Privacy policy

SleeveX is a trading name of TJXLabs, a company in Sydney, Australia ("we", "us").

Last updated 11 November 2026. This page explains what SleeveX does with your information, in plain words.

The short version

SleeveX is a collection and price tracker for trading card games (One Piece Card Game and Pokémon, English and Japanese). It keeps your collection on your phone. If you create an account, a backup of it is stored online so you can use it on another device, and you can choose to share a showcase, follow other collectors and post. We do not sell your data, show ads, or use analytics or tracking.

What we collect

• Account: the first time you use the app it creates a background account with no email, so your collection can be backed up and your profile kept. If you choose to save your account, we also store your email address and a secure sign-in token (your password is stored only as a salted hash, never as text). A background account that is not saved to an email is removed after 7 days if it holds nothing, or after 90 days without opening the app if it holds cards. If sign-in with another provider such as Google is added later, we will receive the email address that provider shares and will update this policy first.
• Your collection: the cards you add, quantities, conditions, the price you paid if you enter it, your wishlist and binders. Stored on your phone; copied to our database to back it up, under your account.
• Profile: your username, display name, bio, avatar colour and, if you add one, a profile photo. They are stored in your account. Your username, display name, bio and profile photo are visible to other collectors when you share a showcase, post or are listed in Collectors.
• Collector page (optional, off until you turn it on): in Account, What collectors can see, you can choose to be listed in Collectors, and to share which cards you own, your portfolio value and graph, and your wishlist. When a switch is on, a copy of just that information (card ids, wishlist ids, total value and its history) is stored in your account for others to see. We never show quantities or what you paid. Turning a switch off hides it straight away.
• Showcase (optional): up to 12 cards you choose to show, a title, and whether prices are shown. A showcase is private until you set it to "Anyone with the link" or "Listed in Explore". Listed showcases can be found by other signed-in and signed-out visitors.
• Following and blocking: who you follow and who you block. Other people can see follower counts; your block list is private.
• Posts, likes and comments: text up to 280 characters, the cards you attach, one optional photo per post, and your likes. Posts, photos and comments are public and show your username and profile photo. Photos are shrunk on your phone before they are uploaded. You can delete your own posts (which removes the photo) and comments.
• Community (threads and replies): the threads and replies you write, their photos, the cards you attach (with an optional condition and asking price), your likes, the threads you follow, the boards you hide, which board rules you have accepted, and which of your tags you chose to hide from your name. Threads and replies are public and show your username, profile photo, helper tags and Rep. If you delete a thread it stays restorable for 30 days and is then removed for good with its photos; threads with no replies for 30 days are archived but stay readable.
• Rep, helper tags and badges: a score and tags worked out from likes your content receives and from your activity in the app. They are shown to other people next to your name.
• Deals: if you record a deal with another person, we store who it was with, the thread, what was agreed and its status, and both of you can see it. We do not process payments.
• Activity counts: how many cards you have scanned, the days you opened the app (used for streaks and badges), the date you joined, and the last day you opened the app (used to remove unused background accounts). We also keep short-lived counters of actions such as posts and scans, to limit spam and to apply the limits of your plan.
• Your plan: whether your account has a Pro plan or Pro access we gave you. Paid plans are not on sale yet; before they are, we will update this policy with how payment is handled (it will be by Google Play).
• Notifications and activity: the notices shown in the bell list (replies, mentions, deals, likes, new followers, tags) and your notification choices.
• Moderation: reports are reviewed by people we appoint. We keep a log of moderation actions (such as hiding content or suspending an account) with the reason, and a note on any suspension or warning shown to you. We also keep counts of how often an account posts, to limit spam.
• Reports: if you report a profile, showcase, post or comment, we store the report and your reason so we can review it. If you later delete your account the report stays but is no longer linked to you.
• Price alerts: the cards you set alerts on and your target prices.
• Notification address: if you allow notifications, a token that identifies your phone so we can send you a price alert. See "Notifications" below.
• Terms and age: the time you agreed to the Terms to post. When you create an account you confirm you are 13 or older; we do not collect your date of birth.
• Photos you choose: for a profile photo or a post you pick a photo from your phone's photo picker or take one with the camera. Only the photo you choose is sent, nothing else from your gallery. Please do not upload photos of other people.
• Card photos: scanning happens on your phone. The camera picture is used to recognise the card on the device and is not uploaded. If a future version offers cloud scanning, a photo is sent only after you choose it, and we will update this policy first.
• On your phone only: your settings (currency, colour theme, notification choices), the App lock (it uses your phone's fingerprint, face or PIN; we never receive that information) and any CSV file you export or import, which stays wherever you save it.
• Crash reports: switched off. Only our own staff can switch them on, on their own phones, to fix bugs. If we ever turn crash reports on for everyone (they would send crash logs and basic device details, such as phone model and Android version, to Google Firebase Crashlytics), we will update this policy and tell you in the app first.
• Technical data: our hosting provider may log standard request information (such as IP address and time) to keep the service running and secure.

