Privacy policy.

Who we are

Dexio is provided by SR Ecommerce, the data controller responsible for the personal data described here. Our Google Play developer name is also SR Ecommerce.

This policy covers the Dexio mobile app, dexio.win and the services supporting them. We process personal data under the General Data Protection Regulation (GDPR).

Information we use

• Account details: your email address, password hash, username, display name, chosen avatar, currency and language settings. Passwords are hashed with bcrypt; the account database does not store readable passwords. We receive your password over HTTPS when you sign in, change it or confirm deletion.
• Your collection: saved cards, quantities, condition, variants, prices, notes, favourites, scan history and daily portfolio value history.
• Card photos: images you choose to scan or upload, including camera frames you send in live mode. Dexio is intended for trading-card photos. Please avoid including people, addresses or other personal information in them.
• AI gradings: the grading result, scores, card details and small preview images, including front, back and close-up views. Full images and crops are processed to produce the result.
• Subscriptions: your Dexio account ID and Google Play purchase information, such as the product, purchase date and renewal status, used to check your Dexio Pro subscription. We never see your payment-card details.
• Community: your posts, replies, likes, attached cards, reports and blocks, together with the profile details shown to other Dexio Pro members.
• Notifications: a push token for your device when you allow notifications, so we can send deal alerts and replies to your posts.
• Advertising measurement: advertising ID and app usage events (for ad measurement), together with device model, operating system and app version, IP address, event time and event type. See the Meta (Facebook) SDK section below.
• Technical information: IP addresses and request information in infrastructure or security logs, used to operate the service, limit excessive requests and investigate abuse.
• Support: your email address, message and anything you choose to send when you contact us.

Dexio does not request your location or contacts. Camera and photo-library access are used only when you choose a feature that needs them. Our hosting and security providers may use necessary security mechanisms.

Why we process it

• Providing the service (contract): creating and managing your account, signing you in, saving and syncing your collection, producing requested results, checking your Dexio Pro subscription, providing community features and deal alerts, and processing account deletion.
• Your consent: optional camera access, selected photo uploads, sending card photos for AI grading and enabling push notifications. You can stop live scanning, revoke device permissions or choose not to upload photos. Withdrawing consent does not undo processing already completed.
• Legitimate interests: keeping Dexio secure, preventing abuse, reviewing community reports, managing blocks, rate limiting and responding to support requests. We balance these interests against your rights.
• Advertising measurement: understanding which Facebook and Instagram ads lead to installs and app events, and measuring and improving our campaigns. We rely on consent where required by applicable law.
• Legal obligations: responding to lawful requests or keeping records where the law requires it.

Grading estimates and card matches help you use the app; they do not make legal or similarly significant decisions about you.

Service providers and transfers

We use providers to operate Dexio. They receive only the information needed for their role:

• Render: account services and the database, hosted in the United States.
• Cloudflare: domain traffic, delivery and security for dexio.win and api.dexio.win.
• Our scanner server, hosted on Vast.ai: processes images sent to api.dexio.win to detect and identify cards.
• OpenAI: processes card photos, close-ups and relevant card details when you choose AI grading. We do not send your account password or email as part of a grading request. OpenAI also provides this website’s hosting through ChatGPT Sites, which involves processing website requests.
• Google Play: sells Dexio Pro and processes subscription payments. Google handles your payment details; Dexio does not receive your payment-card details.
• RevenueCat (RevenueCat, Inc., USA): receives your Dexio account ID and purchase information from Google Play to check subscription status. See RevenueCat’s privacy policy.
• Expo and Google Firebase Cloud Messaging: deliver push notifications using device push tokens and the information needed to route and deliver each message. See Expo’s push-notification information and Firebase’s privacy information.
• Meta Platforms (advertising measurement): receives advertising identifiers, technical device information and app usage events through the Meta SDK, as described below.
• Google Workspace: handles email sent to team@dexio.win.

OpenAI states that API data is not used to train its models by default. Its abuse-monitoring logs are ordinarily retained for up to 30 days, with legal and safety exceptions. Stored Responses have a default retention period of at least 30 days. Where grading uses temporary uploaded files, our service requests their deletion after processing; files remain subject to the provider’s retention controls until deletion succeeds. See OpenAI’s API data controls.

Using these providers can involve processing outside the European Economic Area, including in the United States. Applicable provider data-processing terms include Standard Contractual Clauses for transfers where required. An adequacy decision, such as the EU–US Data Privacy Framework, may apply where the recipient is certified and the transfer is covered. Contact us for information about the safeguards applicable to your data.

