Rarebox
Privacy Policy
Effective 5 November 2026
Rarebox is an iOS app developed and operated by 42pixels FZ-LLC, a company registered in Abu Dhabi, United Arab Emirates. In this policy, "Rarebox", "we" and "us" mean that company. The policy covers the app "Rarebox" on the App Store (listed as "Rarebox: TCG Card Scanner", formerly "CardWorth - Card Value Scanner", App Store ID 6777936063) and its pages on 42pixels.co. It explains what we collect, what stays on your iPhone, who processes your data, how long we keep it and how you can delete it. It takes effect on 5 November 2026 and replaces the privacy policy previously linked from Rarebox's App Store page and from the app.
In short: Rarebox does not track you and shows no ads. It needs no account, and we never ask for your name, email address or password. When you scan a card, the app reads the card's text on your iPhone and sends only that text to find the match. The photo never leaves your iPhone.
What stays on your iPhone
These stay on your device and are not sent to us or anyone else:
- the camera picture while you scan. Rarebox reads the card's text on your iPhone with Apple's on-device text recognition. Camera frames are processed in memory and are never saved or uploaded.
- your currency choice and other settings
- a copy of the card catalog, card pictures and your saved cards, kept so that the app opens quickly and works when your network is slow.
Deleting the app removes all of this from your iPhone.
What we collect
Your app identity
Rarebox has no sign-in screen. When you first open the app, it signs in anonymously with Firebase Authentication, which creates a random user ID for this installation. That ID keeps your Watchlist and collections together and lets us check your Premium subscription. It is not linked to your name, your email address or your Apple Account.
Cards you save
When you save a card to your Watchlist or to a collection, our server stores it with your app identity: which card it is, which list it is in and when you saved it. When you create or rename a collection, we store the name you give it.
Scanning
When you scan a card, the app sends the text it read from the card, and the game you chose, to our server, which finds the matching cards. The photo is never uploaded. We do not keep a history of your scans with your app identity. So that the next scan of the same card is answered faster, the server keeps each scan's result in a shared cache, labelled by the card's text and not linked to you or to any app identity.
Search
What you type in Search is sent to our server to find cards and sets. Search results are kept in the same kind of shared cache, not linked to you.
Card details, pictures and prices
Card details, pictures and prices come from Scrydex, our card data provider. Our server asks Scrydex for the cards that match your search or scan. It sends only the search words, words taken from the card's text (such as its name, number and set code) or a card's ID, and never your app identity. Card pictures load on your iPhone directly from the card data provider's image servers, which see your device's IP address, as any website does.
To show prices in your currency, the app reads the day's exchange rates from our server. Our server gets them once a day from ExchangeRate-API. No data about you is involved.
Purchases
Premium is billed by Apple through your Apple Account. We do not receive your payment details. To check whether you have Premium, the app uses RevenueCat, which manages subscriptions for us. RevenueCat receives your Rarebox user ID, your App Store purchase records and basic technical details, such as the app version and your App Store country. Rarebox sends RevenueCat no advertising identifier.
Saving a picture to Photos
When you share a card, Rarebox makes a picture of it with its value. If you choose Save Image in the share sheet, iOS asks your permission to add the picture to your photo library. Rarebox can only add pictures there. It never reads your photo library.
Links to card marketplaces
A card page links to TCGplayer, Cardmarket, eBay and other card sites. These links open in your browser, and those sites' own privacy policies apply. Some eBay links are affiliate links. eBay can tell that you came from Rarebox, and we may earn a small commission if you buy, at no extra cost to you.
No tracking, no ads
Rarebox does not track you. It shows no ads, has no analytics or crash reporting tools, does not use the advertising identifier and does not show the iOS tracking prompt. We do not sell your data or share it with advertisers or data brokers.
The website
Rarebox's pages are part of 42pixels.co, which sets no cookies and runs no analytics or advertising. See the 42pixels privacy policy for the website.
Support requests
If you email support@42pixels.co, we keep your message and our replies so that we can answer you and follow up if needed. We keep support emails for a reasonable period after the request is closed and then delete them.
