Privacy Policy

Working draft · pre-launch · pending legal review

This describes what TCGTerminal ("we") collects, why, and who processes it on our behalf. It is a working draft to be reviewed and finalized by counsel before launch; the binding version will be posted here with an effective date. Last updated: pre-launch.

1. What we collect

Account data — your email address and authentication credentials (managed by our auth provider), so you can sign in.
Seller verification (KYC) — if you sell, your identity and bank/payout details are collected and held directly by Stripe for identity verification and payouts. We do not store your full financial or government-ID details ourselves.
Marketplace activity — your listings, bids, orders, cart, shipping name and address, and messages, so trades can settle and cards can be delivered.
Uploads — photos you upload of your cards (listing images). These are stored in our cloud storage and are publicly viewable as part of the listings they belong to.
Automatically collected — your IP address, device and browser type, and usage/log data, collected by our servers and our security/CDN provider to operate the site, prevent abuse, and diagnose problems.
Cookies & local storage — see section 6.

2. How we use it

To operate the order book and cart, process payments through Stripe, hold funds in escrow, and fulfill shipments.
To verify sellers and keep the marketplace safe — fraud and abuse prevention, dispute handling, and support.
To comply with legal, tax, and accounting obligations.
To communicate with you about your account, orders, and support requests.

Where required (e.g. under GDPR), our legal bases are: performance of our contract with you, our legitimate interests in operating a safe marketplace, compliance with legal obligations, and your consent where applicable. We do not sell your personal data, and we do not share it for third-party advertising.

3. Service providers who process your data

We rely on the following third-party processors ("sub-processors"). Each processes only the data needed for its function, under its own privacy terms:

Supabase — our database, authentication, and file storage. Hosts your account, marketplace activity, and uploaded photos.
Stripe — payments, escrow, seller identity verification (KYC), and payouts. Stripe collects your payment and (for sellers) identity/bank details directly.
Cloudflare — content delivery and security (DDoS/bot protection). Processes your IP address and request metadata.
Render — application hosting.
Card-data providers (e.g. PokeTrace, TCGdex) — supply card pricing and catalog information. They receive card/market queries, not your personal data.

This list may change as our providers do; we will keep it current here.

4. Automated decisions & AI

We do not use artificial intelligence or automated profiling to make legally or similarly significant decisions about you, and we do not feed your personal data into AI models for training. Card condition assessment is entered by sellers themselves. If we ever introduce AI features that process your personal data, we will update this policy and disclose it first.

5. Data retention & deletion

We keep your data only as long as needed to provide the service and meet legal obligations. You can request access to, correction of, or deletion of your account data at any time (see Contact). On a deletion request we will delete or anonymize your account and your uploaded photos, except records we are required to retain — for example, completed-transaction, tax, and accounting records, and information needed to resolve disputes or prevent fraud — which are kept for the period required by law and then deleted.

6. Cookies & local storage

We use essential browser storage only — for keeping you signed in and remembering your session and preferences. We do not use third-party advertising or cross-site tracking cookies.

7. Your rights

Depending on where you live (e.g. under GDPR or CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. To exercise any of these, contact us (section 10). We will not discriminate against you for exercising your rights.

8. Children

TCGTerminal is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

9. Security & international transfers

We protect your data with encryption in transit and at rest, access controls, and least-privilege database policies. No method of transmission or storage is 100% secure. Your data may be processed and stored in the United States and other countries where our providers operate.

10. Changes & contact

We will post any changes to this policy here with a new effective date. For privacy questions or to make a data request, reach us through the channels linked in the site footer.