Updated: November 9, 2026 · iPhone, iPad, macOS and Android app
Optional device sync (version 1.2.1 and later)
Optional activation
Sync is off by default. Only after confirmation does the app send templates, collections, items, photos and reminders over HTTPS to the self-hosted Supabase installation at supabase.marketport.de.
Encryption and technical data
Content is encrypted on your device; the operator receives no decryption key.
The server stores random technical device identities, random sync identifiers, access permissions, file sizes and timestamps; the connection processes the IP address.
Sync requires no name, email address or phone number. No Supabase Cloud account is created for you.
Random identifiers and connection data are used only to operate the service; complete anonymity from the infrastructure is not guaranteed.
Pairing codes and session credentials are protected in the device Keychain or Android Keystore and excluded from JSON/CSV.
Linking new devices
- New devices require the pairing code and explicit approval on the initial device after matching random request and device IDs.
- Requests are valid for ten minutes.
- Other linked devices cannot approve further devices.
The code contains the decryption key and must be protected like a password. AI keys, AI consent and device settings are not synced.
Sync and local recovery copies
Changes and individual deletions propagate between connected devices while the app is open and unlocked. Local recovery copies retain at most three earlier versions.
Importing or clearing the local library disconnects this device first.
Server erasure and backups
Disconnecting alone does not erase server data. Delete sync on server revokes all existing devices and the old code; local libraries are kept.
- Unneeded encrypted files are cleaned up within 48 hours in normal operation; protected daily Supabase backups retain at most 14 snapshots.
- In addition, regular Plesk backups on private external backup storage retain twelve weekly full backups with their associated incremental versions.
- Deleted content may remain there only in encrypted form until those backup cycles expire; these backups are not used for ongoing device sync.
- A random content-free deletion marker prevents reuse of a deleted code.
Disabling the service and device loss
Activation is optional. Disable service stops future transfers on this device while retaining its protected connection for later manual activation.
Fully disconnecting or losing the initial device’s keys prevents further device approvals; the code alone cannot replace this confirmation. In that case, start a new sync from an existing local library or JSON backup.
The operator cannot recover encrypted content without device keys. Your photos and notes may contain personal information; they are transferred only in encrypted form.
1. Controller and contact
market port GmbH
Splieterstraße 27
48231 Warendorf, Germany
info@marketport.de
+49 2581 9493360
marketport.de
Data protection officer: Nils Möllers, Keyed GmbH
info@keyed.de
+49 2505 639797
2. Local data processing
Without device sync enabled, collections, templates, metadata, notes, storage locations, acquisition dates, settings and photos are stored only on this device. Collection management requires no registration. There is no advertising, analytics or tracking. The notice above applies to voluntarily enabled device sync.
A backup file or CSV file is exported only at your express request. Depending on the export, these files may contain storage locations, acquisition dates. You decide where to store or share them. Importing a backup replaces the locally stored collection data after your confirmation.
When you send feedback, the name, email address and message you enter, app language, app version and build number, device model and operating system version are sent over HTTPS to the CollectorsHub contact API. The connection also processes your IP address.
The API forwards your name, email address, subject, message, language, app version, platform and operating system version to the CollectorsHub project in the market port Hub at hub.marketport.de. The request is stored there as a support ticket and processed to answer you; forwarding to awork is possible according to project settings.
Device identifiers, device model, build number and the original device IP are not forwarded to the Hub. An automatic email copy is not guaranteed.
Collections, photos, pairing codes and API keys are not included automatically.
When you open the FAQs, the app loads public answers for the selected language over HTTPS from collectors-hub.io. The server processes the IP address to provide the connection. No search terms, collection data, photos, API keys or device diagnostics are sent. Confirmed answers are cached on the device for offline use.
Optional catalog lookup starts only when you tap “Search” or “Review match”. The search term, optional set name or catalog ID and selected catalog language are sent over HTTPS to collectors-hub.io and from there to Rebrickable (LEGO) or TCGdex (Pokémon).
