Codexa privacy policy

Last updated: October 19, 2026 · Terms of use

Codexa is a companion app for trading card games, made by PancakeStack Studios ("we"). This policy says what Codexa collects, why, who else handles it, and how to delete it.

Codexa is an unofficial fan app. It is not produced, endorsed, supported or affiliated with Wizards of the Coast, Bandai, Bandai Namco, Sunrise, The Pokémon Company, Nintendo, Creatures or Game Freak. Card names, images and game rules belong to their respective owners.

What we collect

Data	Why
Account: your email, a password (stored only as a salted hash), and the name you choose to show. If you sign in with Google: the email, name and Google account id Google shares.	To create your account, sign you in, confirm your email and reset your password.
Your collection and decks: the cards you add, quantities, condition, prices you enter, notes, and the decks you build.	To keep them in your account and show them on your devices.
Questions to the assistant: what you type or dictate, the cards or deck you attach to the question, and the answers; for the deck assistant, the deck being built.	To answer you. They are kept as your chat history and sent to our AI provider to produce the answer (see below).
Card photos: when you scan a card, the photo of the card.	To recognize the card. Photos may be kept to check and improve recognition.
Voice: when you tap the microphone, your phone's speech recognition service (on Android, usually Google's) turns your voice into text. We never receive the audio, only the text if you send it.	To let you dictate questions.
Feedback and reports: what you write in "Send feedback", and when you report an answer, the question and the answer you reported. Also the app version and platform.	To fix problems and wrong or inappropriate answers.
Usage and technical data: requests to our servers with your account id, time, app version and device type; how many assistant questions you used (for the free plan's limits); and how much AI processing each request cost. We also keep your Deck Assistant credit balance and transaction records so we can grant credits, prevent duplicate rewards or purchases, and spend credits when a session starts.	To run, secure and pay for the service, enforce limits and fix errors.

Stored only on your phone, never sent to us: your profile photo, your preferences (language, theme, prices, scanner settings) and the cached card catalog.

Codexa may offer an optional rewarded video ad in exchange for one Deck Assistant session credit. Google Mobile Ads may collect and share your IP address, ad interactions (including video views), diagnostics and performance data, and device or advertising identifiers for ad delivery, measurement, and fraud prevention. Ad personalization depends on your device and Google privacy settings. We do not use your email or Codexa account ID to target ads; reward callbacks use a random, short-lived token. We do not ourselves track you across apps or websites, sell your data, or collect your contacts.

Camera and microphone

The camera is used only while you scan cards or take a profile photo. The microphone is used only while you dictate a question after tapping the microphone button. Both need your permission and you can turn them off in your phone's settings.

Who else handles your data

AI provider (currently OpenAI): receives the text of your questions, the cards or deck attached, and the rules passages we retrieve, to write the answer. It processes them on our behalf and does not get your email or name.
Google: if you choose Google sign-in; and your phone's speech recognition when you dictate.
Google Mobile Ads (AdMob): serves optional rewarded ads and processes ad, device, and diagnostic data as described above and in Google's privacy policy.
Email delivery: to send you confirmation and password-reset codes.
Card databases and image services (such as Scryfall and other public card catalogs): card images are loaded from them, so, like any website, they see your device's IP address. They get nothing else from us.
Hosting: our servers and databases run on infrastructure we rent; data is sent over encrypted connections (HTTPS).

We may disclose data if the law requires it.

How long we keep it

Your account, collection, decks, chat history and feedback are kept until you delete them or your account. Usage and technical records are kept as long as needed to run and secure the service; credit balances and transaction records are deleted with your account. Other retained records keep only a random account number that no longer leads to you. Card photos used to improve recognition contain only the card.

Deleting your account

In the app: Profile → Delete account. Deleting the account deletes your profile, sign-ins, collection, decks, assistant chats, deck sessions, feedback and plan, on every one of our services. It can't be undone.

If Codexa closes

If we stop offering Codexa, or PancakeStack Studios closes or ceases operating, we will try to tell you in the app beforehand. Your account and your data will then be deleted, and will not be sold or handed to anyone as part of the closing. Money already paid (subscriptions, unused periods or purchases) will not be refunded, to the extent the law allows; see the terms of use. If Codexa is instead taken over by another company, it can only use your data as this policy says, and we will tell you before anything changes.

Your choices and rights

You can see and change your data in the app, delete any card or deck, and delete your account (with all your chats) at any time. Depending on where you live you may have the right to access, correct, export or delete your data, or to object to how we use it. You can also reach us with Profile → Send feedback in the app.

Security

Passwords are stored only as salted hashes, connections are encrypted, and sign-ins use short-lived tokens. No system is perfectly secure, but we work to protect your data.

Children

Codexa is not directed to children under 13 and we don't knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

Changes

If this policy changes we will update this page and the date above.