Privacy Policy

This Privacy Policy explains how Gundex (“we”, “our”, or “us”) collects, uses, and protects personal information when you use the Gundex mobile app, the marketing website at gundex.io, the web companion at gundex.app, and related services (collectively, the “Service”).

Your GUNDEX account and supported saved information are shared between the app and web companion.

1. Information We Collect

• Account Information: email address, username, and profile details you provide, including optional contact details and profile photos.
• Collection and Sharing Information: your cards, quantities, favorites, wishlists, binders, decks, notes, preferences, and sharing choices.
• Usage Information: basic technical information required to operate, understand, and improve the Service, including app interactions, screen views, app and device information, approximate location derived from IP address, and a pseudonymous Firebase app-instance identifier.
• Subscription and Purchase Information: product, price, currency, purchase date, renewal status, cancellation status, expiration status, billing status, platform, transaction identifiers, and a RevenueCat app-user identifier.
• Communications: messages you send when contacting support.
• Email Preferences and Consent Records: your optional email subscription choice, the date and time of your consent, and the version of the consent wording shown to you when you opt in.

2. How We Use Your Information

• Provide and maintain app features
• Authenticate users and manage accounts
• Provide customer support
• Improve security and reliability
• Deliver necessary account and security emails
• With your separate opt-in, send optional product news and testing or translation invitations and manage your email preferences
• Measure feature adoption, onboarding completion, collection engagement, subscription performance, and product reliability
• Comply with legal obligations

Email Communications and Preferences

Necessary account and security emails

GUNDEX sends emails needed to operate and protect your account, such as email verification, sign-in or password-reset messages, security alerts, and essential account notices. These emails do not require an optional email subscription.

Optional news and invitations

With your separate opt-in, GUNDEX may send product news, feature announcements, and invitations to participate in testing or translation activities. We expect these emails to be occasional, generally around once a month, with additional invitations when opportunities arise.

Subscribing is optional and is not required to create an account or use GUNDEX. Creating an account, accepting our Terms, or continuing to use GUNDEX does not subscribe you to these emails.

Email delivery and consent records

We use Resend to deliver emails and manage optional email subscription preferences, including unsubscribe requests. Resend processes your email address, email content, subscription status, and delivery information as needed to provide these services.

When you choose to subscribe, we record your choice, the date and time of your consent, and the version of the consent wording shown to you. We store these records with our application-data provider, Supabase, and synchronize your optional email subscription status with Resend.

Changing your choice

You can withdraw your consent at any time using the unsubscribe link in any optional email or by contacting support@gundex.io. Where email preference controls are available in GUNDEX Settings, you can also change your choice there. Updating your preference in the app requires an internet connection.

Unsubscribing stops future optional news and invitation emails. It does not stop necessary account or security emails, affect your access to GUNDEX, or cancel a paid subscription.

If you separately join a testing or translation program, communications you request for that program are governed by the choices explained when you join. Joining a program does not automatically subscribe you to general news or future invitations.

Legal Basis for Processing (EU/UK)

Where required by applicable data protection laws, we process personal data under the following legal bases:

• Contractual necessity: to provide the Service
• Consent: where you choose to provide it, including your separate opt-in to optional product news and testing or translation invitations
• Legitimate interests: to secure, understand, and improve the Service
• Legal obligation: to comply with applicable laws

3. Data Storage and Security

We use reasonable administrative and technical safeguards to protect your information. No system is completely secure.

We retain personal data only as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Data is securely deleted or anonymized when no longer required.

4. Sharing of Information

We do not sell personal data. Information is shared only when needed to operate the Service, at your direction through public profiles and shared links, or as described below, including with:

• Supabase (authentication and application-data services)
• Resend (email delivery and optional email subscription preferences, including unsubscribe requests)
• Firebase Analytics, provided by Google (app analytics and product-reliability reporting)
• Firebase Cloud Messaging, provided by Google (mobile notification delivery)
• RevenueCat (subscription, purchase, and entitlement management)
• Apple App Store and Google Play (payment processing)
• Vercel (website hosting and delivery, security, and public-page analytics)
• Legal authorities when required by law

Supabase remains Gundex’s authentication and application-data provider. RevenueCat remains the authority for subscription status and purchase lifecycle information.

Public profiles and shared content

Choosing Play on MSA sends the exported main-deck card numbers and quantities to Mobile Suit Arena in a link you open. That service has its own terms and privacy practices. Sideboard contents and your GUNDEX account details are not included in this export.

