Privacy

TCG Tracker is run by Steven Hamilton, who is responsible for the personal data it holds (its data controller, under UK GDPR). Write to support at tcgtracker dot online about anything on this page.

What we store

• Your account: your email address, username, password (stored only as a one-way hash, never as you typed it), and the avatar and banner you chose.
• Your collection: which cards you own and how many, your lists, and the value of your collection each day, kept for two years.
• Your friends: who you've added, and who has added you.
• Invitations you send: the address you invited.
• Where you're signed in: the IP address and browser of each device, until you sign out or haven't used it for 90 days.
• Error reports: when something goes wrong, a record of the error and the page it happened on, kept for 30 days.
• Server logs: the IP address, browser and page of each request. They're capped in size rather than kept for a set time, so newer entries overwrite older ones.

The database is backed up every night, and each backup is kept for 14 days.

Who can see it

Anyone signed in can see your username, avatar and banner. Friends, people you've added who have added you back, can also see your collection and your lists. What your collection is worth is shown only to you.

Who else handles it

• Hetzner runs the server the app and its database live on, in Nuremberg, Germany.
• Resend sends our emails (invitations, password resets and email address changes), so it handles your email address and those messages.
• Resend also receives what you send to support at tcgtracker dot online and keeps it for up to 30 days.
• Google's Gemini reads the photos you take with the card scanner, to work out which card is in them. The photo goes to Google and we don't keep it.
• Cloudflare stores and serves the card images and our database backups. Your browser fetches the images from Cloudflare, so it sees your IP address.

Resend, Google and Cloudflare may handle your data in the United States. Each is bound by contractual safeguards that UK data protection law recognises.

We don't sell your data, share it with anyone else, or show advertising.

Cookies

Only the ones that keep you signed in and carry messages from one page to the next. There are no analytics, advertising or tracking cookies.

Why

We use your data to run the service you signed up for and for nothing else. That's the lawful basis: it's needed to provide what you asked for.

Your choices

• Change your email address, password, username, avatar and banner in your account settings.
• Delete your account in your account settings. It's erased straight away, along with your collection, lists and friends, and drops out of the backups within 14 days.
• Ask for a copy of your data, or anything else this page doesn't cover, at support at tcgtracker dot online.
• If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.