Privacy policy

This privacy policy explains how the Compleo website, available at https://compleoapp.com, the Compleo mobile app (iOS and Android) and the public member pages of compleoapp.com collect, use and protect your personal data.

The controller of the data collected through the Compleo website and app is: Teradev Studio, Rue du Verger 27, 1160 Auderghem, Belgique, VAT BE0550481730.

For any question about your data or to exercise your rights, use the address [email protected] or the contact form.

• Account: email address and password (stored in hashed form, never in plain text). If you use “Sign in with Apple” or “Sign in with Google”: the identifier of your Apple or Google account, the email address provided (with Apple, you can use a private relay address) and, if provided, your first and last name; with Google, the address of your Google photo, used as your profile photo until you choose another one.
• Profile: username and previous usernames, date of birth, your choice of a public or private profile and of appearing or not in the leaderboards and, if you add them, photo, bio, links to your social networks and showcase.
• Preferences and context: language, currency, collection language, reference marketplace, your phone’s time zone, the country of your App Store or Google Play account (read through RevenueCat, for the United States age rule and the choice of the reference marketplace), notification preferences.
• Collection and progress: cards, sealed products, binders, wishlist, price alerts, scan lists, the value of your collection and its history; XP, levels, streaks, quests, medals, season scores and results (with the season’s language).
• Scanner: cards are recognised on your phone; camera images are not sent. Our servers only receive the recognised card (card, language, variant), to count your scans and your XP. If you report a misrecognised card, the cropped photo of that card is sent to us with technical information (app version, operating system, language) and kept to improve recognition.
• Community: the members you block and the reports you make (reason and any comment).
• Referrals: your referral code, the code you entered and, for each referral, who invited whom, the date the code was entered, progress on the conditions (sign-up completed, first scan, email address verified), the date and details of the rewards granted, as well as your remaining free scans. A code received through an invitation link is kept on your phone until it is entered.
• “Discover Compleo on …” quests: the app opens Compleo’s account on the chosen social network; we only record that the quest was completed. Compleo does not send any data to the network; what you do there is governed by its own privacy policy.
• Notifications: if you allow them, a random installation identifier, your phone’s notification token (Firebase Cloud Messaging), the language, the platform and the categories chosen.
• Purchases: your Premium status and the history of your purchases (plan, price, currency, store country), received from RevenueCat. To manage your purchases, RevenueCat receives your account identifier and your username and, if you have accepted measurement (see below), your email address and technical identifiers of your phone. Payment is processed by Apple or Google; we never have access to your payment details.
• Usage measurement, with your consent: if you accept “Help us improve Compleo” (offered during the app’s onboarding and changeable in Settings › Privacy), the screens viewed and the actions taken in the app (for example “card added”, with the card identifier, without any amount or search text) are sent to PostHog (servers in the European Union), with your account identifier and some context (game, language, currency, Premium or not, level, app version, platform). If you decline, nothing is sent to PostHog. Regardless of this choice, our servers record, for our internal statistics and linked to your account, app opens, views of Premium features and of the Premium offer (the feature or screen concerned, the offers shown), when it is closed and, if you make a purchase, the plan, the amount and the currency, so we know which features lead to a subscription.
• Advertising campaign measurement, with your consent: the app shows no advertising. To learn which campaigns lead people to discover Compleo, it includes the Meta and TikTok SDKs. They are only activated if you have accepted measurement; they then receive app install, app open and completed sign-up events and technical data about the phone. On iPhone, the advertising identifier (IDFA) is only passed to them if you also allow it (App Tracking Transparency), and this permission is only requested if you have accepted measurement; without it, Apple only provides aggregated measurement (SKAdNetwork). On Android, the app does not request access to the advertising identifier; the Google Play install source (Install Referrer) is read by the TikTok SDK. If you have accepted measurement, your trial starts and Premium purchases are sent to Meta and TikTok by our servers, with your email address in hashed (unreadable) form, the technical identifiers of your phone passed to RevenueCat (Meta anonymous identifier and, on iPhone, the advertising identifier only if you have allowed it), the plan, the amount and the currency, to attribute the purchase to a campaign. If you decline, these SDKs remain inactive and your purchases are not sent.
• Diagnostics: technical error reports through Sentry, without your identity or your email address.
• Sign-in and security: the IP address and the type of device or browser of each sign-in session, and the technical logs of our servers.
• Contact: if you write to us from the app, your email address, the subject, the message, your account identifier, the phone model, the operating system and the app version. The message is sent to us by email and is not stored in our database.
• After a cancellation: if you reply to the email sent after you cancel Premium, your message.

