Opening Hand privacy policy

Last updated: 3 October 2026

Opening Hand is a Pokémon TCG deck simulator and match journal for Android. This page says what data the app handles, where it goes, and what you can do about it. The short version: without an Account, everything stays on your phone. With an Account, your Decks, Matches and Tags are also stored online so they're safe and the same on every phone you use. There are no ads, no analytics and no tracking, and your data is never sold.

Who is responsible

Opening Hand is made by Marijn Goedhart, who is responsible for your data. Questions, requests and complaints: contact@openinghand.app.

Without an Account

Your Decks, Matches, Games, Tags and card notes are stored only in the app on your phone. Nothing is sent to us.

The app does connect to the internet for two things, which don't include anything you logged:

• Card data. Once a day it downloads the list of cards and archetypes from GitHub (raw.githubusercontent.com).
• Card images. When you search for cards it loads their pictures from images.pokemontcg.io and images.scrydex.com.

Like any website, these services see your phone's IP address when the app downloads from them.

If backup is turned on in your phone's settings, Android also backs up the app's data to your Google account. That's between you and Google; see Google's privacy policy.

With an Account

Making an Account is optional. If you make one, we store:

• Your email address, to log in, to send codes (confirming your Account, resetting your password) and to warn you about security changes, such as someone asking to remove two-factor login. Nobody else sees it, and we don't send newsletters or ads.
• Your Username, shown in the app instead of your email.
• Your password, if you set one, stored only in scrambled form (hashed); nobody can read it, including us.
• Two-factor login, if you turn it on: the key your authenticator app shares with us, needed to check its codes, and your recovery codes, stored only hashed.
• What you log in the app: Decks and their lists, Matches, Games, Tags, Card Tags and your answers about unknown cards, so they sync between your phones.
• Technical data: when you logged in and from which IP address, kept by our provider to keep logins secure and to stop people guessing passwords.

If you sign in with Google, Google tells us your Google account's ID, email address, name and profile picture address. We use the ID and email to log you in; Supabase keeps the name and picture address with your login, but the app doesn't use or show them. Google learns that you signed in to Opening Hand; see Google's privacy policy. We don't get access to anything else in your Google account.

We use this only to run your Account and sync your data. The legal basis is providing the service you asked for (GDPR article 6(1)(b)), and our legitimate interest in keeping it secure (article 6(1)(f)).

Where it's stored

Account data is stored with Supabase in their data centre in Frankfurt, Germany (EU), which stores and processes it on our behalf. See Supabase's privacy policy.

Emails are sent by Resend (Resend, Inc., USA), from their servers in Ireland (EU). Resend receives the email address and the email itself, only to deliver it, and keeps delivery logs for a short time. Because Resend is a US company, the transfer is covered by the EU–US Data Privacy Framework and standard contractual clauses. See Resend's privacy policy.

Emails to contact@openinghand.app are forwarded by Cloudflare to our inbox, without being stored by Cloudflare.

How long we keep it

As long as you have an Account. When you delete your Account, it's deleted 7 days later, together with everything in it. You can cancel during those 7 days. Our provider may keep technical logs for a short time after that. Your old Username stays reserved for 90 days so nobody else can pretend to be you.

Your rights

• See and take your data: Backup in the app saves everything you logged to a file.
• Correct it: change anything in the app; change your Username or password under Account.
• Delete it: Account → Delete Account in the app, or on the delete account page, or by emailing us from your Account's email address.
• Object or ask questions: email contact@openinghand.app. We answer within a month.
• Complain to the data protection authority in your country.

Children

If you're under 16, ask a parent or guardian before making an Account. The app works fully without one.

Changes

If this policy changes, the new version is posted here with a new date. Big changes are also announced in the app.

Opening Hand is an unofficial fan-made app. It is not affiliated with, endorsed by or sponsored by Nintendo, Creatures, GAME FREAK or The Pokémon Company.