Privacy Policy

SaitoDex is an independent collector reference. For privacy questions or requests, contact support@saitodex.com.

What we collect

If you create an account, SaitoDex stores the information needed to operate it: your username, email address, password hash, email-verification state, collection and wishlist entries, optional private card notes, trade-card condition/notes, profile/privacy choices, collector bio, collection-focus preferences, optional profile images and display-currency preference, authentication credentials such as passkey public-key records or optional authenticator-app configuration, active-session information, and limited security records such as login time, IP address and browser/device user-agent.

If you deliberately connect Discord, SaitoDex stores your permanent Discord user ID, current Discord username/display name, the time the identity was linked, and whether you chose to show it publicly. The connection requests only Discord's basic identity permission. SaitoDex does not request or store your Discord email address, server list, messages, or long-lived Discord OAuth access/refresh tokens.

If you choose to sign in with Google or connect Google from Account settings, SaitoDex stores your Google account ID and the name and email address Google provides, so it can recognise you next time. SaitoDex never sees your Google password and does not store Google access or refresh tokens. You can disconnect Google from Account settings.

If you support SaitoDex, we store a supporter record with your account: when each supported month starts and ends, whether it was monthly, one-off or a gift, the amount you paid, and the IDs Stripe gives us for your customer record and any monthly payment. Your card details are typed on Stripe's pages and never reach SaitoDex. The amount you paid is only ever visible to the SaitoDex owner; your supporter badge and months-in-a-row count can appear on your public profile if it is public.

Saved Collectors are a private list only you can see; saved collectors are not told. Notifications about your own badges and milestones are stored with your account and are included in your data export.

We do not need your real name, postal address or phone number to use normal collector features. You may optionally provide a country for trading context; it remains private unless you deliberately enable the country badge on your public profile. SaitoDex does not store Face ID, fingerprints or Windows Hello biometric data; those checks happen on your device.

Why we use it

We process account and collection data to provide the SaitoDex service you request. We use limited security and technical information for our legitimate interests in protecting accounts, preventing abuse, diagnosing faults and keeping the service reliable. If you choose to make a collector profile public, the information you enable is published at your direction and can be switched off again from your profile settings. Private card notes are never included on public collector or trade profiles.

Who receives it

SaitoDex does not sell collector personal data to advertisers. Data may be processed by infrastructure and email providers used to host, secure and operate SaitoDex, including IONOS for hosting/email services. Supporter payments are handled by Stripe, which receives your email address, your SaitoDex user number and username, and the payment details you give it, and acts as the official seller for those payments, so it also uses them to work out sales tax and send your receipt, under its own privacy policy (stripe.com/privacy). If you are a supporter with Discord linked, the SaitoDex Discord bot uses your Discord user ID to give or remove the SD Supporter role in the official Saito Legends Discord. We may disclose information where required by law or where necessary to protect the service and its users.

The SaitoDex owner and specifically authorised read-only analytics collaborators may access internal collection-derived signals needed to operate and understand the service. These may include collector usernames and self-reported ownership, wishlist, set-participation and trading metrics. Read-only analytics access does not expose passwords, passkey secrets, private card notes or other authentication secrets, and does not grant account-management or site-configuration permissions.

How long we keep it

Live account data is kept while your account remains active. Deleting your account removes your supporter record from SaitoDex and cancels any monthly payment; Stripe keeps its own record of past payments for as long as the law requires, and the SaitoDex owner may keep basic payment records (date and amount) for tax purposes. If you delete your account, normal account-linked collector data is removed from the live database. Limited security or administrator audit records may be retained where reasonably necessary to protect account integrity, investigate abuse or preserve an accurate security history; these records are not used to recreate a deleted collector profile. Database backups are kept on a short rolling retention schedule and expire automatically; they exist for disaster recovery rather than normal account use.

Your choices and rights

You can change your email, password, passkeys, optional 2FA and profile-visibility settings from your account. You can download a copy of your SaitoDex collector data or delete a normal collector account from the Security & Privacy page. Depending on the circumstances, UK data-protection law may also give you rights of access, correction, erasure, restriction, objection and data portability.

For a privacy request, contact support@saitodex.com. You also have the right to raise a concern with the UK Information Commissioner's Office (ICO).

