Caught! home

Privacy Policy

Effective date: October 9, 2026

This privacy policy applies to the Caught! app for iOS (the "Application"), created by Tortuga Labs, LLC (the "Service Provider", "we", "us"). Caught! is a tracker for trading card collections.

The short version

Your collections live on your device. Caught! has no user accounts on our servers, no analytics, no advertising, and no third-party tracking. Information leaves your device in three cases: card images are downloaded, the status of the optional Caught! Plus subscription is checked, and a report is sent if you choose to report an inaccurate card scan.

Information stored on your device

The Application stores the following on your device only. We do not receive it and cannot see it.

  • Your collections. The collections you create, their names and rules, the cards you mark as owned, their condition and quantity, and any custom cards you add.
  • Your card photos. Photos you take with the camera or choose from your photo library to stand in for a card. The Application asks for camera access only when you choose to take a photo, and it sees only the library photos you pick.
  • Your Apple sign-in, if you use it. Sign in with Apple is optional. If you sign in, the Application keeps the identifier Apple provides, plus your name and email address if you share them, on your device. They are not sent to us. Signing in reserves an identity for a cloud backup and sync feature we plan to add later; we will update this policy before that feature collects anything.
  • App preferences, such as your chosen app icon.

If your device is backed up to iCloud or to a computer, Apple may include this data in that backup under your Apple account settings.

Information that leaves your device

Card images

Card scans are downloaded from a third-party image host, TCGdex (assets.tcgdex.net), when you browse cards, and are cached on your device. As with any download, TCGdex receives your IP address and the address of the image requested. We do not control TCGdex and receive nothing from these requests.

Caught! Plus subscription

Purchases are made through Apple, using your Apple Account. We never receive your payment card details.

To know whether a subscription is active, the Application uses RevenueCat, a subscription service provider that processes information on our behalf. RevenueCat receives a random identifier created for your installation of the Application, your purchase history for the Application (the product, purchase and renewal dates, and subscription status), your App Store country, and basic technical information such as device model, operating system version, Application version, and IP address. This happens each time the Application opens, whether or not you subscribe. It is not linked to your name, email address, Apple sign-in, or the contents of your collections. RevenueCat's privacy policy is at https://www.revenuecat.com/privacy.

Reports of an inaccurate scan

If you choose "Report an inaccurate scan" on a card, the Application sends us a report so we can correct the card data. A report contains:

  • facts about the card: its name, set, number, print, language, rarity, artist, and whether it is a custom card;
  • the image shown for that card. If you added your own photo for the card, that photo is sent; otherwise the catalog scan is sent;
  • the version of the card catalog and the build of the Application;
  • the date and time of the report.

A report does not include your name, email address, Apple identifier, or the rest of your collection. Reports are sent to our server at bytortuga.com and delivered to us by email. Our hosting provider may log your IP address when a report is received, as is standard for web requests. If you are offline, the report waits on your device and is sent the next time the Application opens.

Sharing a want list

When you share a want list, the Application hands it to the iOS share sheet. It goes only where you send it.

Information we do not collect

The Application does not collect location data, contacts, advertising identifiers, usage analytics, or crash reports of its own, and contains no advertising or third-party analytics software. The only third-party software in the Application that communicates over the network is RevenueCat's, for the subscription described above. Apple may share aggregated crash and usage data with us if you have opted in to sharing with app developers in your device settings.

How we use information

We use reports of inaccurate scans only to review and correct the card catalog. We use subscription information only to provide Caught! Plus, to understand subscription revenue, and to answer support requests about a purchase. We do not sell personal information or share it for advertising.

Disclosure

We may disclose the information we hold if required by law, such as to comply with a subpoena or similar legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud. Reports pass through the service providers that host our server and deliver our email, and subscription information is processed by RevenueCat; they handle this information on our behalf.

Retention and deletion

  • Data on your device stays there until you delete it. Deleting a collection removes it and its ownership marks. Deleting the Application removes everything it stored on your device.
  • "Log out" and "Delete account" on the Account screen remove your Apple sign-in details from the Application. Because we hold no copy, there is nothing further for us to delete. You can also stop using Sign in with Apple for Caught! in your Apple account settings.
  • Subscription records are kept by Apple and by RevenueCat for as long as needed to provide the subscription and to meet accounting and legal obligations. You can ask us to delete the RevenueCat record for your installation by emailing support@bytortuga.com; because the record is tied to a random identifier and not to your name or email, we may need details of your purchase to find it.
  • We keep reports of inaccurate scans for as long as they are useful for maintaining the card catalog. To ask us to delete a report you sent, email support@bytortuga.com with the card and the approximate date.

Your choices

You can use the Application without signing in. You can withdraw camera access at any time in iOS Settings. You can stop all collection of information by the Application by uninstalling it.

Children

The Application is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, email support@bytortuga.com and we will delete it.

Security

Your collection data stays on your device and is protected by your device's own security. Reports are sent over an encrypted connection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes

We may update this policy from time to time. The updated policy will be posted at /privacy with a new effective date. Continued use of the Application after a change means you accept the updated policy.

Contact

Questions about privacy or this policy: support@bytortuga.com

Tortuga Labs, LLC
https://www.bytortuga.com