• Cookie-free audience measurement: pages viewed, referring website, country, device and browser type, through Plausible, installed on our own servers (OVH). No cookie is set and your IP address is not stored.
• Audience measurement with your consent: pages viewed, clicks on the app download buttons, form submissions (without their content), language and device type, linked to a random identifier stored in your browser, through PostHog, and pages viewed, referring website, device and browser type, language and country inferred from your IP address, linked to a random identifier, through Google Analytics (Google Ireland Limited), without Google signals, without ad personalisation, without any account identifier or form content. This data is only collected if you have accepted audience measurement.
• Invitation page (compleoapp.com/r/…): shows the referral code in the address and checks that it exists; it reveals nothing about the referrer.
• Contact form: email address, subject and message. They are sent by email to our support team so we can reply, and are not stored in our database.
• “Notify me” (upcoming games): email address, chosen game and language. Your sign-up only becomes active once you confirm it through the link sent by email; every email contains an unsubscribe link.
• Affiliate program application: the program is currently closed. Applications already received (full name, email address, legal status, company number, link to the main channel or account, audience size, language and introduction) are kept for their review.
• Member pages: see “What others can see”.
• Technical data: IP address, date and requested page, processed by our servers and by Cloudflare to deliver the website and protect it against abuse.

The compleoapp.com website shows no advertising and uses no advertising pixel.

• You choose whether your profile is public or private; nothing is visible until you have chosen (this is the case for accounts created before the version dated 02/10/2026).
• If your profile is public, other members can see, in the app, your username, your photo (once approved), your bio, your links to your social networks, your level and your title, your medals and their dates, how long you have been a member, your numbers of cards, completed sets, Pokédex species and graded cards, your showcase and your public binders. The same information, except your social networks, appears on a public web page in your name (compleoapp.com/u/your-username), accessible without an account and not indexed by search engines.
• If you appear in the leaderboards, signed-in members can see your rank, your username, your photo, your level and your XP.
• If you were referred, your referrer can see, in the app, your username, your level and the progress of your referral; the invitation page compleoapp.com/r/… never shows the referrer’s username.
• Others can never see: your amounts (collection value, prices), your date of birth, your email address, your country.
• Under 13, the profile stays private and absent from the leaderboards. A member you block can no longer see your profile, and you can no longer see theirs.

The data collected is used to:

• run the website and the app and keep them secure;
• create, manage and sync your account and your collection across your devices;
• authenticate you, including through Google or Apple;
• show your public profile, your showcase, your public binders and the leaderboards, according to your choices;
• apply the age rules;
• allow members to be blocked and reported, and fight cheating in the leaderboards;
• manage your Premium subscription;
• manage referrals and grant their rewards;
• improve card recognition thanks to your reports;
• send you the emails related to your account (verification, password reset and password change) and the notifications you have enabled;
• answer your requests (support, suggestions, questions);
• let you know when a game is released, if you asked us to;
• review applications to the affiliate program (program currently closed);
• measure audience and usage and improve content and usability, with your consent when an identifier is used;
• measure the effectiveness of our app install campaigns, with your consent;
• diagnose technical issues and keep the app stable.

In accordance with the General Data Protection Regulation (GDPR), processing is based on:

• the performance of the contract (our terms of use), for your account, your collection, your progress (including quests), referrals, your profile and the leaderboards according to your choices, your subscription, account emails and the messages you send us from the app;
• your consent, for usage measurement in the app (PostHog), advertising campaign measurement (Meta and TikTok SDKs, sending your purchases to Meta and TikTok, advertising identifier on iPhone), notifications, audience measurement with an identifier on the website (PostHog, Google Analytics) and “Notify me” sign-ups. You can withdraw your consent at any time (Settings › Privacy in the app, “Manage cookies” on the website, your phone settings), without affecting processing already carried out;
• the legitimate interest of the publisher, for security and abuse prevention (sessions, logs, request limits), the protection of minors, the fight against cheating and referral abuse, technical diagnostics, improving the scanner from your reports, our internal statistics (app opens, views of Premium features and of the Premium offer, resulting purchases), cookie-free audience measurement on the website, keeping purchase records and handling contact requests and applications.

Your data is never sold. It is accessible to the following recipients, strictly for the purposes described:

• other members, for what you make public (see “What others can see”);
• OVH SAS (France): hosting of the API, the data and the website;
• Cloudflare, Inc.: delivery and protection of the website and the API, image storage (including profile photos);
• Google (Google Ireland Limited and Google LLC): sign-in with Google, notifications (Firebase Cloud Messaging), storage of profile photos (Firebase Storage), Google Play and, with your consent, audience measurement on the website (Google Analytics, Google Ireland Limited);
• PostHog (servers in the European Union): usage measurement in the app and audience measurement on the website, with your consent;
• Sentry (Functional Software, Inc., data hosted in Germany): error reports;
• RevenueCat, Inc.: purchase management;
• Apple: sign-in with Apple, App Store, aggregated SKAdNetwork measurement;
• Meta (Meta Platforms Ireland Limited) and TikTok (TikTok Technology Limited): advertising campaign measurement, with your consent;
• Brevo (Sendinblue SAS, France): sending emails;
• the authorities, when required by law.