Who processes your data
Rarebox runs on services from the providers below. Each receives only what it needs for its task.
| Provider | What it does for Rarebox | What it receives |
|---|---|---|
| Google (Firebase and Google Cloud) | Anonymous app identity, our server, the database that keeps your saved cards, and the shared card cache | Your app identity, the cards you save and your collection names, the text of your scans and searches, and your device's IP address when the app connects |
| Scrydex | Card details, prices and pictures | From our server: search words, words from a scanned card's text and card IDs, never your app identity. From your iPhone: its IP address when a card picture loads |
| RevenueCat | Premium subscription status | Your Rarebox user ID, your App Store purchase records and basic technical details |
| Apple | App Store billing, on-device text recognition, the share sheet and adding pictures to Photos | Billing is handled by Apple under Apple's own terms. Text recognition runs on your iPhone and sends nothing to us |
These providers process data only to provide their service to Rarebox, and each is bound to protect your data at least as well as this policy does. While a provider processes your data, its own terms also apply to that processing.
How we use your data
We use your data to:
- provide the service: find cards, show their details and prices, and keep your Watchlist and collections
- check your Premium subscription
- keep the service fast, safe and free of abuse
- answer your support requests.
We do not sell your data, and we do not use it for advertising.
Legal bases
Where the law requires a legal basis for processing, for example in the EU and the UK, we rely on the following.
- Contract. Providing the service you asked for, keeping your saved cards and collections, and providing Premium.
- Legitimate interests. Keeping the service fast and secure, for example with the shared card cache and server logs, and preventing abuse. We keep this processing to what a user would reasonably expect.
The camera and adding pictures to Photos work only after you allow them in the iOS prompt. You can turn either off at any time in iOS Settings.
Retention and deletion
- Your saved cards and collection names are kept with your app identity until you remove them or ask us to delete everything.
- When you remove a card from your Watchlist or a collection in the app, it is deleted from our servers.
- When you delete a collection, its name is deleted. As the app says when you delete it, the cards that were in it stay saved with your app identity.
- Shared search and scan results are not linked to anyone. They are refreshed and replaced over time.
- Server logs are kept for about 30 days, the standard Google Cloud logging retention.
- Support emails are kept for a reasonable period after the request is closed.
- Deleting the app removes everything on your iPhone. Because Rarebox has no account, it does not delete what is stored on our servers.
To delete everything we hold, email support@42pixels.co with the subject "Delete my Rarebox data". Rarebox has no account and does not show your user ID, so we need a way to find your data. If you subscribed to Premium, include the order ID from Apple's receipt email. It leads to your app identity, and we then delete your saved cards, your collections and your app identity, and ask RevenueCat to delete your subscription record. If you never subscribed, nothing we hold is linked to your name, your email address or your Apple Account, so we may not be able to tell which data is yours. You can still remove your cards in the app at any time.
International transfers
Our server runs on Google Cloud in the United States, and our providers may process data in the United States and other countries. If you live in the EU, the UK or another place whose law restricts transfers abroad, we rely on standard contractual clauses or equivalent safeguards where the law requires them.
Security
- Every request that reads or changes your saved cards carries your anonymous Firebase identity, and our server reads and writes only that identity's own data.
- Database rules stop one installation from reading another installation's saved cards.
- Data travels over encrypted connections (TLS), and Google Cloud encrypts it at rest.
No system is completely secure. If you have found a security problem, email support@42pixels.co.
Children
Rarebox asks no one for their name, email address or age. It is not directed at children under 13, or under 16 where the law sets that age, and we do not knowingly collect personal data from children below that age. If you believe a child has given us personal data, for example in a support email, write to us and we will delete it.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you
- correct it if it is wrong
- delete it
- receive a copy in a portable form
- object to, or ask us to restrict, certain processing
- complain to a supervisory authority.
You can do much of this yourself in the app: see everything you saved in Collections, remove cards and delete collections, and turn camera or Photos access off in iOS Settings.
For anything else, email support@42pixels.co. We may ask you to confirm that the data is yours before we act. We respond within the time the applicable law requires.
If you live in the European Economic Area or the United Kingdom, you have these rights under the GDPR and the UK GDPR, and you can complain to your national data protection authority. If you live in California, you have the rights to know, delete and correct your personal information and not to be discriminated against for exercising them. We do not sell or share your personal information as those terms are defined in California law. If you live in the United Arab Emirates, you have rights under the UAE Personal Data Protection Law, including access, correction, deletion and objection. Residents of other places may have similar rights under their own laws. Wherever you live, write to the same address and we will apply the rights that your law gives you.
Changes to this policy
We will update this policy when Rarebox changes, for example when we add a feature or change a provider. The date at the top of this page shows when the current version took effect. If a change is significant, we will say so in the app's release notes on the App Store before it takes effect.
Contact
Rarebox is developed and operated by 42pixels FZ-LLC, Abu Dhabi, United Arab Emirates. For questions about this policy or your data, email support@42pixels.co. Our Terms of Use are at /p/rarebox/terms.