Providers see the server IP; CollectorsHub processes the device IP for the connection and short-term rate limiting using a hashed identifier. The app sends no photos, notes or full collections.
Responses are cached on the server for up to five minutes, LEGO theme names for up to one hour. Accepted details and source references are stored locally and included in backups and CSV exports.
External source and image links open in the browser only when tapped; the provider’s terms and privacy notices then apply.
Optional image import (version 1.2.1 and later): When you select Use catalog image as item photo, only Use details and image downloads the image through collectors-hub.io from the catalog provider’s image server (cdn.rebrickable.com or assets.tcgdex.net). Only the provider, catalog ID and language are sent.
Providers see the server IP; CollectorsHub processes the device IP for the connection and temporary rate limiting using a hashed identifier. No personal photos or collection contents are uploaded.
The downloaded image is optimized on the device and stored locally with the item only when you save; it is then available offline and in JSON backups. The server keeps no permanent image copy.
Existing photos are kept.
Optionally retrieve market prices for catalog-linked Pokémon items: manually or, after saving a price basis and “Update when opening”, when opening after at least 24 hours since the last successful retrieval. Only the catalog ID, catalog language and price basis are sent via collectors-hub.io to TCGdex (Pokémon; Cardmarket/TCGplayer data).
Providers see the server IP; CollectorsHub processes the device IP for the connection and short-term rate limiting with a hashed identifier. Responses are cached on the server for up to five minutes.
Photos, notes and full collections are not sent. Prices and their history remain local and are included in JSON backups; CSV includes the latest unit price, source, currency and timestamps.
No retrieval runs while the app is closed. Provider credentials remain exclusively on the server.
3. Photo recognition
Photos are stored locally on the device. Photo recognition in the editor uses only the selected optional AI connection after consent and manual start. Local text recognition is not offered in the editor.
4. Optional AI processing
Only after your manual start does the app send data over an encrypted connection to the selected AI provider: for photo recognition, the current photo, your note, collection instructions and template fields; for description search, only the description, collection instructions and template fields; for template suggestions, only your collecting area and the public standard template catalog. Other entries, custom templates and collection photos are not sent.
Taking a photo alone sends nothing. You review and save suggestions yourself.
AI is optional and off by default. You can choose OpenAI, Gemini (Google), Claude (Anthropic) or Perplexity.
Changing providers requires new consent. The selected provider processes requests under its terms, possibly outside the EU; retention and possible use to improve models depend on the provider and your account.
Perplexity may forward content to the selected model’s provider. The app enables no web search.
Personal API keys remain protected in iOS Keychain or Android Keystore and are excluded from backups and CSV. They are sent only to the selected provider for authentication.
Provider charges may apply. There is no automatic switch to another provider or access method.
Disabling AI and removing the key stops future requests; data already sent remains subject to the provider’s terms. Collection management remains local without AI.
During optional ChatGPT sign-in, OpenAI receives a random identifier for this installation. The app securely stores the account ID, email address and access credentials on this device, outside backups and CSV files.
Tokens are sent only to OpenAI; the app does not access chat history. You can disconnect here and revoke access in ChatGPT.
Your ChatGPT account terms and privacy settings also apply to processing.
5. Legal basis and withdrawal
Optional transmission is based on your consent under Art. 6(1)(a) GDPR. You can disable the feature and remove the API key at any time in Settings. Withdrawal applies to future requests. Collection features remain available without AI.
6. Deletion and your rights
You can delete local collection data in Settings. Individual photos, items and collections can also be removed. Deletion of data held by your selected AI provider is governed by its settings and terms. For access, rectification, erasure, restriction, portability or objection, contact the data protection contact above. You may also lodge a complaint with a data protection authority.
7. Third parties
This notice covers the CollectorsHub app. The market port GmbH website privacy policy applies when you visit its website.