Who is responsible
Scanlings is made by Alessandro Magnani, an individual based in the Czech Republic, who is the data controller for the purposes of the GDPR. Questions about your data, and any request to see or delete it, go to hello@scanlings.app.
The short version
Scanlings turns barcodes into creatures. To do that across your devices it stores the barcodes you have scanned and a name you choose. It does not store your email, it has no advertising, no analytics and no trackers, and nothing here is sold or shared for anyone else's purposes.
The parts worth reading properly are what appears publicly on the leaderboards, and where the data is physically kept.
What is stored
- The barcodes you scan, with the time each was scanned. This is your collection; it is the game.
- A display name that you choose. You may change it.
- Which barcodes were found first, and by whom — a permanent record of who discovered a creature before anyone else.
- Your team — which five of your own creatures you picked to fight with — and when you last changed it.
- Two display preferences: creature size and light or dark theme. Nothing else may be stored here; the server accepts only those two settings with only those values.
- Battle results: whether you won, the power totals and tier letters involved, and when. No barcodes are recorded with a battle.
- Tower climbs: how high you reached and how long you spent.
- If you sign in with Google, an opaque per-app identifier Google gives us. Your email address is never stored — it is shown to you in your browser and goes no further.
- A session token, stored only as a hash, so a stolen database does not yield working logins.
There is no advertising identifier, no location data, no contact list, no device fingerprint, and no third-party analytics.
What other people can see
The name is one you choose, and it is not your real one unless you make it so. Signing in with Google tells us only an opaque account number — we never read the name on your Google account, or your profile picture. If you call yourself Kendo, Kendo is all we have.
The leaderboards are public. If you appear on them, other people can see your display name and how many creatures, how much variety and how many first discoveries you have. Titles you hold are public in the same way.
The leaderboards are also posted to our Discord. The same rows you see on the website — the name or label, and the numbers beside it — are sent there so the boards can be followed in the chat. Discord is a separate company with its own privacy policy. If your name is private, the generated label is what gets posted.
The barcodes you scanned are not public. No other player's device ever receives one of your barcodes, and none appears on any leaderboard, in any battle record, or in anything the game posts to Discord.
You can opt out of appearing by name. Your position and your numbers stay on the board — hiding a name should not cost a place — but the name is replaced by a generated label. That label is derived from your account, encodes nothing, and is deliberately not a valid barcode.
Where it is kept
The game and its database run on Railway in Virginia, United States.
This means that if you are in the European Economic Area or the United Kingdom, your data is transferred outside it. That transfer is covered by the European Commission's Standard Contractual Clauses, which form part of our agreement with the hosting provider.
Deleting it
You can delete your player from inside the game, and it works: your whole collection, your team, your battle history and your sessions are erased, and your Google sign-in is released so you can start again from nothing.
Two things stay, and you should know why. The record that a barcode was discovered for the first time survives, because being first to find something is a fact about the world's catalogue rather than about you, and removing it would rewrite what every other player has already seen. Your leaderboard row survives too, frozen at the totals you reached and marked with a tombstone — and you choose whether it still carries your name or shows a barcode in its place.
Deletion is permanent: a deleted player cannot be restored or given to anyone else, and the name it used can never be taken again. The full account of what goes, what stays, and how to ask if you no longer have the app is on the delete account page.
Your rights
If you are in the EU or UK you have the right to access, correct, export or erase your personal data, to object to processing, and to complain to your national data protection authority. The contact address above is where to ask.
Children
Scanlings asks that you are 16 or older, or have permission from a parent or guardian. We do not knowingly collect data from children below that without it. If you believe a child has given us data, write to the address above and it will be deleted.
Changes
If what is stored changes, this page changes with it, and the date at the top moves. This page has one permanent address, so a link to it does not go stale.