Privacy Policy

Overview

Hanlon Digital LLC ("we", "us", "our") operates ZeroPop, a trading card grading and collection management application for iOS. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By using ZeroPop, you agree to the collection and use of information as described in this policy.

Data We Collect

• Email address — provided optionally through Sign In with Apple. You may choose to hide your email.
• User ID — a unique identifier created via Firebase Authentication to associate your account with your data.
• Card images — photos you capture are uploaded to Firebase Storage for cloud sync across your devices. Card images are also sent to Google Cloud for grading analysis.
• Collection data — card metadata, grades, binder organization, and related information stored in Firebase Firestore.
• Purchase history — subscription status and transaction records managed through RevenueCat.
• Device attestation — Firebase App Check verifies that requests to our services originate from a genuine instance of ZeroPop, helping prevent fraud and abuse.

Data We Do NOT Collect

ZeroPop does not collect any of the following:

• Location data
• Contacts
• Browsing history
• Advertising identifiers
• Health data

How We Use Your Data

All data we collect is used exclusively for app functionality:

• Authentication — to sign you in and secure your account.
• Cloud sync — to keep your collection and card images available across your devices.
• Grading analysis — to process your card images and return grade estimates.
• Subscriptions — to manage your plan, enforce scan limits, and process payments.
• Fraud prevention — to verify legitimate app usage via device attestation.

We do not sell your data. We do not serve ads. We do not track you across apps or websites.

Third-Party Services

ZeroPop uses the following third-party services to operate:

Data Retention

• Your data is retained for as long as your account exists and is active.
• When you delete your account, all associated data is permanently deleted within 30 days.
• Banned accounts are retained for 30 days following the ban and then permanently deleted.
• Google may retain card images submitted for grading analysis for up to 30 days in accordance with their data processing policies.

International Data Transfers

ZeroPop uses Firebase and Google Cloud infrastructure located in the United States. If you are located outside the United States, your data will be transferred to and processed in the US. Google provides Standard Contractual Clauses (SCCs) to ensure adequate data protection for international transfers.

Your California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know — request what personal information we have collected about you.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to non-discrimination — we will not discriminate against you for exercising your rights.

We do not sell personal information. We will respond to verified requests within 45 days. To exercise your rights, contact us at zeropop@hanlon.digital.

Your European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your data under the following legal bases:

• Performance of a contract — to provide ZeroPop's core services (authentication, cloud sync, grading).
• Consent — where you have given explicit consent, such as providing your email address.
• Legitimate interest — fraud prevention and service security via device attestation.

Your Rights

• Access — request a copy of your personal data.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.
• Complaint — lodge a complaint with your local data protection authority.

Automated Decision-Making

ZeroPop uses automated analysis to produce card grade estimates. These grades are advisory in nature and carry no legal effect. They do not constitute professional grading opinions and should not be the sole basis for financial decisions. You are not subject to decisions with legal or similarly significant effects based solely on automated processing.

Children's Privacy

ZeroPop is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at zeropop@hanlon.digital.

Your Rights & Choices

• Use without an account — you may use ZeroPop's on-device scanning features without creating an account.
• Delete your account — you can delete your account at any time from the app's settings. All data is permanently removed within 30 days.
• Export your data — export your collection as a CSV file at any time from within the app.
• Request a data copy — contact us to receive a full copy of all data we hold about you.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and notify you through the app or by email if the changes are significant. Your continued use of ZeroPop after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

zeropop@hanlon.digital
Hanlon Digital LLC
United States