Privacy notice

under Articles 13-14 of Regulation (EU) 2016/679 (GDPR) — Reame Arcano waitlist and Deckread app. Updated 9 October 2026. Versione italiana.

Data controller

Alessio Zanon, Celano (AQ), Italy — contact: [email protected].

What we collect and why

• The email address you enter in the waitlist form, together with the sign-up date, your preferred language (it/en, inferred from your browser, so we can write to you in your language) and the version of this notice you accepted.
• Purpose: notifying you of the launch of Reame Arcano and of early access. Nothing else: no third-party marketing, no profiling.
• Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting the form.

Where the data lives and for how long

• Emails are stored in the controller's Cloudflare infrastructure (Workers KV). Cloudflare Inc. acts as a processor under Art. 28 GDPR pursuant to its Data Processing Addendum; any transfers outside the EU are covered by Standard Contractual Clauses and by Cloudflare's participation in the EU-US Data Privacy Framework.
• We keep your email until the service launches and in any case no longer than 24 months; after that, you either turn it into an account or we delete it.

The “Deckread” app (account and collection)

• Data processed: email and sign-in identifiers (including Google/Apple Sign-In; with “Sign in with Apple” we only ask for your email), the data you enter in the app (collection, sealed products, decks, wishlist, journal, settings), — if you turn alerts on — the device push token, and — if you subscribe to Deckread Pro — the subscription state (product, expiry, store transaction identifier): payment is handled by Apple or Google, we never see payment data.
• Card photos (scanner): recognition happens on your device. Only when the device isn't sure and only if you allowed it (a sheet before your first scan; a switch in Settings → Privacy), the photo of the card is sent to our server and from there to Anthropic, PBC (United States), which processes it solely to recognize the card, deletes it within 30 days and does not use it to train models (Anthropic commercial terms and retention notice; transfer outside the EU covered by Standard Contractual Clauses). We do not keep the photo. Legal basis: your consent, revocable at any time.
• Anonymous diagnostics: launch times, slow screens and app errors, and the steps through which the first cards get saved (for example: scanner opened, card confirmed; never card names), with a random installation identifier (EAS Observe by 650 Industries, Inc. “Expo”, United States, acting as processor; retained at least 60 days). It contains neither your email nor collection data. You can turn it off in Settings → Privacy. Legal basis: legitimate interest in keeping the app working and understanding where it gets stuck (Art. 6(1)(f) GDPR), with an immediate right to object.
• Purpose: providing the service (collection valuation, signals, the alerts you ask for). No third-party marketing, no profiling, no sale of data.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for push alerts, your consent, revocable from the app or the system settings.
• Where: authentication on Supabase and application data on Railway infrastructure; push notifications through Expo (650 Industries, Inc.); remote card recognition and automatic translations through Anthropic (all processors under Art. 28 GDPR; transfers outside the EU covered by Standard Contractual Clauses). Every processor guarantees your data a level of protection equivalent to the one described here.
• Retention: as long as the account is active. Immediate deletion from the app (Settings → Delete account) or on request: see account and data deletion.

Artificial intelligence (transparency under EU Regulation 2024/1689, the “AI Act”)

Some app features use artificial intelligence, and we always tell you at the point where you meet them:

• Generated analyses and texts. Some analyses shown in the app are generated automatically by a language model from our market data, without prior human review: they are marked as such in the interface and should be treated as a starting point, not as advice.
• Automatic translations. Automatically translated news items (Anthropic language model; the translated text contains none of your data) are marked “Automatically translated”.
• Card recognition. The scanner uses automatic image and text recognition to identify cards, on the device and — with your consent — through Anthropic (see above): the result is always a suggestion that you confirm.

None of these features make decisions with legal effects on you, nor do they process biometric data for identification purposes.

Your rights

You can request access, rectification, erasure, restriction, portability and withdraw your consent at any time by writing to [email protected]. Withdrawal does not affect processing already carried out. You have the right to lodge a complaint with your supervisory authority (for Italy: Garante per la protezione dei dati personali, www.garanteprivacy.it).

No cookies, no profiling

The site uses no cookies and no profiling tools; fonts are served from our own domain. The only data stored on your device is your chosen language (localStorage "ra_lang"), a purely technical storage exempt from consent.

To know how many people visit the site and which pages they read, we use Cloudflare Web Analytics, provided by Cloudflare Inc., which already hosts the site as a processor (Art. 28 GDPR). It collects aggregate statistics only: it uses no cookies or other storage on your device and does not identify you.

← Back to Reame Arcano · Terms of Service