Privacy Policy

Last updated: October 26, 2026

PackLens is operated by Killer Cards Collective, LLC, a Delaware limited liability company (“we”, “us”). This policy explains what we collect when you use PackLens and what we do with it.

1. What we collect

• Account and plan details: your email address, password (stored as a hash by our auth provider), optional public handle, account ID, subscription tier, and purchase status. Payment and subscription data is handled by our payment processor, Stripe; card details stay with Stripe and are not available to PackLens. We keep your Stripe customer and subscription identifiers, and a marker recording that your account has had a Creator free trial or a Creator subscription, which makes it ineligible for another trial. For a Creator trial paid by card, we also record a card fingerprint (a code Stripe gives a payment card, which identifies the card within our Stripe account and is not the card number), with your account ID and the trial's start, so that each card gets one trial. The fingerprint is normally that of the card the trial started with; for a trial we record later, it is the card on file for that subscription at the time. Some payment methods, such as Link and certain wallets, do not provide a fingerprint, and then nothing is recorded. If a trial is cancelled because its card already had one, we record when that happened so the app can tell you why. Stripe collects your billing address to calculate tax, and it is stored on your Stripe customer record.
• Your content: the videos you upload (including their audio), the rendered results, card lists and totals, and any corrections you make during review.
• Technical and diagnostic data: request logs, IP addresses, app and OS versions, a random install identifier, and crash, hang, launch, performance, and WebView error reports. We use these to keep the app reliable, secure the service, enforce rate limits, and prevent abuse. Our sign-in, sign-up, password and confirmation-email forms use Cloudflare Turnstile, which checks your IP address and browser signals to tell people from bots.
• Support requests: when you send the team a request from Get help, the message you write, a screenshot if you add one, and the email address you give us to reply to. We check whether that address belongs to a PackLens account, so account holders' requests come first; we never tell anyone the answer. If you are signed in, your account ID and email are attached so we can find your scans. Where your browser allows, a JPEG photo's location and device details are removed before it is sent.
• Referral program: when you open a referral link, its referral code and when you opened it, kept for 30 days so the referral can be saved if you sign up in that time; if you do not, it is never linked to an account. If you sign up through a referral link or code, which referral it was and when you signed up. If you refer people, your referral code, what you earned from each payment of the people you referred and what was paid to you. To be paid in cash: the PayPal or Wise email address you give us, which version of the referral terms you accepted and when, when you confirmed you are 18 or over, which tax form applies to you and when we received it, and your tax form (a W-9 or W-8 form) itself, which you email us and which includes your tax identification number.
• Reports of shared packs: when you use Report this content on a shared pack, the reason you choose, any details you add, the page you reported, and an email address only if you give one. You do not need an account to report a page.

We don't run third-party advertising or analytics trackers.

2. How we use it

• To provide the service: processing your videos and showing you results.
• To enforce plan limits and keep the queue fair.
• To improve recognition accuracy: for every scan we keep a copy of its analysis record, and we may also keep the small cropped card images it produced. We may use them, together with any corrections you make in review, to train and evaluate our recognition models. This copy is kept apart from your scan library, so it is not removed by your plan's storage limit. It is deleted when you delete the scan, and when you delete your account. We do not keep your original video for this.
• To run the referral program: to credit a referral to the person who referred you, work out and pay what referrers earn, and meet our tax reporting duties.
• To respond when you contact us.

We do not sell your data.

3. Where it lives

PackLens runs on a small set of infrastructure providers acting as processors: Vercel (web hosting), Supabase (authentication and database), Cloudflare R2 (video storage), Cloudflare Turnstile (bot protection on sign-in, sign-up, password and confirmation-email forms), and Resend (account, service and billing emails, such as storage notices and purchase confirmations). Your video is processed on a GPU server that PackLens operates itself. Card recognition runs on that server against local copies of the card catalogs: Scryfall's for Magic, and the open pokemontcg.io card data for Pokémon. For Magic, if the local copy is unavailable, card-name text read from your footage (never the images, and never your account identity) is looked up against Scryfall's public card API instead. No data from your footage is sent to any AI model provider. Crash and error reports are summarized into one-line operational alerts and posted to our ops team's Discord; these summaries cover app version and crash or error detail, not account identity. Support requests are stored in the same database and storage as the rest of the service. For account holders' requests and for reports, the message and the reply address are also emailed to our support inbox through Resend. A notice that a request or report arrived, without what you wrote, may be posted to a staff-only Discord channel. Screenshots are never emailed or posted. Payments and subscriptions are handled by Stripe. Referral cash payouts are sent by PayPal or Wise, which receive the payout details you give us and the amount. Referral credit is applied to your bill in Stripe. A tax form you email us is kept in our email inbox, not in the PackLens database. When a referrer's cash balance passes the payout threshold, a notice with their account ID and the amount is posted to the staff-only ops channel on Discord. If you press Send to KillerCards on a finished scan, the following is shared once with KillerCards, which is also operated by Killer Cards Collective, LLC, along with the Bloodline game: the cards detected in that scan (names, card identifiers, set and collector numbers, finish, estimated prices, and when each card appears in the video), when the scan was created and processed, and a pack identifier; never your footage, and never your account identity. Prizes, game settings and publishing are then managed on KillerCards. PackLens shares data with these providers as needed to operate the service.

