Asset licensing and source risk register

Date: 2026-05-14. Status: operational guardrail, not legal advice.

This page records asset, content, data-source, and licensing risks that affect SKN's scanner, collection, pricing, and future marketplace work. It is not a substitute for legal review. It exists so engineering decisions do not accidentally turn an internal proof of concept into public redistribution of assets we do not control.

Core rule

Private indexing is still copying. Public image serving is redistribution.

Unknown, missing, or unclear rights are acceptable only for private lab work on controlled infrastructure. They are not acceptable for assets bundled in the app, exposed through a public CDN, displayed in production UI, used in paid marketing, or shipped as a downloadable dataset.

Every source used by the product should keep:

• source name and upstream URL;
• source type: image, metadata, pricing, sale comp, user upload, model output;
• license or terms URL when available;
• rights status: approved, internal_only, unknown, or blocked;
• allowed uses: private_lab, private_beta, public_app, public_api, marketing, training, redistribution;
• cache permission, rehost permission, and public display permission;
• attribution requirement;
• last review date and reviewer.

Risk register

Area	Current examples	Main risk	Allowed now	Required before production use
Sealed-product imagery from ptcg-assets	1niceroli/ptcg-assets local clone, packshots, ETBs, displays, tins, collections	The GitHub repository exposes no declared license (NOASSERTION), and the images likely include copyrighted Pokémon packaging artwork	Private sealed scanner lab, private embeddings, private candidate analysis	Written permission, a compatible license, or replacement by production-safe assets
SKN-owned sealed bootstrap references	Owned French sealed photos under tcg-collector-backend/src/api/tests/fixtures/sealed-samples	Safe for lab use, but the current benchmark reuses the same photos as references, so it can overstate real-world accuracy	Private lab matching, debug candidate display, regression benchmark	Separate unseen evaluation set, documented retention policy, and explicit production asset policy
Pokémon card images	TCGdex images, local image cache, scan debug candidates	Card artwork is copyrighted; cache and rehost rights must match source terms	Current private/dev scanner work with provenance retained	Verified source terms for cache, public display, rehost, attribution, and commercial use
Pokémon logos, symbols, product names, set marks	Set logos, Pokémon names, product packaging, slab labels	Trademark and brand confusion risk; app must not imply official affiliation	Descriptive references and internal classification	Clear disclaimers, trademark-safe product copy, and legal review before public launch
Competitor screenshots and UI/UX references	MonPrice, TCG CardScanner, Iestims, Zebradex screenshots in research folders	Screenshots are copyrighted and should not become public marketing or training assets	Internal competitive research only, with source/date context	Remove or replace before public docs/marketing unless permission or fair-use/legal review is explicit
Marketplace and pricing data	eBay, Cardmarket, TCGPlayer, PriceCharting, RapidAPI providers	API terms, scraping restrictions, caching limits, rate limits, and commercial-use clauses	Provider evaluation and normalized schema design	Terms review, API agreement where needed, cache policy, freshness display, and provider abstraction
User-uploaded scan photos	Phone captures, debug images, issue screenshots	Photos may include personal data, EXIF, background content, or collection value signals	Transient scan processing and explicit debug cases	Retention policy, EXIF stripping, deletion path, access control, and user-facing privacy copy
Slab label and certification data	PSA/CGC/BGS labels, grade text, certification numbers	Certification databases and label designs may have terms and branding limits	OCR/classification experiments on user-provided images	Terms review before querying official databases or showing certification enrichment
Derived embeddings and indexes	DINOv2 embeddings from card or sealed images, pgvector tables	Embeddings can be derived from assets with unclear rights and should not become a redistributed dataset	Private matching index on controlled backend	Source registry linkage, no public dump, no public candidate images unless image rights are approved
Third-party ML models and libraries	DINOv2, Ultralytics YOLO, OpenCV, FAISS/pgvector, npm/python dependencies	Model and dependency licenses may impose notice, attribution, copyleft, or commercial constraints. Ultralytics YOLO usage must be reviewed against AGPL-3.0 or commercial Enterprise terms before closed commercial production use.	Engineering use with dependency tracking and private lab gating	License audit, notices, model-license records, and commercial-license decision before production release
Public server and CDN storage	VPS image storage, nginx-served images, future CDN	Hosting images on our server can become redistribution even if the file originated elsewhere	Private authenticated debug or terms-approved serving only	Public asset allowlist enforced by rights status

Practical policy

Internal lab

Internal lab usage may ingest sources with unknown or internal_only status when access is restricted to the team and the output is used only to evaluate scanner quality. This includes sealed-product experiments using ptcg-assets.

Internal lab endpoints should not expose raw source folders, full datasets, or downloadable image archives. For sealed scan endpoints, returning product metadata and confidence is acceptable. Returning candidate images is acceptable only in private debug surfaces.

Private beta

Private beta should not display unlicensed third-party images by default. If an unapproved source is needed for matching, keep it backend-only and return a placeholder, user photo crop, or metadata-only candidate in the client.

Public production

Production must block unknown and internal_only images from:

• mobile app bundles;
• public APIs;
• public CDN or nginx routes;
• marketing pages;
• public documentation;
• downloadable datasets;
• marketplace listing media.

Production-safe images must be backed by explicit source terms, direct permission, a compatible license, or user-owned uploads with appropriate consent.

Sealed scanner implication

ptcg-assets is useful for proving whether DINOv2 plus pgvector can identify sealed products. It should not be copied wholesale into the public backend data path, app bundle, or CDN.

The safer sealed-lab architecture is:

1. keep ptcg-assets as a private source clone;
2. create a normalized sealed-product source registry;
3. index only a controlled subset for lab matching;
4. store source provenance on every product and image;
5. keep embeddings private;
6. return public candidate images only after the source is approved for public display.

Immediate actions

1. Add a source registry before scaling sealed-product indexing.
2. Mark ptcg-assets as internal_only until permission or replacement assets exist.
3. Verify TCGdex, pokemon-api.com, eBay, Cardmarket, TCGPlayer, and graded-provider terms before public pricing or image display.
4. Strip EXIF and define retention for scan debug uploads.
5. Add a production allowlist so public image routes can serve only approved assets.
6. Keep legal review as a launch gate before public paid release.

Related docs

• Data sources and pricing strategy
• Product engine architecture
• Scan UI/UX competitive review