Cookies

SaitoDex currently uses only cookies or equivalent browser storage that are necessary for functions such as secure sessions, CSRF protection and authorised maintenance access. We do not currently use advertising or behavioural-tracking cookies. If that changes, this notice and any required consent controls will be updated before non-essential tracking is enabled.

Visitor counts. To see how many people use SaitoDex without an account, the site counts visits without cookies. Each visit is turned into a scrambled code made from the IP address and browser together with a secret that changes every day, so a visitor can't be recognised from one day to the next and the IP address itself is not kept. These codes stay only in short-term server memory (for at most two days) and are only used for counts and the page being viewed. For signed-in collectors, the SaitoDex owner can see which page or screen you are on for a few minutes so maintenance isn't started while you're busy; this is short-term too and is not kept as a browsing history.

Public collector profiles

Collector profiles are private by default. If you enable a public profile, only the collection information you have chosen to expose is intended to be public. Optional country and verified-Discord display are both off by default. Turning the public-profile option off removes normal public access to that profile. Recent collection activity is optional and remains off unless you enable it. Your Showcase Card is only shown publicly when you also allow visitors to see your owned cards.

Linking Discord does not make Discord a SaitoDex sign-in method and does not automatically publish your Discord username. You can unlink Discord at any time from Profile & Privacy; unlinking removes the stored Discord identity from your live SaitoDex profile.

Trade Finder is a separate opt-in publication feature. If you enable it, SaitoDex publishes a Trade Profile containing your verified Discord username and the cards you have deliberately marked Wanted or For Trade so other collectors can find and contact you in the official Saito Legends Discord. Pausing Trade Finder removes you from automated matching and card-search results but does not by itself remove the directly accessible Trade Profile. You can disable Trade Finder or unlink Discord to stop publishing that Trade Profile.

When you are signed in and view another collector's public Spares / Dupes page, SaitoDex may compare those public spare cards with your own collection to highlight cards you are missing. That comparison is shown only to you; the other collector is not told what you are missing or that you viewed their page.

SaitoDex Vault app

SaitoDex Vault is the official SaitoDex companion app for Android. It uses the same SaitoDex account and the same data described in this notice; it does not collect anything extra about you. Signing in happens on saitodex.com, and the app only receives a sign-in token, which is kept in your phone's secure storage (Android Keystore). The app also keeps a copy of the public card catalogue, your display preferences and, while you are signed in, a copy of your own collection, wishlist and trade list on your phone, so it opens quickly and you can still look at them without signal. Signing out removes the token and that copy from the phone.

The app has no adverts, no analytics or tracking tools and no third-party SDKs that collect personal data. It only talks to saitodex.com. If the app runs into an error, it can send a short error report to saitodex.com (the app and Android version, the screen and the technical error message) so it can be fixed; it contains no collection data or personal details, and you can turn it off under Account > Display & app. Photos are only read when you choose one to use as your profile picture or background, and they are uploaded to SaitoDex and processed as described under Profile images. The app never reads your contacts, location, camera or other files.

Inside the app you can report another collector's profile to support@saitodex.com using the flag button on their profile.

Deleting your account

You can delete your SaitoDex account, including everything the Vault app uses, at any time. Sign in on the website and go to Account → Security & Privacy → Delete account, or open Account → Delete account in the app, which takes you to the same page. If you can no longer sign in, email support@saitodex.com from the address on your account and we will delete it for you. What is removed and what is briefly kept is explained under How long we keep it. Uninstalling the app alone does not delete your account.

Security

Passwords are stored using strong one-way password hashing. SaitoDex supports verified email, passkeys and optional authenticator-app 2FA, and uses HTTPS and account/session security controls. No online service can promise absolute security, so please use a unique password and protect the devices holding your passkeys.

Changes

We may update this notice when SaitoDex changes. Material changes to how account data is used will be reflected here before the new use is introduced.

Profile images

If you upload a collector profile picture or profile background, SaitoDex processes it into a sanitised WebP display copy and strips embedded metadata such as EXIF information. The original upload is not published. These display copies may be served on a public Collector Profile or an enabled Discord-backed Trade Profile, depending on the features you choose to publish. You can replace or remove them from Account settings.

Your display-currency choice changes only how GBP reference values are shown to you. SaitoDex keeps its source values in GBP and uses server-side reference exchange rates for conversion; the currency-rate provider is not sent your SaitoDex account or collection information.