Privacy Policy

This Privacy Policy explains how Ahmed Sohail Malik, an independent app developer ("Preslab", "we", "us", or "our"), handles information in connection with the Preslab mobile application for iOS (the "App").

Preslab does not require you to create an account, and we do not sell your personal information. Your collection is stored on your device and backed up to our cloud service so it survives reinstalling the App. On first launch the App asks for tracking permission; if you grant it, we use your device's advertising identifier to measure which marketing campaign led to your install.

1. Who We Are (Data Controller)

Preslab is developed and operated by an individual developer. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), the data controller is:

• Data controller: Ahmed Sohail Malik (individual developer)
• Contact: maximusislamabadg84@gmail.com

All privacy questions and requests should be sent to the email address above. We handle every request through email; there is no postal contact channel for this App.

2. Information We Process

2.1 Card images you capture

When you scan a sports card, the App captures an image using your device camera or an image you select from your photo library. That image is transmitted to our servers and/or our image-processing providers so we can:

• Identify the card (player, set, year, parallel, serial numbering);
• Retrieve an estimated market value based on comparable sales data; and
• Generate an AI pre-grading assessment (for example, centering, corner, edge, and surface indicators) intended to help you decide whether to submit the card to a third-party grading company.

Card images are ordinarily photographs of trading cards and are not intended to contain personal information about you. Please avoid capturing faces, documents, or other personal content in the frame. We do not use card images to identify individuals, and we do not collect biometric identifiers or facial recognition data.

A copy of each scanned image is retained in our cloud storage (Cloudflare R2) so that your scans and collection can be restored if you reinstall the App or move to a new device. Images are kept for as long as the associated card remains in your collection, and are deleted when you delete that card from the App or ask us to delete your data (see Sections 8 and 9).

2.2 Collection data (on your device and in our cloud)

Cards you save, folders, notes, purchase prices, and your collection value history are stored on your device and synchronized to our cloud database (Google Firebase Firestore) so your collection survives reinstalling the App or switching to a new device. This data is stored under an app-generated identifier assigned to your installation, not under your name or email address.

Because this data is held in our systems, we are technically able to access it. We access it only to operate and troubleshoot the service, to investigate an issue you report to us, or where we are required to by law — never to build a profile of you or for advertising.

2.3 Technical and usage data

We and our service providers automatically process limited technical information so the App works and so we can fix problems:

• Device model, operating system version, App version, language and region settings;
• A non-permanent app-generated identifier or vendor identifier (IDFV);
• Crash logs, error reports, and performance diagnostics;
• Aggregated in-app usage events (for example, number of scans performed, features opened);
• IP address, which may indicate approximate country-level location. We do not collect precise GPS location.

2.4 Subscription and purchase data

Preslab offers a free tier and optional paid subscriptions. All purchases are processed by Apple through the App Store. We never receive or store your payment card number, billing address, or Apple ID password. We receive only the subscription status and anonymized transaction receipt needed to unlock paid features and handle refunds or restore-purchase requests. See Apple's Privacy Policy.

2.5 Information you send us voluntarily

If you contact support, submit feedback, report a mis-identified card, or request data deletion, we process the email address and any content you choose to include, solely to respond to you.

2.6 Camera and photo library permissions

The App requests access to your camera to scan cards, and optionally to your photo library if you choose to import an existing image. We access only the specific images you capture or select. You can revoke these permissions at any time in iOS Settings → Privacy & Security; scanning features will not work without camera access.

3. What We Do Not Do

• We do not sell your personal information.
• We do not share your personal information with third parties for their own advertising or marketing.
• We do not use your card images or collection data to build advertising profiles about you.
• We do not collect precise GPS location, biometric identifiers, or facial recognition data.
• We do not knowingly collect data from children (see Section 10).

3.1 Advertising identifier and App Tracking Transparency

The App presents Apple's App Tracking Transparency ("ATT") prompt when you first open it, and links Apple's AdSupport framework in order to do so.

• If you allow tracking: the App may access your device's Advertising Identifier (IDFA) and include it in the install-attribution data we send to our attribution provider, AppsFlyer. We use this to understand which marketing campaign led to your install and how our advertising performs.
• If you decline: no IDFA is collected, and attribution is performed without it. Declining has no effect on your ability to use any feature of the App.

The App briefly waits for your response to the ATT prompt before sending its first attribution event, so that the event reflects the choice you actually made. You can change your decision at any time in iOS Settings → Privacy & Security → Tracking.

Separately from attribution, we use product analytics (Firebase Analytics and Mixpanel) to understand how features are used within the App. These are not used to track you across other companies' apps or websites.

