Privacy policy

Data we may collect

• Account data: email, public display name, avatar, login provider, and Discord, Google, or Twitch identifiers when chosen.
• User content: collection, wanted list, sell list, catalog proposals, public profile, marketplace activity, and preferences.
• Technical data: cookies, session data, WebView/app local storage, device, browser, language, and events needed for security and operation.
• Email and notification data: newsletter preferences, alerts, delivery history, and confirmation, reset, or unsubscribe tokens.
• Camera access in the Android app: requested only for scan features when the user starts that action. We do not store camera video or images unless a future feature asks for explicit confirmation.

How we use data

• To authenticate accounts, maintain sessions, and protect access.
• To save collections, lists, favorite cards, marketplace listings, and preferences.
• To show cards, sets, prices, history, and companion tools.
• To send emails requested by the user, including confirmation, password reset, newsletter, and enabled alerts.
• To diagnose issues, prevent abuse, and improve service stability.

Data sharing

We do not sell personal data. We may share data only when needed with providers that support the service, such as hosting, database, email, authentication, app stores, and platforms used by the user, including Discord, Google, Twitch, and Google Play.

Some data may become public when the user chooses to publish a profile, list cards on the marketplace, or share information in a Discord server.

Android app and WebView

The Android app loads the official website in a WebView. It uses internet access to reach the service and may request camera permission for card scanning. Cookies, session data, and local storage may be kept on the device to maintain login and preferences.

Depending on Android settings, some local app data may be included in device backup or device transfer.

Retention and deletion

We keep data while it is needed to operate the account and meet technical, security, or legal requirements. Users can manage email preferences in Preferences and can request/delete the account and associated data at Account and data deletion.

After account deletion, we remove or anonymize personal data where possible. Some minimal records may be kept for security, anti-fraud, audit, or legal compliance.

Security and children

We use reasonable measures to protect data, including HTTPS, secure sessions, temporary tokens, and access controls. No system is completely risk-free.

The service is not directed to children under 13. If you know that a child provided personal data to us, contact us so we can review removal.