Privacy Policy

What we collect

Account email and display name (for sign-in and account communication). If you sign in via Google, we receive the email, name, and avatar URL Google chooses to share. If you set a password, it's hashed and stored by our authentication provider — we never see the plaintext. Card photos you upload (front and optional back). Listing data you create (titles, prices, conditions, SKUs). Referral codes or campaign parameters (e.g. UTM source) when provided. Billing details are handled by our payment processor — we never see or store your credit card number.

How we use it

To provide and improve the TCG Yomitori platform, enable features like batch listing and CSV exports, communicate important account updates, comply with legal obligations, and (with your consent where required) measure marketing performance.

Sharing and disclosure

We do not sell your personal information.

We rely on a small set of trusted partners to operate the Service:

• Stripe — payment processing
• Supabase — account authentication and database hosting
• Vercel — application hosting

We also use additional service providers in standard categories such as AI inference (for card identification), file storage (for uploaded images), and third-party data sources (for catalog and market price data). These partners are contractually obligated to safeguard your data and may not use it for their own purposes.

Staff access for support

To investigate a problem you report, or a fault we detect, an authorized member of our team may open your account in a read-only support view. This shows us what you see: your batches, cards, settings, and subscription status. It does not let us change anything in your account, and it never involves signing in as you or accessing your password.

Access is limited to accounts we operate the Service with, is time-limited, and every session is recorded in an internal audit log. We do not use this to browse accounts casually — only to diagnose a specific issue.

International data transfers

Some of our partners may process data outside your country of residence, including in the United States. Where applicable, we rely on standard contractual clauses and other safeguards required by law.

Cookies and tracking

We use a session cookie to keep you signed in, and analytics cookies to understand usage and improve the Service. On our free Pack Simulator pages we show advertising provided by Google AdSense; Google and its partners may use cookies or device identifiers to serve and measure ads, including personalized ads where you have consented. You can control ad personalization at adssettings.google.com. Where required by law, a consent banner lets you choose before any advertising cookies are set. The paid application contains no advertising.

Data retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will permanently remove your personal data within a reasonable timeframe, subject to backup retention schedules and any legal obligations to retain certain records (e.g. billing history).

Your rights

You have the right to:

• Access or update your personal information
• Request a copy of your data or full account deletion
• Withdraw any consent you previously gave
• Contact us about any privacy concerns

Reach us at [email protected] for any of the above.

Security

We take reasonable technical and organizational measures to protect your data, including encryption in transit, scoped access controls, and a small infrastructure footprint. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

Changes to this policy

We may update this policy occasionally. When we do, we'll update the date at the top of this page and may notify you via email or in-app notice if the change is material.

Contact

Questions or concerns? Email [email protected].