# Pepita for ChatGPT privacy policy

Effective date: October 22, 2026.

## Scope and operator

Mathis Grosjean operates Pepita for ChatGPT. For privacy questions and access, correction or deletion requests, email support@pepitacards.com.

This policy covers the Pepita Pokémon Card Value ChatGPT plugin and its three tools: search_cards, value_card and compare_trade, served at https://pepita-chatgpt.fly.dev/mcp. The separate Pepita mobile scanner has a different data flow and privacy notice; its photo storage and model-training practices do not apply to this plugin.

## Data collected and purposes for each tool

When you use a tool, ChatGPT sends its selected arguments to Pepita. Card details can describe your interests, a proposed purchase or a proposed trade even though we do not require an account or attach them to a user profile.

| Tool | Information Pepita receives | Purpose |
| --- | --- | --- |
| search_cards | Card name, language, optional set ID or set name, collector number, printed set total and result limit. These can be details ChatGPT reads from your photo. | Search the catalog, distinguish printings, check supplied details and return candidates, matching evidence and reference-image links. |
| value_card | Catalog ID, language, market (US or EU), finish, edition, condition and optional asking price. | Retrieve a dated price reference for the selected printing and market, explain missing or unsupported prices and compare your asking price with the reference. |
| compare_trade | Market and the cards on each side of a proposed trade: catalog IDs, languages, finishes, editions, conditions and quantities. | Retrieve the relevant references, calculate the value of each side and the difference, and identify incomplete comparisons. This does not execute a trade. |

Pepita returns tool results to ChatGPT, including matching evidence, your selected card attributes, price references, asking-price differences, trade quantities and calculated totals as applicable. These results may become part of your ChatGPT conversation.

The tools do not request or accept photo uploads. ChatGPT interprets your uploaded photo and sends selected textual card details instead. Pepita does not receive your original photo, full conversation, ChatGPT account credentials, payment details or a linked collection through these tools. Do not put names, contact details or other personal information into card-search fields; any text entered there is processed as a search term.

## Technical data and diagnostics

ChatGPT may also attach request metadata outside the tool arguments: requested locale, a user-agent hint, approximate location (city, region, country, timezone and potentially latitude/longitude), and pseudonymous user, conversation/session and organization identifiers. These fields are documented at https://developers.openai.com/plugins/reference#_meta-fields-the-client-provides. Pepita receives them as part of the request, but its tool handlers do not read or use them for personalization, analytics, identification or rate limiting, and do not log, cache or forward them to TCGdex. They are handled in request memory rather than retained as a user or conversation history.

Hosting and network infrastructure process connection information needed to receive and secure requests, such as the connecting IP address, request time, URL, HTTP headers and response status. For a tool call sent by OpenAI, the connecting address may be OpenAI infrastructure rather than your device. Opening this policy directly creates a separate browser request.

Our application diagnostics record tool name, outcome and duration; where available, they also record a failure reason, result status, candidate-count bucket, upstream-read count, cache-hit count and fallback reason. We use these operational measurements to investigate failures, understand catalog-search quality and monitor reliability and performance. The application does not log tool arguments, card names, asking prices, trade lists, complete returned results, photos, credentials or conversation transcripts.

