Beyond Scan - Privacy Policy

Beyond Scan (the “App”) · operated by Beyond Industries LTD, a company registered in England and Wales.

Effective: 4 August 2026
Last updated: 4 August 2026

The short version

We do not sell your data. Ever.
Your collection, scans, wishlist, and trade history live on your device, not on our servers.
We do not track you across other apps or websites. No analytics SDKs, no ad networks.
Sign-in is optional and uses Sign in with Apple, which never gives us your real email unless you choose to share it.
If you opt in, we may email you about Beyond Scan and other Beyond TCG products. You can unsubscribe with one tap, any time.

The rest of this document is the specific detail.

1. Who we are

Beyond Industries LTD (“we”, “us”) is a company registered in England and Wales at [REGISTERED OFFICE ADDRESS]. Company number [COMPANY NUMBER]. Beyond Scan is shipped under our Beyond TCG brand.

For any privacy-related question, contact us at privacy@beyondtcg.co.uk.

2. What data the App handles

2.1 On your device (never leaves)

The App stores the following locally, using Apple’s SwiftData framework backed by SQLite:

Your collections — cards you’ve scanned or manually added, quantities, conditions, purchase prices, dates, sources.
Your wishlist — cards you want.
Your trade history — trade lists you’ve generated, offers received, offers accepted.
Scan history — cards you’ve scanned (used for pricing cache and set-completion tracking).
Cached pricing — recent market prices we’ve fetched, so we don’t re-fetch them every time you open a card.
App preferences — currency display, condition defaults, notification preferences.

If you delete the App, all of this data is deleted with it. There is no cloud backup that persists after uninstall (unless you have iCloud backup enabled at the operating-system level, which is controlled by Apple, not by us).

2.2 What we transmit off your device

The App makes network requests to the following services on your behalf. None of these requests carry a user identifier we control.

Service	Purpose	Data sent
eBay Browse API	Current market pricing	Card name, set name, collector number, condition — no user identifier
PSA / Ace Grading	Certificate verification for graded cards	Certificate number — no user identifier
Card image CDNs	Card artwork	Image URL request — no user identifier
Cloudflare Worker (our OAuth broker)	Fetches short-lived eBay access tokens on the App’s behalf so the eBay client secret never ships in the App	An anonymous request per token refresh — no user identifier

Each of the above services has its own privacy policy, and the standard web-request metadata they collect (your IP address, request timestamp, user agent) is out of our direct control. We do not receive or store any of it.

2.3 If you opt in

You may choose to provide:

Your email address (marketing opt-in) — if you tick “Get updates from Beyond TCG” during sign-up. We store this only to send you those updates, and we use a reputable third-party email provider (currently Loops.so) to handle delivery. You can unsubscribe at any time using the link in every email.
Sign in with Apple — Apple gives us either your real email or a private relay address you can revoke at any time. We use this only to identify your account across your devices (for subscription entitlement and cross-device sync at the Business tier).

We do not collect your name, date of birth, address, or any other personal information unless you explicitly type it into a support conversation you initiate with us.

3. What we do NOT do

We do not use analytics SDKs (no Firebase Analytics, no Amplitude, no Mixpanel, no PostHog).
We do not use advertising networks or attribution SDKs.
We do not use tracking cookies (the App has no cookies).
We do not fingerprint your device.
We do not share, sell, rent, or trade your data with third parties for marketing purposes.
We do not “combine” your data with data from other sources to build profiles.
We are not part of Apple’s App Tracking Transparency framework — we don’t track, so the ATT prompt doesn’t apply.

4. Subscriptions and payments

Subscriptions (Pro, Business, Founder) are processed by Apple through the App Store. We never see your payment details — Apple gives us only an anonymous entitlement token confirming that you have an active subscription for a given product.

Apple’s privacy policy: apple.com/legal/privacy
To manage or cancel: Settings → Apple ID → Subscriptions on your device.

5. Legal basis for processing (UK GDPR)

On-device processing: not personal data leaving our systems. No legal basis needed.
Marketing email (opt-in): your consent, under Article 6(1)(a) UK GDPR. Withdrawable any time.
Sign in with Apple: contractual necessity — we cannot provide subscription entitlement across devices without an account identifier. Article 6(1)(b).
Support conversations: legitimate interest in helping you use the app. Article 6(1)(f).

6. Your rights

Under the UK GDPR, you have the right to:

Access — ask what data we hold about you.
Rectify — correct inaccurate data.
Erase — delete your data (right to be forgotten).
Restrict processing — pause use of your data.
Portability — get a copy in a portable format.
Object — refuse marketing at any time.
Complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint

To exercise any of these rights, email privacy@beyondtcg.co.uk. We will respond within 30 days.

In practice: since we store nearly everything on your device, the fastest way to delete all your data is to delete the App. For any email we hold under a marketing opt-in, use the unsubscribe link in any email or write to us.

7. Data retention

On-device data — kept as long as you use the App. Deleted when you delete the App.
Marketing email address — kept until you unsubscribe. On unsubscribe, we remove your address from active send lists and retain only a suppression record so we don’t accidentally re-mail you.
Support correspondence — kept for two years after our last exchange for reference; deleted after that unless you ask us to keep it longer.
Anonymous request logs at our Cloudflare Worker — kept for 7 days for operational debugging, then deleted.

8. Children

The App is rated 4+ in the App Store and does not knowingly collect personal information from anyone. The email opt-in requires an active account, which requires Sign in with Apple, which Apple restricts by age at the operating-system level. If you believe a child has provided us data, email privacy@beyondtcg.co.uk and we will delete it.

9. International transfers

Our email provider (Loops.so) and our OAuth broker (Cloudflare) are US-based companies with UK/EU data-processing agreements in place. Any transfer of your email address to them relies on the UK’s approved transfer mechanisms (Standard Contractual Clauses or equivalent adequacy decisions).