Last updated: October 22, 2026
Bulk Box is developed and maintained by Meris Lihić, an independent developer. This policy explains what data is collected, why, and how it is used.
Account information (optional)
If you choose to sign in with Apple to use cloud sync, I receive your Apple ID, your email address (or the private relay address Apple creates if you choose to hide it) and, on first sign-in, the name you share with the app. This is used solely to identify your account and associate your collection backup with it. Sign-in is not required to use the app or to buy Collector's Edition.
Collection data (optional)
If you are a premium subscriber and use cloud sync, your card collection data (box names, card quantities, conditions) is uploaded to and stored in Supabase, a third-party cloud platform. This data is linked to your account and used exclusively to sync your collection across your devices. It is never shared or sold.
Purchase and subscription information
If you subscribe to Collector's Edition, your subscription status and purchase history are processed by RevenueCat, a third-party subscription management platform. You can subscribe without signing in; in that case RevenueCat identifies your purchase with a random ID it generates on your device. If you later sign in with Apple to use cloud sync, that purchase is linked to your account so that your subscription follows you across devices. I do not directly handle payment information — that is managed entirely by Apple.
Card images and data
Card information and images are fetched from the YGOProDeck API and cached locally on your device to reduce repeated network requests. This data does not leave your device.
Crash and error reports
Bulk Box uses Sentry to automatically collect crash reports and error logs when the app encounters a problem. This may include device type, OS version, app version, and a stack trace of the error. This data is used solely to identify and fix bugs. No personally identifiable information is intentionally included in these reports.
Usage analytics (optional, off until you agree)
The first time you open the app, I ask whether you are happy to share usage analytics. Nothing is collected unless you say yes, and you can turn it on or off at any time in Settings under Privacy. If you agree, the app sends events to PostHog (hosted in the EU) that describe how it is used, such as when the subscription screen is opened and how it is closed. Each event carries a random ID created on your device when the app was installed, plus technical details: device model, operating system and app version, language, time zone, screen size and whether you are on Wi-Fi or mobile data. This ID is not linked to your name, Apple ID, account or collection, and I do not use it to identify you. PostHog receives your IP address when the data is sent; I have configured it to discard the address and not to work out your location. I use this data only to understand which features are used and what to improve. I never sell it. Because the ID is not linked to you, I generally cannot tell which data is yours; turning the setting off stops any further collection.
The following third-party services are used by Bulk Box. Each has its own privacy policy:
Your collection data, if synced, is stored in Supabase's EU infrastructure. Access is restricted to your authenticated account. Usage analytics, if you opt in, are stored in PostHog's EU cloud. Local data stays on your device and is never transmitted unless you explicitly use cloud sync, or you opt in to usage analytics, which sends only the technical usage events described above.
Usage analytics are collected only with your consent, which you give or decline in the app and can withdraw at any time in Settings. Account, sync and subscription data is processed to provide the features you ask for. Crash reports are processed for the legitimate interest of keeping the app working.
You can delete your account and all associated cloud data at any time by signing out and contacting me at the address below. Local data can be removed by deleting the app. You can withdraw your consent to usage analytics at any time in Settings. If you are in the EU or UK, you also have the right to access, correct and erase your personal data and to complain to your data protection authority.
Bulk Box is not directed at children under 13 and does not knowingly collect data from them.
If this policy changes meaningfully, the "Last updated" date above will reflect that. Continued use of the app after changes constitutes acceptance.
Questions or data requests: meris.lihic@gmail.com