Privacy — PokéItem Chrome extension

The extension has no server of its own.

• →The title and the price read from the page are sent to app.pokeitem.fr to identify the card and fetch its price.
• →If you are already signed in to PokéItem in Chrome, your NextAuth cookies are used to read your binder and your wishlist. Nothing is stored with a third party.
• →The history of the last 15 cards stays in chrome.storage, on your own Chrome profile.
• →No data is ever sold. eBay links use the affiliate programme already in place in the PokéItem app.

Listings reported to improve prices

Leboncoin and Vinted have no public API: the only French listings anyone can observe are the ones somebody is looking at. The listings the extension prices are therefore shared to refine everyone's prices.

When — every time the extension prices a listing and the card has been identified unambiguously, whether you opened the listing page or the extension simply placed a price badge on a results page. On a list page this happens without any click from you, for every listing priced.

If the extension hesitates between several cards, it offers you a list and reports nothing: a guessed card pollutes a price instead of improving it. Nothing is ever sent either for a bundle, a sealed product, a site other than Vinted / Leboncoin / eBay / Cardmarket, a page the extension could not read, or a page it could not prove was really about the listing on screen. The same listing at the same price is sent only once per session; sends are batched in twenties.

What is sent — the listing, nothing else:

What is NEVER sent:

• →no seller data whatsoever — not their name, not their profile, not their rating, not their review count (the extension reads them to warn you on screen; they stay local);
• →no identity of yours — your account is used to authenticate the send to app.pokeitem.fr and to rate-limit it; your account identifier is not passed any further (but read "What the server adds" below: the relay attaches a pseudonym derived from that account);
• →no browsing history: not the pages without a listing, not your searches, not any site outside Vinted / Leboncoin / eBay / Cardmarket;
• →neither the description, nor the listing photos, nor the messages.

Where it goes — the extension only ever talks to app.pokeitem.fr. It is the PokéItem server that relays the listing to its pricing service (api.tcgapi.io) using its own key: the extension holds none. Contributed listings are used solely to compute prices; they are not sold, and they do not carry your identity — they do carry a stable pseudonym, described right below.

What the server adds

The final recipient therefore receives a field the extension does not send, and that has to be said. The extension emits nothing beyond the tables above, but since August 2026 the PokéItem server attaches to every relayed listing a non-reversible pseudonym derived from your account: HMAC-SHA256(server secret, account identifier), truncated to 16 hexadecimal characters. It is computed on the server; the extension never sees it and cannot forge it — the relay overwrites any value that reaches it.

It lets the pricing service establish that two different people saw the same listing: that is the only way to tell a corroborated observation from an isolated one, since the entire extension fleet goes through a single technical key. It is stable (the same account always yields the same pseudonym) but the recipient cannot trace it back to your account: the secret that computes it never leaves the PokéItem server, and it can be rotated. Your account identifier itself is still never transmitted.

What you can refuse

Nothing, within the extension. There is no setting, no checkbox, no "turn off contribution". The only ways to report nothing are to uninstall the extension, disable it in chrome://extensions, or not use it on a listing page. This is stated plainly because it is the truth of the binary.