Meta (Facebook) SDK

Dexio uses the Meta SDK from Meta Platforms to measure how well our ads on Facebook and Instagram work. When you install and open the app, create an account, save a scan or start an AI grading, the SDK sends Meta technical information such as your device’s advertising ID, device model, operating system and app version, IP address, the time and the type of the event (for example “app installed” or “account created”).

We do not send Meta your name, email address, card photos or collection. Meta uses this information to show us which ads led to installs and to measure and improve our campaigns, as described in Meta’s privacy policy.

You can reset or delete your advertising ID, or turn off ad personalisation, in your Android settings (Settings → Google → All services → Ads, or Settings → Privacy → Ads). The available controls and menu names vary by device and Android version. You can also manage how Meta uses data in your Facebook or Instagram ad settings.

Subscriptions (Dexio Pro)

Dexio Pro is sold through Google Play. Google processes the payment; we never see your card details.

We use RevenueCat (RevenueCat, Inc., USA) to check whether your subscription is active. RevenueCat receives your Dexio account ID and purchase information from Google Play, such as the product, purchase date and renewal status.

You can cancel anytime in Google Play under Payments & subscriptions.

Community posts

If you use the Dexio Community, your username, display name, avatar, posts, replies, likes and the cards you attach are visible to other Dexio Pro members.

You can delete your own posts at any time. Posts that are reported are reviewed by us and may be removed. We store reports and blocks to keep the community safe. Deleting your account deletes your posts.

Notifications

If you allow notifications, we store a push token for your device so we can send deal alerts and replies to your posts. Push messages are delivered through Expo and Google Firebase Cloud Messaging.

You can turn notifications off in the app or in your phone’s settings.

Deal Alerts

Deal Alerts show public eBay listings. Tapping a deal opens eBay. We do not send your Dexio account details, card photos or collection to eBay. Once you open eBay, your use of its service is covered by eBay’s privacy policy, including information it collects directly when you visit.

Estimated profit is a guide, not financial advice.

How long we keep information

Account and collection data: until you remove it or delete your account, subject to any necessary legal retention. The app retains the latest 200 saved scans and 100 saved gradings per user; older history is removed as new entries are saved. These are history-retention limits, not allowances for how often you can use the features.

Community posts: we keep your posts until you delete them, they are removed through moderation or you delete your account. We keep reports and blocks only while needed for community safety, abuse prevention or a legal obligation.

Grading previews: remain with the saved grading until it is deleted, replaced by the history limit or removed with the account. Provider copies are subject to the OpenAI retention described above.

Scanner photos: are temporarily stored while scan jobs are processed and their results are available. Completed jobs are cleaned up as storage slots are reused, when a later scan finds a job older than roughly one hour, or during normal server shutdown. This is activity-based cleanup, not a guaranteed one-hour expiry; interrupted sessions can leave temporary files until maintenance removes them.

Account deletion: successful deletion immediately removes your account and its collection, favourites, saved scans, saved gradings, portfolio history and community posts from the active account database. It does not instantly erase provider backups, security logs or independent temporary processing files.

Backups: deleted information can remain in managed database backups until the recovery window expires. Render’s documented managed recovery windows are 3–7 days depending on plan, and managed database exports expire after 7 days. Backups are used for recovery, not normal account access. See Render’s backup retention.

Security logs and support: we retain them only while needed to resolve the request, investigate an incident, prevent abuse or meet a legal obligation. The period depends on the incident or request and the provider’s log controls; we do not promise a single fixed retention period for all logs. You can ask us about a specific record.

Your choices and rights

You can ask to access, correct, delete or export your personal data, restrict processing, or object to processing based on legitimate interests. You can also withdraw consent where we rely on it. These rights apply subject to the conditions in data-protection law.

You can delete your community posts, turn off notifications in the app or your phone’s settings, and cancel Dexio Pro in Google Play under Payments & subscriptions.

Email team@dexio.win. We may need to verify your identity and will normally respond within one month. If a lawful extension is necessary, we will explain why. You can delete your account in the app or on our account-deletion page.

You may complain to the Dutch Autoriteit Persoonsgegevens or your local data-protection authority.

Age and changes

Dexio is not intended for children under 13. If you are under the age at which you can give valid consent in your country, a parent or guardian must authorise features that rely on consent. In the Netherlands, this applies to children under 16. Contact us if you believe a child is using Dexio without the required permission.

We update this policy when our service or data practices change. The date at the top shows the latest version. We will communicate significant changes through an appropriate channel.