Notifications

Notifications (price alerts, release reminders and Community activity) are delivered through Google's Firebase Cloud Messaging. If you allow notifications, Google receives your phone's notification token and the text of the notification (for example a card name and price, or the title of a thread) so it can reach your phone. Nothing else about you is sent. You can turn notifications off in your phone's settings, and remove an alert at any time in Portfolio, Alerts.

Who handles your data

We do not sell your data or share it for advertising. We use a small number of services to run the app: Supabase (database, sign-in and photo storage), Resend (sends the sign-in code emails), Google Firebase Cloud Messaging (notifications) and GitHub Pages (this website). Card text on a scanned card is read on your phone with Google ML Kit, which runs on the device and sends nothing to Google. Card and price data comes from public sources (TCGCSV and JustTCG) and exchange rates from a public source; those requests carry card identifiers, not your personal details. Links to sellers such as eBay or TCGplayer open on their own sites, which have their own policies.

Where it is stored

Account data is stored with Supabase in the Asia-Pacific (Sydney) region. Notification tokens and notification text pass through Google, and sign-in emails through Resend, which may handle that information outside Australia (for example in the United States). We only send them what they need to do that job. Card and price data is public catalogue data and contains nothing about you.

Your choices

• Save your account only if you want to: a background account has no email address and is removed automatically when unused.
• Delete your account and cloud data any time in Account (Delete account and cloud data, or Delete my data for an account without an email). This removes your profile and profile photo, collector page copy, showcase, follows, blocks, posts and post photos, comments, threads and replies with their photos, likes, deals, alerts and notification address. Threads you started are removed with your account. For an account with an email your collection stays on your phone; Delete my data also clears the phone.
• Keep your showcase private, or turn it off, in Account, My showcase.
• Export your collection as a CSV file any time in Account, Export and import.
• Ask us for a copy of what we hold about you, or to correct or delete it, by emailing us. We will reply within 30 days.
• Turn off any notification type, or all of them, in the app or in your phone's settings.

How long we keep it

We keep account data until you delete your account, then remove it from our database. Reports you made stay, with no link to you. The moderation log (which names the staff member who acted, and the reason) is kept for up to one year. Sent notifications are removed after 30 days, price-alert history after 90 days and the log of the days you opened the app after about 400 days. Suspensions and notices about your account are removed when you delete your account. Our hosting provider may keep routine technical logs for a short time and backups for a limited period before they are overwritten.

Children

SleeveX is not directed at children under 13. Using the app requires you to confirm you are 13 or older, and we do not knowingly collect data from children under 13. If you believe a child has made an account, email us and we will delete it.

If something goes wrong

If we find that your personal information has been accessed or lost in a way likely to cause you serious harm, we will tell you and, where the law requires, the Office of the Australian Information Commissioner.

Complaints

Email us first and we will try to fix it. If you are not happy with our answer you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If this policy changes we will update the date above and, for important changes, tell you in the app.

Contact

TJXLabs, Sydney, Australia. tjxlabs@gmail.com