privacy_tip Legal

Privacy Policy

Last updated October 21, 2026 · Effective October 21, 2026

Utopia POS keeps your business records so you can use them on your phone and back them up. We do not sell your personal information, and the app has no advertising or tracking. Camera scans and trade photos stay on your phone. You can delete your account in the app.

On this page
  1. Introduction
  2. What we collect
  3. What we do not do
  4. How we use information
  5. Who we share it with
  6. Keeping and deleting your data
  7. Security
  8. Your rights and choices
  9. Children
  10. International users
  11. Changes and contact

1. Introduction

This Privacy Policy explains what Utopia (“Utopia,” “we,” “us”) collects, uses and shares when you use the Utopia POS iPhone app and the utopiamarket.app website (together, the “Service”). Utopia POS helps trading-card vendors scan cards, log trades, buys and sales, and keep an inventory. It supplements our Terms of Service.

Questions: legal@utopiamarket.app.

2. What we collect

2.1 Account

  • Email address, to sign you in, confirm your account, reset your password and send service emails.
  • Business name (and a username we generate from your email or business name), shown in the app and in emails to you.
  • Password. We store only a salted hash, never the password itself.
  • If you join the waitlist on the website, your email address.

2.2 Your business records

The trades, buys, sales, adjustments, events and daily figures you log in the app, including the cards, quantities, prices, costs and notes you enter, are stored on your phone and synced to our servers so they are backed up and available on your other devices. They are linked to your account and are not visible to other vendors or users.

2.3 Device and app information

  • A random device identifier created for each install, and the device name (for example “Sam’s iPhone”), sent when you sign in and with each sync, so you and we can tell your sessions apart and end one if a phone is lost.
  • The app version, sent with requests, so we can ask you to update if a change needs it.
  • If you turn on alerts, your push notification token, so we can send them.
  • Your alert settings (for example a weekly profit target and which alerts you want).

2.4 Things that stay on your phone

  • Camera. The app asks for camera access to scan cards. Scanning runs on your phone; camera images are not uploaded to us.
  • Trade photos you attach to a record stay on your phone. We do not receive them.
  • Location. The app does not use your location. Events are filtered by the region you choose.

2.5 Security and operations

We record what is needed to protect accounts: failed sign-in counts and temporary lockouts, session (refresh token) records, and rate-limit counters by IP address. Our server keeps a short in-memory log of recent requests (method, path, status, timing) that is cleared when the server restarts. Hosting providers may log your IP address in the ordinary course of running the service. Admin actions (for example inviting or removing a vendor) are written to an audit log.

3. What we do not do

  • We do not sell your personal information or share it for advertising.
  • We do not track you across other companies’ apps and websites, and the app has no advertising or analytics SDKs.
  • We do not collect your contacts, photos library, health data, financial account details or precise location.

4. How we use information

  • To run the Service: sign you in, sync your records, show card details and prices, list events, and send the alerts you turn on (price moves on cards you hold, new sets, new events, your weekly target).
  • To keep accounts and the platform secure and to prevent abuse.
  • To email you: confirmation, password reset, invitations and important service notices. We do not send marketing email without your consent.
  • To fix problems, keep the service reliable and plan changes, using aggregate figures and the operational logs above.
  • To meet legal obligations.

5. Who we share it with

Only with providers that run the Service for us, under their own privacy commitments:

  • Google Cloud, which hosts our servers, database and file storage in the United States.
  • Apple, to deliver push notifications through the Apple Push Notification service, and for TestFlight and the App Store.
  • Our email provider, which delivers the emails above.
  • Card data sources (such as the Pokémon TCG API, Scryfall and others) supply card information and prices to our servers. We send them card identifiers, never information about you.
  • Google Fonts on some website pages (not the landing page or the sign-up pages), which receives your IP address when the font loads.

We may disclose information if the law requires it, to protect people or the Service, or in a merger or sale of the business, with notice to you.

6. Keeping and deleting your data

We keep your account and records while your account is open. You can delete your account in the app. Sign-in stops and all your sessions end at once; we keep the data for 30 days so a mistake can be undone, then delete your profile and business records, and anonymise the account. Backups roll off on the provider’s normal schedule. Sign-ups whose email was never confirmed are deleted about a week after their link expires. Records we must keep for legal reasons stay as long as the law requires.

To delete your data without the app, email legal@utopiamarket.app from your account address.

7. Security

Passwords are hashed. The app keeps its sign-in tokens in the iOS Keychain. Traffic uses HTTPS. Sign-in locks after repeated failures and sensitive endpoints are rate limited. No system is perfectly secure, so please use a strong, unique password.

8. Your rights and choices

  • Access and correction: your records are in the app; email us for anything else.
  • Deletion: in the app, or by email (see above).
  • Notifications: change them in the app or in iOS Settings.
  • Camera: allow or revoke it in iOS Settings.

California. You may ask what we hold about you, ask us to correct or delete it, and ask us not to sell or share it (we do not). We will not treat you differently for asking. EEA, UK and Switzerland. You may ask for access, correction, erasure, restriction, portability or object to processing, and complain to your regulator. We process your data to provide the Service you asked for, to keep it secure, and to meet legal duties. Email legal@utopiamarket.app.

9. Children

Utopia POS is for adults who run a business selling cards. It is not directed to children under 13 and we do not knowingly collect their information. If you think a child has given us information, email us and we will delete it.

10. International users

We run the Service from the United States. If you use it elsewhere, your information is transferred to and processed in the United States.

11. Changes and contact

We will update this page when what we collect changes, and change the date above. For a material change we will tell you in the app or by email first. Contact: legal@utopiamarket.app, or use the support page.