When card artwork is displayed, your browser may load it directly from Scryfall, Pokémon TCG API image hosting, or Scrydex. Those services receive the information ordinarily included in a web request, such as your IP address, browser details, the requested image, request time, and possibly the PackLens site origin. PackLens does not send them your PackLens account identity.

4. Sharing and public pages

Results are private to your account unless you create a share link. Share links are unlisted: anyone with the URL can view that result (including your handle, if you set one), and they are excluded from search-engine indexing. You can stop sharing a result at any time from its page.

Separately, your best pulls can appear in the “Community highlights” on our home page. A highlight shows only a card's name, price, set and artwork, and the hour it was scanned; never your name, handle, email, results page or video. This is on by default, and you can switch it off at any time with Show my hits on the homepage in Settings. Switching it off removes every highlight from your account, including from scans you have shared. If your account existed before this setting was introduced in October 2026, scans you made before then appear only if you shared them.

We also show anonymous platform-wide totals (for example, the number of scans completed and their combined value). These totals count every scan, including ones you have not shared, but they contain no cards, no results and nothing that identifies you or your account.

If someone referred you, they see only counts: how many people signed up through them, how many of those are paying, and their own earnings and balances. They never see your name, email, handle or account.

5. Retention and deletion

A recording made or selected in the iOS app is staged in the app's private storage until you upload or remove it, and stale staged recordings are cleared after about 24 hours. Original uploads are temporary. Finished Free-tier videos are stored for 7 days from the scan's first completed render. Videos on a paid plan (Pro or Creator) are kept while the plan is active; after your account switches to Free, older videos become eligible for deletion after a 30-day grace period. Result data stays with your account. You can delete individual scans from the app, and you can permanently delete your whole account, including stored footage, from the Delete account section of Settings, or by emailing admin@vibecade.ai from your account address. Requesting deletion stops your sharing immediately: every share link you have is switched off, Show my hits on the homepage is switched off, and your results leave the home-page highlights at that moment, not when the deletion finishes. A link preview that another app or service already fetched can stay in its cache for up to an hour after that; we cannot recall a preview someone has already received. Canceling the request does not switch them back on; you decide which results to share again and whether to show your hits. Account deletion itself completes within 30 days of the request. Footage already incorporated into model training in anonymized, aggregate form cannot be extracted retroactively. A card list you sent to KillerCards is held and managed there; deleting the scan or your account in PackLens does not remove it from KillerCards. Records of payments, invoices and refunds are kept by Stripe and by us for as long as tax and accounting law requires, including after your account is deleted. So are referral records (who referred whom, what was earned and paid, and any tax form), which tax reporting needs. The trial card record described in section 1 is also kept after deletion, because removing it would let the same card start another free trial on a new account. Support requests and reports, and any screenshot with a request, are kept while we work on them and deleted 90 days after we mark them done. When you delete your account, the support requests you sent while signed in or from your account's email address are deleted with it; a report of a shared pack is a moderation record and follows the 90-day rule. Copies already emailed to our support inbox are deleted when you ask us to. Our email provider keeps its own delivery records for a limited time under its policy.

6. Children

PackLens is not directed to children. You must be at least 13 years old to hold an account (see the Terms of Service), and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their information, email admin@vibecade.ai and we will delete the account and its content.

7. Changes and contact

We'll update this policy as the service evolves; the date above reflects the latest revision. For any privacy question, contact admin@vibecade.ai. See also the Terms of Service.