Privacy Policy

Account information. If you create an account we store your display name, email address, whether that address has been verified, and an avatar image if you upload one. Your password is never stored directly — only a cryptographic hash of it, which cannot be reversed back into your password.

Session data. Signing in sets a session cookie so the site knows it is still you between page loads. This cookie is required for a signed-in account to work.

Verification codes. When you sign up we email a six-digit code. It is stored hashed, expires after ten minutes, and is deleted once used.

Activity in the app. Your credit balance, credit transactions, daily-reward claims, and any prediction entries you make are stored against your account.

Purchases and shipments. If you buy from the store or have a prize-wheel item shipped to you, we store the order details together with the name and shipping address you give Stripe at checkout, so we can fulfill and support the shipment. The shop privacy supplement describes this in more detail.

Technical data. We record your IP address for rate limiting — the mechanism that stops someone from hammering the sign-up or login endpoints. Our hosting provider also keeps standard server logs.

First-party measurement data.We record the first page you visited, the referring site's hostname, campaign tags in the URL, a random visitor identifier, and a small set of product-funnel events such as viewing a search landing page or clicking a locked-panel signup link. If you create an account, we also record the signup page and whether you complete a meaningful product action. We do not record the words you searched for against your browser or account.

We do not ask for or store payment card numbers, and we do not buy personal data about you from third parties.

To operate an account system, to keep you signed in, to prove an email address is real before it can use the app, to run the credits and predictions features, to understand whether public search pages lead to useful accounts, to improve those pages, and to defend the service against abuse. We do not use your personal information to build advertising profiles, and we do not sell it.

We use a small number of service providers, and they only receive what they need to do their job:

Render hosts the application and the database, so account data is stored on their infrastructure. Resend delivers our email and therefore receives your email address and the message contents. Stripe processes payments if you buy something through the store; card details go directly to Stripe and never reach our servers.

If advertising is enabled on the site, ads are served by Google AdSense, which may set its own cookies and use them for ad personalization under Google's policies rather than ours. You can opt out of personalized advertising at any time via the Do Not Sell or Share My Personal Information link in the footer — ads then still appear, but Google serves them non-personalized, targeted by page content rather than by you. We honor the Global Privacy Control browser signal as the same opt-out automatically.

The market data on TCGstacker comes from outside sources such as TCGplayer pricing feeds, PSA, and image search. Those requests carry no information about you — we ask them about cards, never about users.

We will also disclose information where the law requires it, or where it is necessary to investigate abuse of the service.

The session cookie described above is strictly necessary — without it you cannot stay signed in.

First-party measurement cookies. We set a random visitor cookie and an immutable first-touch cookie for up to 180 days, plus a signup-touch cookie for up to seven days. They contain landing path, referrer hostname, URL campaign tags, and timestamps—not your name, email, search query, or activity on other sites. They are used only for our own aggregate product and search-performance measurement and are not shared with an analytics vendor.

Advertising cookies.When ads are enabled, Google's AdSense script may set its own cookies for ad delivery and personalization under Google's policies. If you opt out via the Do Not Sell or Share page (or your browser sends the Global Privacy Control signal), ads are requested in non-personalized mode instead. The opt-out itself is remembered in a small first-party cookie on your device for 12 months.

Account data is kept while your account exists. Verification codes expire in ten minutes. Rate-limiting records are short-lived by design. Credit and prediction history is kept for as long as the account exists so your balance can be reconstructed and audited. Search-performance snapshots and pseudonymous first-party funnel events are kept for no more than 480 days. Attribution attached to an account is kept while that account exists.

You can change your display name and avatar at any time in account settings. You can ask us for a copy of the data associated with your account, ask us to correct it, or ask us to delete the account entirely. Depending on where you live you may have additional rights — for example under the GDPR or the California Consumer Privacy Act — and we will honor those requests regardless of where you live.

You can delete your account yourself at any time from the Danger zone in account settings. Deletion is immediate and irreversible: it removes the profile, wallet, vault, and history associated with the account, and any unwithdrawn prize-wheel items are forfeited. Records of completed purchases are retained without the link to your account, because we need them for accounting and tax purposes. A prize shipment that is still in transit has to complete (or be cancelled) before the account can be deleted.

For anything else — a copy of your data, a correction, or help with deletion — email support@tcgstacker.com from the address on the account and we will action it.

TCGstacker is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.

Traffic is encrypted in transit, passwords are hashed, and verification codes are stored hashed rather than in plain text. No system is perfectly secure, and we will not pretend otherwise — but if a breach affects your data we will tell you.

If this policy changes materially we will update the date at the top of the page. Continuing to use the service after a change means you accept the updated policy.

Mythic Holdings LLC — support@tcgstacker.com

2406 Main St, Vancouver, WA 98660, United States