Holomark privacy policy
Last updated: 9 November 2026
Holomark is built to need as little of your data as possible. There's no account, no advertising and no tracking. Your collection lives on your phone.
Who we are
Holomark ("we") is run by its developer, trading as Holomark, in Scotland, United Kingdom. We are the data controller for the limited data described below. Contact: [email protected].
We handle personal data under the UK GDPR and the Data Protection Act 2018, which apply across the UK including Scotland, and the Privacy and Electronic Communications Regulations 2003 (PECR) for push notifications and anything stored on your device. Holomark uses no advertising or tracking cookies.
What stays on your phone
- Your collections, wishlists, prices paid, targets and settings are stored only on your device.
- Card scanning: photos are read on your phone by Google ML Kit's on-device text recognition and are never uploaded by Holomark.
- Your own card photos (pictures you add for cards that have no official picture yet) are stored on your phone and included in backups you make. They are only sent to us if you switch on “Help recognise cards” (see below).
- Price alerts (wishlist targets and alerts on any card) are checked on your phone; they are not sent to us.
- Live scanner (optional, Android): while you have it switched on, Holomark reads the cards shown on your screen using on-device text recognition. Screen images are processed on your phone only — never saved, recorded or uploaded. Android asks your permission each time and shows a notification while it runs.
- Google Drive backup (Holomark Pro, optional): your backup is saved in a hidden Holomark folder in your own Google Drive. It goes straight from your phone to Google; we never see or store it.
- Your location (only if you tap “Use my location”) is used on your phone to sort nearby shops and is never sent to us. All UK shop locations are downloaded to your phone, so finding nearby shops needs no location lookup on our side. Your favourite shops are stored on your phone and, if you turn on alerts, as part of your alert choices.
- Android may include Holomark's data in your Google account backup (controlled by you in Android settings and covered by Google's privacy policy). Backup files you choose to export are saved wherever you choose.
What we receive, and why
| Data | When | Why | Kept for |
|---|---|---|---|
| Card list and price downloads (no personal data) | When the app updates prices | To show prices | Not stored per user |
| Listing titles you check (Price check, browser extension) | When you check a listing | To identify the card | Not stored |
| Push notification token + your alert choices (products, shops, price limit, regions, quiet hours) | Only if you turn on restock alerts | To send the alerts you asked for (consent) | Until you turn alerts off (deleted immediately) or the token stops working |
| Restock and graded-sale reports: what you reported, a random per-install ID, and a scrambled (hashed) version of your IP address | Only when you send a report | To show checked community information and prevent abuse (legitimate interests) | 12 months |
| A postcode you type to find shops (e.g. “LS1”) | Only if you search by postcode | Sent directly to postcodes.io (free UK open-data service) to turn it into map coordinates; not sent to us | Not stored by us |
| Map tiles | When you view the shop map | Map images are loaded from OpenFreeMap, which sees your IP address and the area being shown, like any website | Per OpenFreeMap's own policy |
| Google sign-in token (proves which Google account you are; includes your email address) | Only if you tap “Continue with Google” (Holomark Pro) | To check whether your account has Pro, including Pro given as a gift (contract / legitimate interests) | Not stored. If we give your account Pro as a gift, we keep only a one-way scrambled (keyed hash) form of the email |
| Google Play subscription token | When you subscribe to Pro or the app checks your subscription | To confirm with Google Play that your subscription is active (contract) | Stored scrambled (hashed) with its status, for as long as the subscription runs plus 12 months |
| A card photo you add, the card it shows, and a scrambled (hashed) version of your per-install ID | Only if you switch on “Help recognise cards” (off unless you choose it), for cards with no official picture | To help the scanner recognise that card for everyone (consent). The photo is turned into an anonymous fingerprint (a list of numbers that can't be turned back into the picture) in memory and then deleted straight away; it is never saved or shown to anyone | The photo: not stored. The fingerprint: until the card gets an official picture or you ask us to delete it |
| Which card you open for slab prices, or tap “Find it on eBay” for (not linked to you) | When you view graded prices or tap the eBay button | To look up that card's current eBay UK listings, and to send you to eBay's search for it | Only as the card itself (when it was last looked up); nothing about you is stored |
| Bug reports you choose to send: the app version, phone model and Android version, and the live scanner's log (when it started and stopped, and any errors; never what was on your screen), with a scrambled (hashed) install ID | Only when you tap “Send bug report” | To find and fix problems (legitimate interests) | 90 days |
| Basic server logs (time, page requested, error codes) | Any request | Security and reliability (legitimate interests) | 30 days |
You don't need an account to use Holomark. We never ask for your name or contacts, your email is only seen if you choose “Continue with Google” (and is not stored), and your location never reaches our server. In-store reports include only the shop name, town and region you type.
Who else is involved
- Expo / Google Firebase Cloud Messaging deliver push notifications (they receive the push token and the alert text).
- Google: Google Play handles Pro payments (we never see your card details) and Google Sign-In / Google Drive handle sign-in and Pro backups, under Google's own privacy policy.
- Our hosting provider Hetzner Online GmbH (Germany, EU) runs the Holomark server.
- Shops, eBay and affiliate networks: when you tap “Buy” or “Find it on eBay”, you go to the shop's or eBay's website, sometimes through an affiliate link. The shop, eBay or the network (e.g. eBay Partner Network, Awin) may use cookies to credit Holomark a small commission. Their own privacy policies apply; we never receive your eBay or shop account details.
- OpenFreeMap (map images) and postcodes.io (postcode look-ups) receive requests directly from your phone when you use the shop map.
- Shop locations come from OpenStreetMap (© OpenStreetMap contributors).
- Card data and prices come from official and open sources (TCGdex, pokemontcg.io, PokéWallet, Cardmarket and TCGplayer via those, and eBay's official API). We send them no information about you. Holomark doesn't store eBay members' personal data (only listing titles and prices) and answers eBay's account-deletion notices.
We do not sell or share your data for advertising. Where data is processed outside the UK, it is protected by appropriate safeguards (e.g. UK adequacy regulations or standard contractual clauses).
Your rights
Under UK GDPR you can ask to access, correct or delete your data, object to processing, or withdraw consent. Turning off restock alerts deletes your token and alert choices straight away. For anything else, email [email protected]. Because we don't know who you are, we may ask for your report details or device ID (shown in the app) to find your data. We'll reply within one month. You can complain to the Information Commissioner's Office, the UK regulator, which has an office for Scotland in Edinburgh (ico.org.uk, 0303 123 1113), but please contact us first so we can try to help.
Children
Holomark is not directed at children under 13 and does not knowingly collect their data.
Changes
We'll update this page if anything changes and show the new date at the top. Significant changes will also be mentioned in the app.
Holomark is independent and not affiliated with, endorsed or sponsored by Nintendo, Creatures, GAME FREAK or The Pokémon Company.