The app also stores a session cookie so
you stay signed in; it is marked HttpOnly and Secure, so it cannot
be read by scripts and is not sent over an unencrypted connection.
IP addresses
Your IP address is used briefly to limit how many scans can be run from one place, which stops the service being abused. It is held in memory only, for at most a day, and is never written to a database or linked to your account.
Deleting your account
You can delete your account from inside the app, under Profile. This is immediate and permanent: your account, your collection, and everything attached to it are removed. There is no soft delete and no recovery, so please be sure.
Children
HaveFun is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact us and it will be removed.
Changes
If this policy changes, the date at the top changes with it. Material changes will be announced in the app rather than made quietly.
Contact
Questions, or a request to see or delete your data: [email protected]