## Recipients and external services

- **OpenAI / ChatGPT:** processes your conversation and uploads, selects tool arguments, sends them to Pepita and receives our results. OpenAI controls its own retention, privacy settings and any use of ChatGPT content under its policies and your settings. See https://openai.com/policies/privacy-policy/ and ChatGPT's Data Controls. Pepita cannot delete OpenAI's records.
- **Fly.io (hosting and operational logs):** runs the Pepita service and processes requests and application diagnostics to deliver, operate and protect it. The application is configured in the Paris region; that does not guarantee that all infrastructure records or other providers' processing stay in France. See https://fly.io/legal/privacy-policy/.
- **TCGdex (catalog and price-data provider):** receives card-name searches, language, a set-ID prefix when resolved or supplied, and pagination parameters. A supplied set name is resolved against its set list; collector numbers and printed totals are checked within Pepita rather than sent as search filters. Individual card lookups send catalog ID and language. TCGdex also receives the Pepita server's connection metadata. Pepita does not forward your asking price, trade quantities, give/receive grouping, condition, chosen finish or edition, original photo, conversation or ChatGPT account information to TCGdex. Cardmarket and TCGplayer price references are obtained through TCGdex, rather than by sending your valuation or trade request directly to those marketplaces.
- **Reference-image hosts, catalog links and marketplace destinations:** if ChatGPT or your browser loads a reference image, TCGdex's image host receives that request. If you open a catalog reference link, TCGdex's API receives the card-ID/language lookup and normal connection metadata. If you open a Cardmarket or TCGplayer link, that marketplace receives the linked card search and normal connection metadata. Those requests are governed by the destination's policies and are separate from Pepita's catalog requests.
- **Support operator and email service providers:** if you contact support@pepitacards.com, we and the email services delivering and storing the correspondence process your email address, message, attachments and delivery metadata to answer your question, investigate a reported problem or handle a privacy request. Do not send passwords, payment details or unrelated conversation content.

Pepita does not sell plugin data, use it for advertising or build a persistent personal card-interest profile. Pepita does not use plugin inputs or outputs to train models. This statement concerns Pepita's use; OpenAI's handling of your ChatGPT content depends on its policies and your settings.

## Retention

| Data category | Storage and retention |
| --- | --- |
| Tool arguments, attached ChatGPT request metadata and calculated results | Processed in memory to complete the request. Pepita has no database of conversations, collections or per-user search/trade history and does not intentionally persist these arguments, attached metadata or results after processing. Copies returned to ChatGPT follow OpenAI's retention rules. The catalog cache below is separate. |
| Catalog-request URLs and catalog responses | Shared in-memory cache bounded to 128 entries. Entries are fresh for 60 seconds; this is a refresh interval, not a deletion deadline. URL keys can contain the language, searched name, set-ID filter and catalog IDs looked up for search, valuation or trade. An old entry can remain until it is replaced, evicted at the cache limit or the service restarts; there is no fixed maximum age for an inactive entry. The cache is not written to disk. |
| Application diagnostic logs | Sent to Fly.io's logging service. Fly.io documents a seven-day retention window for its standard searchable app logs: https://fly.io/docs/monitoring/logging-overview/. This window does not establish retention for Fly.io's separate internal security or infrastructure records. |
| Request and connection records controlled by external providers | OpenAI, Fly.io, TCGdex and any image or marketplace destination manage their own records under their policies. Pepita has not verified a fixed deletion deadline for TCGdex request records or Fly.io's separate infrastructure records. They are not covered by the cache's 60-second freshness window or Pepita's request-memory lifecycle. |
| Support correspondence | Stored in the support mailbox. There is currently no scheduled automatic deletion period, so correspondence may remain indefinitely unless deleted following a request or a manual review. You can request deletion at support@pepitacards.com. If a specific legal obligation requires retention, we will explain the applicable limitation. |

## User controls and privacy requests

You choose which card details to provide and whether to include an asking price or proposed trade. You can use printed details instead of a photo. Do not invoke Pepita for information you do not want sent to its tools. You can stop using or disconnect Pepita in ChatGPT to prevent future tool calls; this does not recall earlier requests or erase existing records.

Use ChatGPT's conversation, file and Data Controls to manage content held by OpenAI. Disconnecting Pepita does not itself delete ChatGPT conversations or uploads. Pepita has no linked account or saved collection to delete for this integration.

Email support@pepitacards.com to ask what information Pepita holds about you or to request access, correction, deletion, or a restriction or objection where applicable. Include enough context to locate the record, such as the email address used for support and the approximate date; do not send sensitive identity documents unless we explain why proportionate verification is needed. We can handle support records we control. Because Pepita does not retain or use the attached pseudonymous identifiers, we cannot reliably associate past tool calls or shared catalog-cache entries with a particular person, and cannot erase records controlled independently by OpenAI or other providers. We will explain any limitation and the appropriate provider contact route. Rights depend on the rules applicable to your situation.

## Changes and contact

We will update this policy and its effective date when the plugin's data practices change. Contact: support@pepitacards.com.