4. Why We Process Your Data and Our Legal Bases (GDPR)

• Identify scanned cards, return values and pre-grade estimates
  • Data used: Card images, technical data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Operate, secure, and troubleshoot the App
  • Data used: Technical data, crash logs
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Improve scanning accuracy and product features
  • Data used: Aggregated usage data; card images only where permitted (see Section 5)
  • Legal basis: Legitimate interests, or consent where required (Art. 6(1)(a)/(f))
• Provide and manage subscriptions
  • Data used: Subscription status, receipt data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Respond to support requests
  • Data used: Email address, message content
  • Legal basis: Legitimate interests / consent (Art. 6(1)(a)/(f))
• Comply with legal obligations and enforce our terms
  • Data used: As required
  • Legal basis: Legal obligation, legitimate interests (Art. 6(1)(c)/(f))

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Model Training

We may use scanned card images in de-identified form to improve the accuracy of our card-recognition and pre-grading models. Choose one and delete the other: (a) We do this only where you have opted in through in-App settings; or (b) We do this by default, and you may opt out at any time in Settings → Privacy. Images used for this purpose are stripped of device identifiers and are not linked to you.

6. Who We Share Data With

We share data only with service providers ("processors") that help us run the App, under terms requiring them to protect it and to use it only on our instructions:

• Cloud hosting and database: Google Cloud / Google Firebase (Firestore) — collection data
• Cloud object storage: Cloudflare R2 — scanned card images
• AI / image recognition processing: OpenAI
• Crash reporting: Apple App Analytics, Firebase Crashlytics
• Product analytics: Firebase Analytics, Mixpanel
• Install attribution and marketing measurement: AppsFlyer (receives the IDFA only where you have allowed tracking — see Section 3.1)
• Payments and subscription management: Apple

7. International Transfers

Our service providers may store and process data in the United States and other countries, which may be outside the country where you live. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. You can request details of the safeguards we use by emailing us.

8. How Long We Keep Data

• Scanned card images (cloud storage): Retained for as long as the associated card remains in your collection, so that your scans can be restored. Deleted when you delete the card in the App, or within 30 days of a verified deletion request.
• Collection data on your device: Until you delete it or uninstall the App
• Collection data in our cloud database: Retained so your collection can be restored after a reinstall. Deleted when you delete the card in the App, or within 30 days of a verified deletion request. Uninstalling the App alone does not delete it.
• De-identified images used for model improvement: Retained while relevant to model quality; no longer linked to you
• Install attribution data (including IDFA where you have allowed tracking): 24 months
• Crash logs and diagnostics: 90 days
• Aggregated usage analytics: 24 months, in aggregate form
• Subscription and transaction records: As required by tax and accounting law, typically 7 years
• Support correspondence: 24 months after the matter is closed

9. Your Rights

9.1 If you are in the EEA, UK, or Switzerland (GDPR)

You have the right to: access your personal data; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent; and lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office.

9.2 If you are a California resident (CCPA/CPRA)

You have the right to know what personal information we collect and how it is used and shared; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age. You may exercise your rights by emailing us; we will verify your request using the information reasonably available to us, which may be limited because the App does not use accounts.

9.3 Other US state privacy laws

Residents of states including Virginia, Colorado, Connecticut, Utah, and Texas have comparable rights to access, delete, correct, and port their data, and to opt out of targeted advertising and profiling. We honor these rights through the same contact channel.

9.4 How to exercise your rights

Email maximusislamabadg84@gmail.com with the subject line "Privacy Request". We will respond within 30 days (or 45 days for CCPA requests, extendable where permitted). Exercising these rights is free unless a request is manifestly unfounded or excessive.

You can also delete most data yourself: delete individual cards inside the App, or uninstall the App to remove all locally stored collection data. Uninstalling does not automatically delete data held on our servers — email us if you want that removed too.

10. Children's Privacy

Preslab is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for stored images, restricted access to production data, and regular review of our providers' security posture. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities where required by law.

12. Third-Party Services and Links

Estimated values shown in the App are derived from publicly available marketplace and sales data and are provided for informational purposes only. They are estimates, not appraisals or financial advice. AI pre-grading assessments are predictions and do not guarantee any grade from PSA, BGS, SGC, CGC, or any other grading company. Preslab is not affiliated with, endorsed by, or sponsored by any grading company, card manufacturer, league, team, or marketplace. The App may link to third-party sites governed by their own privacy policies.

13. Apple App Store Disclosures

Our App Store privacy labels reflect the practices described here. The App presents Apple's App Tracking Transparency prompt on first launch and, if you grant permission, may use the Advertising Identifier (IDFA) for install attribution as described in Section 3.1. You can withdraw that permission at any time in iOS Settings → Privacy & Security → Tracking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the "Last updated" date. If changes are material, we will provide notice in the App before they take effect. Continued use of the App after the effective date means you accept the updated policy.

15. Contact Us

For any questions, complaints, or privacy requests relating to Preslab, contact:

• Developer: Ahmed Sohail Malik
• Email: maximusislamabadg84@gmail.com