DexClub Privacy Policy
Last updated: 24 September 2026
In short
DexClub works without an account: your collection is stored on your phone and never leaves it.
If you choose to create an account, your email address and your collection are stored on a private server in the European Union, for one purpose only: so you can use the app on more than one device and get your data back if you change phones.
There are no ads, no trackers, your data isn't shared with anyone and it isn't sold. Ever.
1. Who is responsible
DexClub is an app developed by a private individual.
| Controller | Adrián Mesa Delgado |
| Contact | support@dexclubapp.com |
| Website | dexclubapp.com |
For any question about this policy or about your data, write to that address.
2. What data is processed
2.1 Without an account: nothing leaves your phone
If you use the app without registering, everything is stored on your device: your collection, albums, lists, decks, tags and settings. Nothing is sent to any server and nobody else can see it.
If you uninstall the app without making a backup, that data is lost.
2.2 With an account: what is stored on the server
Your email address. It identifies your account and is used to send you two messages: the account confirmation and the password recovery. Nothing else.
Your password, hashed. It is stored with bcrypt, an algorithm designed for this: the password itself is not stored, only a result that cannot be reversed. Not even the developer can know what it is.
Your collection data, so it can be synced: which cards you own, in which variant, condition and language, plus your albums, wishlists, tags, decks, tournaments, matches and graded cards.
2.3 Technical server data
Like any server on the internet, DexClub's automatically logs the IP address the app connects from, the date, the time and the path requested.
These logs are used only for security and troubleshooting: detecting attacks, blocking brute-force login attempts and fixing errors. They are not used to profile anyone and are not cross-referenced with collection data. They are kept for 30 days and then deleted.
2.4 What is NOT collected
- No advertising or ad networks.
- No analytics or behavioural trackers.
- No access to your location, your contacts or your calendar.
- No device information beyond what the app needs to work.
- No selling or sharing of data with third parties for commercial purposes.
2.5 Photos and camera
The app may ask for access to your camera and gallery for two things: your profile picture and photos of your graded cards. Those images stay on your device and are not uploaded to any server, even with an active account.
3. Why it is used, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email and password | Creating your account and letting you sign in | Performance of the service you request (art. 6.1.b) |
| Email address | Confirming your account and recovering your password | Performance of the service you request (art. 6.1.b) |
| Collection data | Syncing it between your devices | Performance of the service you request (art. 6.1.b) |
| IP and logs | Server security and troubleshooting | Legitimate interest in protecting the service (art. 6.1.f) |
No automated decisions are made and no profile is built about you.
4. Where it is stored
Data is hosted on a server rented from IONOS, located in Spain, within the European Union. IONOS acts as a processor and does not access the content of the data.
There are no international transfers of data outside the European Economic Area. All communication between the app and the server is encrypted with HTTPS.
5. Other services involved
Resend, the service that delivers the account confirmation and password recovery emails. To send them it processes your email address, and messages are sent from its infrastructure in the European Union.
Google Play, for downloads and updates on Android. Google processes its own data under its own privacy policy.
Apple, once the iPhone version is available: downloads and updates will go through the App Store, and Apple will process its own data under its own privacy policy. If "Sign in with Apple" is offered in the future, Apple will share your email address — either the real one or the anonymous forwarding address you choose — for the sole purpose of creating your account.
TCGdex, where card images are downloaded from. When an image loads, your IP address reaches that service, as happens when opening any image on the internet.
Cardmarket and TCGplayer, only if you tap a link to view a card on their site. At that point you leave the app and their own terms apply.
The prices shown in the app are downloaded from DexClub's server as a file, without sending any information about you.
6. How long it is kept
As long as your account is active. If you delete it, your data is removed from the server.
Technical logs are deleted after 30 days.
Server backups are kept for 14 days and expire on their own. So after you delete your account, your data may remain in a backup for that period before disappearing completely.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to support@dexclubapp.com.
Two of them are available directly in the app:
Portability. You can export your collection to a CSV file and make backups whenever you like, without asking anyone.
Erasure. You can delete your account from within the app. Doing so removes your email address and all your data from the server.
If you believe your data isn't being handled properly, you can complain to the data protection authority in your country. The authority competent by virtue of the controller's country is the Spanish Data Protection Agency, AEPD (www.aepd.es).
8. Minors
DexClub is not aimed at children under 14, the age from which Spanish law allows consent to data processing without parental authorisation. In other countries this age ranges between 13 and 16; the local rule applies.
The app can be used without an account at any age, because in that case no personal data is processed: everything stays on the device.
If you are below that age and want to create an account, ask a parent or guardian.
9. Security
- All communication between the app and the server is encrypted with HTTPS.
- Passwords are stored hashed with bcrypt, never in plain text.
- Confirmation and recovery links expire, work only once and are stored hashed.
- The server only allows administrative access with a cryptographic key, not a password.
- The database is not reachable from the internet: only from the machine itself.
- There are attempt limits on registration, sign-in and password recovery.
- Daily backups are made.
No system is infallible, but if a breach affecting your data ever occurred, you would be informed and the relevant authority notified within the time limits set by law.
10. Changes to this policy
If anything relevant changes, this page will be updated and the date at the top changed. If the change affects how your data is handled, you will be notified inside the app.
11. Trademark notice
DexClub is an unofficial app made by a fan. It is not affiliated with, endorsed or sponsored by Nintendo, The Pokémon Company or Game Freak. Pokémon and character names are trademarks of their respective owners.