Your profile starts private. Making it public exposes your username and the supported profile fields and collection information you choose to show. Email, phone, private notes, and value history are not part of your public profile. A share link separately lets anyone with the link view the shared item's name, cards, quantities, and supported deck settings without signing in. Recipients may forward the link and, where available, save an independent copy. Do not include sensitive information in public names, profile fields, or shared content.

Revoking a link prevents future access through that link on GUNDEX. It does not erase independent copies, downloaded images, screenshots, or previews already retained by recipients or messaging services. Messaging services may fetch and cache public link titles and images. Profile photos use public image storage; hiding a profile does not revoke a photo URL that someone already has.

5. Analytics and Tracking

Website analytics

The Gundex marketing website and public Hangar, card, and set pages on the web companion use Vercel Web Analytics and Speed Insights to understand website traffic and loading performance. These services process information such as visited pages, referring websites, browser and device type, approximate location, and performance measurements. Vercel Web Analytics uses aggregated statistics and does not use third-party tracking cookies. Private companion pages, shared-link pages, tester pages, authentication pages, and API routes are excluded from these website analytics tools. Query strings and URL fragments are removed from measured companion page addresses.

Essential website storage

The web companion uses essential cookies for sign-in and session security. Browser storage may remember appearance and accessibility preferences. The web companion requires an internet connection; it does not provide an offline collection cache or queue unsaved changes for later delivery.

For more information, see Vercel's Web Analytics privacy documentation and Speed Insights privacy documentation.

App analytics

Gundex uses Firebase Analytics to understand app usage, onboarding, feature engagement, subscription conversion, and product reliability. Analytics information is used to measure feature adoption, onboarding completion, collection engagement, subscription performance, and product reliability.

Mobile notifications

The mobile app uses Firebase Cloud Messaging to deliver notifications. This uses device/app registration identifiers, and we associate the current push token with your account to route messages. You can change notification permission in your device settings. Notification permission and optional email subscriptions are separate choices.

Firebase Analytics

Firebase Analytics may process app interactions, screen views, app and device information, approximate location derived from IP address, and a pseudonymous Firebase app-instance identifier. This information is pseudonymous and is not completely anonymous.

After authentication, Gundex associates analytics activity with the user’s Supabase UUID. Gundex does not use the user’s email, name, username, or phone number as the analytics user ID.

Gundex does not intentionally send raw search queries, collection notes, authentication tokens, FCM tokens, Firebase installation IDs, or other user-entered content to analytics.

For more information, see Google’s Privacy Policy and the Firebase privacy documentation.

RevenueCat

Gundex uses RevenueCat to manage subscriptions and purchases. RevenueCat may process the product, price, currency, purchase date, renewal status, cancellation status, expiration status, billing status, platform, transaction identifiers, and RevenueCat app-user identifier.

RevenueCat sends verified subscription lifecycle events to Firebase/Google Analytics for reporting. Gundex does not enable hashed-email advertising matching and does not intentionally send customer email addresses to Google Analytics through RevenueCat.

For more information, see RevenueCat’s Privacy Policy. Gundex does not use third-party advertising SDKs or cross-app tracking technologies for advertising, and it does not display advertisements.

6. Your Rights and Choices

• Access, correct, or delete your personal data
• Request restriction or objection to processing
• Request data portability where applicable

To exercise applicable privacy rights, contact privacy@gundex.io. We will respond as required by applicable law, subject to permitted legal and operational retention.

To permanently delete your Gundex account and associated application data in the app, go to Settings, select Edit Profile, scroll down, and tap Delete Account. When deletion completes, it removes your profile and stored application data, including collections, favorites, binders, decks, and preferences, across both the app and web companion. On the web companion, go to Account → Delete account. Account deletion is permanent. GUNDEX does not offer recovery of deleted accounts or data.

Deletion does not remove independent copies saved by other people or content already cached by third-party services. Account deletion does not cancel an Apple or Google subscription; manage your subscription separately through your store.

Analytics, subscription-provider, email-delivery and backup records may require separate handling and may not be erased at the same time as your application account. Contact privacy@gundex.io to request review of remaining personal data. Retention depends on the record's purpose, applicable obligations and the provider's configured retention and deletion process.

If you cannot access the app or need manual assistance, email support@gundex.io and include the email linked to your Gundex account so we can verify and process the request. You can also review the complete account-deletion instructions. Uninstalling the app or signing out does not delete your Gundex account.

7. Children’s Privacy

Gundex is not intended for children under 13. If such data is discovered, it is deleted promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.