Privacy Policy

Account information. If you create an account we store your display name, email address, whether that address has been verified, and an avatar image if you upload one. Your password is never stored directly — only a cryptographic hash of it, which cannot be reversed back into your password.

Session data. Signing in sets a session cookie so the site knows it is still you between page loads. This cookie is required for a signed-in account to work.

Verification codes. When you sign up we email a six-digit code. It is stored hashed, expires after ten minutes, and is deleted once used.

Activity in the app. Your credit balance, credit transactions, daily-reward claims, and any prediction entries you make are stored against your account.

Technical data. We record your IP address for rate limiting — the mechanism that stops someone from hammering the sign-up or login endpoints. Our hosting provider also keeps standard server logs.

We do not ask for or store payment card numbers, and we do not buy personal data about you from third parties.

To operate an account system, to keep you signed in, to prove an email address is real before it can use the app, to run the credits and predictions features, and to defend the service against abuse. We do not use your personal information to build advertising profiles, and we do not sell it.

We use a small number of service providers, and they only receive what they need to do their job:

Render hosts the application and the database, so account data is stored on their infrastructure. Resend delivers our email and therefore receives your email address and the message contents. Stripe processes payments if you buy something through the store; card details go directly to Stripe and never reach our servers.

If advertising is enabled on the site, ads are served by Google AdSense, which may set its own cookies and use them for ad personalization under Google's policies rather than ours.

The market data on TCGstacker comes from outside sources such as TCGplayer pricing feeds, PSA, and image search. Those requests carry no information about you — we ask them about cards, never about users.

We will also disclose information where the law requires it, or where it is necessary to investigate abuse of the service.

The session cookie described above is strictly necessary — without it you cannot stay signed in. We do not currently run analytics or tracking cookies of our own. Advertising cookies, if ads are enabled, are set by Google rather than by us.

Account data is kept while your account exists. Verification codes expire in ten minutes. Rate-limiting records are short-lived by design. Credit and prediction history is kept for as long as the account exists so your balance can be reconstructed and audited.

You can change your display name and avatar at any time in account settings. You can ask us for a copy of the data associated with your account, ask us to correct it, or ask us to delete the account entirely. Depending on where you live you may have additional rights — for example under the GDPR or the California Consumer Privacy Act — and we will honor those requests regardless of where you live.

Email privacy@tcgstacker.com from the address on the account and we will action it. Deleting an account removes the profile, wallet, and history associated with it.

TCGstacker is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.

Traffic is encrypted in transit, passwords are hashed, and verification codes are stored hashed rather than in plain text. No system is perfectly secure, and we will not pretend otherwise — but if a breach affects your data we will tell you.

If this policy changes materially we will update the date at the top of the page. Continuing to use the service after a change means you accept the updated policy.

Mythic Holdings LLC — privacy@tcgstacker.com