Privacy Policy

1. Controller

Robert Adam, Odenwaldstraße 16, 12161 Berlin, Germany
Email: hello@tcgexplorer.io

2. Overview

TCGExplorer.io is a web app for exploring Pokémon TCG price and population data. This policy describes what personal data may be processed when you use the site.

In short: You can browse without an account. Optional email/password accounts unlock Pro checkout and account management. Payments are handled by Stripe. Catalog data is loaded mainly from static files and API requests. Your watchlist and display settings stay in your browser (localStorage). I do not set marketing or analytics cookies.

3. Hosting (Netlify)

Hosted by Netlify, Inc. (USA). Each visit processes technically necessary connection data (e.g. IP address, time, requested URL, browser type).

Legal basis: Art. 6 (1) (f) GDPR. I currently do not enable Netlify Analytics or similar visitor tracking in the hosting dashboard.

4. Server log files

The host stores access data in logs for operation, security, and error analysis. I do not merge this with other sources unless required by law.

Legal basis: Art. 6 (1) (f) GDPR.

5. Accounts (optional)

You may create an account with email and password to manage Pro subscription access. Account authentication and profile data are processed via Supabase Auth (Supabase, Inc., USA).

Typical data:

• Email address
• Password (stored as a hash by the auth provider, not in plain text on my systems)
• Account identifiers and session tokens needed to keep you signed in
• Profile fields used for Pro access (e.g. Pro status, Stripe customer/subscription references, subscription status)

You can reset your password from the login flow. You can delete your account in the app (Account). Deletion removes the auth user and related profile data I control, and cancels open Stripe subscriptions where possible.

Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract / requested account and Pro features). Technical operation and security: Art. 6 (1) (f) GDPR.

6. Payments & subscriptions (Stripe)

Paid TCGExplorer Pro subscriptions are processed by Stripe Payments Europe, Limited / Stripe (payment service provider). Checkout, invoices/receipts, tax calculation (where enabled), and the customer portal (manage/cancel subscription, payment method, billing history) run on Stripe-hosted pages or Stripe systems.

Stripe may process payment and billing data such as email, name, payment method details, billing address, tax information, transaction and subscription identifiers, and invoice data. Card data is handled by Stripe. I do not store full card numbers on TCGExplorer servers.

After checkout, Stripe notifies my backend (webhook) so your account Pro status can be updated. Related identifiers (e.g. Stripe customer ID, subscription status) may be stored in your profile.

Legal basis: Art. 6 (1) (b) GDPR (contract for paid Pro). Tax and accounting retention where required: Art. 6 (1) (c) GDPR. Stripe Privacy

7. Local storage (localStorage / sessionStorage)

Some data is stored on your device:

• Watchlist (currently local in the browser)
• Display preferences (currency, grade mode, sorting, ranking views)
• Cached set/card and product data (performance)
• Cached chart, price history, and offer data for detail views
• Technical version markers after app updates
• Short-lived session flags (e.g. resume checkout after login)

Delete via browser settings (site data / localStorage) or remove entries in the app where available.

Legal basis: Art. 6 (1) (f) GDPR (usable app without sending these preferences to my servers).

8. Cookies

I do not set my own tracking or marketing cookies. The host and auth/payment providers may use technically necessary cookies or similar storage for security and session handling. No marketing consent banner is used while no non-essential analytics or advertising cookies are deployed by me.

9. Fonts (self-hosted)

The Inter typeface is served from my server at assets/fonts/, without requesting Google Fonts when you load the page.

10. Supabase (API, database & auth)

The app uses Supabase, Inc. (USA) for:

• Catalog/API requests (prices, search, set values) and related infrastructure
• Authentication and account profiles when you sign up or log in
• Edge functions that talk to Stripe (customer portal, webhooks, account deletion)

IP address and request metadata may be processed. The tcggo-proxy edge function may forward price requests to third-party providers.

Legal basis: Art. 6 (1) (b) GDPR for account/Pro-related processing; Art. 6 (1) (f) GDPR for operating the public catalog features. Transfers to the USA rely on appropriate safeguards (e.g. standard contractual clauses). Supabase Privacy

11. Other third parties (CDN, images, scripts)

• Tailwind CSS (bundled on tcgexplorer.io, no third-party CDN)
• jsDelivr: JavaScript libraries (e.g. Supabase client)
• Card and product images from external CDNs (e.g. images.tcggo.com) when displayed in the app
• Static JSON from tcgexplorer.io (cache/)

Legal basis: Art. 6 (1) (f) GDPR.

12. Contact & newsletter

There is no newsletter signup in the app. If you email me, I use your message only to handle the request.

13. No investment advice

TCGExplorer shows market estimates for information only, not a substitute for your own research.

14. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent: contact me by email. You may also delete your account in the app where available. You may lodge a complaint with a supervisory authority (e.g. Berlin Commissioner for Data Protection and Freedom of Information).

15. Retention & changes

Hosting logs are kept only as long as the host requires. Account and profile data are kept while your account exists, and deleted or anonymized after account deletion except where law requires longer retention (e.g. invoices/tax records held by Stripe or required bookkeeping). localStorage remains until you delete it. This policy is updated when the site or services change.