Some providers (in particular Google, Cloudflare, RevenueCat, Sentry, Apple, Meta and TikTok) are established in the United States or belong to a group established there, and may process data there. These transfers are governed by an adequacy decision of the European Commission (including the EU - US Data Privacy Framework) or by its standard contractual clauses. You can ask us for a copy of these safeguards.

• Account, profile, collection, progress, photos of reported cards, devices registered for notifications: for as long as your account exists; deleted or erased when it is deleted (see “Deleting your account”).
• Sign-in sessions (IP address, device): 60 days at most.
• Access logs of our servers (IP address, device): automatically deleted by rotation, usually within a few days.
• Card view data used for trends: 8 days, in a form that does not contain your account identifier.
• Purchase records: 10 years (accounting obligations), including after the account is deleted, linked to an anonymous account.
• Internal usage statistics and messages sent after a cancellation: 3 years, including after the account is deleted, linked to an anonymous account.
• Contact messages: 3 years in the support mailbox.
• “Notify me”: until you unsubscribe, which erases your email address; an unconfirmed sign-up is erased after 30 days.
• Affiliate applications: 12 months.
• Usage measurement (PostHog, with your consent): 1 year.
• Website audience measurement (Google Analytics, with your consent): 14 months.
• Referrals: for as long as the accounts concerned exist; when an account is deleted, its code and its free scans are erased and the referrals remain linked to an anonymous account.
• Error reports (Sentry): 30 days.

You can delete your account at any time from the app (Profile › Delete my account; the steps are described on the Delete my account page). The deletion is scheduled 30 days later; you are signed out of your devices, and signing in again before that date cancels it. If your account uses “Sign in with Apple”, you confirm with Apple and Compleo’s access to your Apple identifier is revoked.

When that date is reached, your collection (cards, sealed products, binders, wishlist, alerts, scan lists), the value of your collection and its history, your progress (XP, medals, quests, streaks, season scores), your showcase, your profile photo, your blocks and reports (made and received), the photos of cards you reported, the devices registered for notifications and your usage measurement data at PostHog are deleted. The information that identifies you is erased: email address, username, password, Apple and Google identifiers, first name, last name, bio, social networks, date of birth, country and time zone.

What remains, without any information that identifies you in our database: the records of your purchases and internal usage statistics (see “Retention periods”), your rank and your XP in season leaderboards already closed (without your username), and the public contributions made on pokedexia.com, attributed to a deleted account. RevenueCat keeps the history of your purchases according to its own retention periods. Your username stays reserved for 90 days, then becomes available again.

Deleting your account does not cancel an active subscription: cancel it in the App Store or Google Play.

If you can no longer access the app, send your request through the address [email protected] or the contact form, from the email address linked to your account.

In accordance with the applicable regulations, you have the following rights over your personal data:

• right of access;
• right to rectification;
• right to erasure (right to be forgotten);
• right to restriction of processing;
• right to object;
• right to data portability, where applicable;
• right to withdraw your consent at any time, without affecting processing already carried out.

You can change most of your data directly in the app (profile, preferences, notifications, visibility, measurement). To exercise your rights, use the address [email protected] or the contact form, from the email address of your account if the request concerns it. We will reply within one month, which may be extended in the cases provided for by the GDPR. You may also lodge a complaint with the Data Protection Authority (Belgium, www.dataprotectionauthority.be) or with the authority of your country of residence.

Your date of birth is used to apply the age rules. Under 13, the profile stays private and does not appear in any leaderboard. If the country of your App Store or Google Play account is the United States and you are under 13, sign-up is refused and the account being created is deleted immediately, without keeping your date of birth.

Notifications are only sent if you allow them on your phone. In the app settings, you choose the categories: Price alerts, Releases and new cards, News (articles and important announcements). Turning off a category or the phone permission stops the corresponding notifications.

The compleoapp.com website only uses audience measurement cookies (PostHog, Google Analytics) with your consent. Details are in our Cookie policy.

The app does not use cookies. It stores on your phone what it needs (sign-in session, preferences, installation identifier, your measurement choice, the code from an invitation link until it is entered) and, only if you have accepted measurement, the identifiers of PostHog and of the Meta and TikTok SDKs.

We implement reasonable technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure (encrypted connections, hashed passwords, restricted access to data).

This privacy policy may be updated to reflect changes to the website, the app or the law. The date of the version in force is shown at the top of this page. In the event of a significant change, you will be informed in the app.