This Privacy Policy explains what personal information TCG Tradr collects, why, who it is shared with and the choices you have. "TCG Tradr", "we" and "us" mean the individual operating TCG Tradr. It applies to the TCG Tradr app, this website and the services behind them. We do not sell your personal information and we do not show ads.
Your email address, full name, a unique username and your password (stored only as an Argon2 hash, never in readable form). We use them to create and secure your account, sign you in, send account emails (such as verification, password reset and security notices) and let teammates and other members recognise you. When you sign up you confirm that you are 13 or older and accept the Terms and this policy; we record that confirmation with the versions in force, the time, your IP address and your device's user agent.
The camera picture and any photo you choose are read on your phone to find the card's collector number or a slab's certificate number. The images are not uploaded to us. What leaves the phone is the text needed to look the card up: a collector number or card id to price it, or a certificate number, which our server looks up with CardHedge.
Your collections, inventory, purchases, carts, sales, trades, card shows, vending rules and what you paid are stored on our servers per vendor profile and copied to your phone so the app works offline and teammates stay in step. Team owners create invite codes; we record who joined a profile with which code and their role. Members of a vendor profile can see that profile's vending data.
Before Social is turned on we ask for your date of birth. Our server works out your age and decides whether you can use Social (18+). As evidence of that check we keep a record of the date of birth you entered, the age it gave, the outcome, the versions of these documents you accepted and the exact wording you agreed to, the time, your IP address, your device's user agent, a device id and the app version. If you set up a Social profile we store your role (vendor, collector or both) and, if you add one, a profile picture. Pictures are re-encoded to a small square JPEG and their location and camera data (EXIF/GPS) are removed before they are stored.
We store your connection requests and connections, the bundles you send and receive and the offers made on them, and your direct messages (text only) and which messages you have read. Messages are checked automatically on our server before they are delivered; a message that breaks our rules is refused and not stored, and we log only that it was refused, why, and between whom. If you block someone or report a member or a message, we store the block, the report's reason, any details you write and the message or conversation you pointed to. When a report is reviewed, our administrators can read it, both members' names, usernames and email addresses, and the reported message with a few messages before and after it (or the conversation's latest messages). We read conversations only to review reports. We record the outcome, such as a warning or a suspension.
If you allow notifications, your phone gives us a push token (from Apple Push Notification service or Firebase Cloud Messaging). We store it with your sign-in session and use it only to tell you about new direct messages and the unread count.
The app creates a random id for each installation. We use it to keep sign-ins to one device per account and to tell you why a session was signed out. We keep a log of security events (sign-ins, sign-outs, password and email changes, two-factor changes, account closure and similar) with the time, IP address, user agent and client type, and ordinary server logs, to protect accounts and investigate abuse.
If you join the waitlist on our website we store your email address, the name and role (vendor or collector) you give if any, and the IP address and browser user agent of the sign-up. We send one confirmation email and add you only after you confirm it (double opt-in). We use the address only to tell you about the launch. Every email has an unsubscribe link, after which we never email you again; we delete your entry when you ask or after the launch announcement.
Where the law requires a legal basis, we rely on: performing our agreement with you (running your account and the features you use); our legitimate interests in keeping the Service secure, preventing fraud and abuse and improving it; your consent (push notifications, the waitlist and the Social age check — you can withdraw consent at any time); and legal obligations (for example keeping transaction records or responding to lawful requests).
We share personal information only with the service providers who run the Service for us, under contracts that limit their use of it, and never sell it:
We also collect public market data (eBay sold listings through SoldComps, alt.xyz sold auctions, TCGplayer listings and TCGCSV's catalog data) on our servers; none of your personal information is sent to those sources. We may disclose information if the law requires it, to protect people's safety or our rights, or to a successor if TCG Tradr is reorganised or sold (for example to a company formed to run it), in which case this policy keeps applying.
Passwords are hashed with Argon2; all traffic to our servers uses TLS (HTTPS); sign-in tokens are kept in the phone's encrypted secure storage; access to our servers and database is restricted; and you can turn on two-factor authentication. No system is perfectly secure — if you think your account is at risk, change your password and contact us.
Depending on where you live (for example California, the EU/EEA or the UK) you may also have the right to know what personal information we hold, to receive a copy, to correct or delete it, to object to or restrict some uses, and to withdraw consent. We do not sell or "share" personal information for cross-context behavioural advertising and we do not use it to make decisions with legal effects about you. To use any of these rights write to support@tcg-tradr.com from the address on your account; we will confirm it is you and answer within the time the law requires, and we will not treat you differently for asking. You may also complain to your local data protection authority.
TCG Tradr is not for children under 13 and we do not knowingly collect their information; if you believe a child under 13 has an account, tell us and we will delete it. Social is for people 18 or older. If the date of birth entered at the age check shows someone is under 18, Social stays off for that account; we keep the record of the check as described in section 5 and use it for nothing else.
We are based in, and our servers are hosted in, the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States, where data protection laws may differ from yours. Where the law requires it we rely on appropriate safeguards for those transfers.
The app has no advertising or third-party analytics trackers, and these web pages set no cookies.
We will update this policy when what we do changes. The version and date are shown at the top of this page. For material changes we will tell you in the app before they take effect and ask for your consent again where the law requires it.
Questions or requests about your privacy: support@tcg-tradr.com. See also our support page and Terms of Service.