Privacy Policy

1. Data We Collect

We collect the following categories of information:

Account Information

Username, email address, and hashed password when you create an account.

Collection & Watchlist Data

Cards you add to your collection or watchlist, with their quantities and the purchase price recorded when you added each card.

Usage Data

Pages visited, search queries, features used, and interaction patterns to improve the Service.

Device Information

Browser type, operating system, and screen resolution for compatibility and optimization.

Scanner Results

When you identify a card with the scanner, we keep the result (the card, its name, set and image link, and the time) so you can add it to your collection later. We do not keep your photo. Results you have not added are deleted after a limited number of days.

Scan Counts

We record each scan you make (the date, your plan and whether a card was identified) to apply daily and monthly scan limits and to manage service costs. These records contain no image and are kept with your account.

Push Notification Subscriptions

If you turn on push notifications, we store your browser’s push subscription (its delivery address and encryption keys) so we can send you alerts about cards you follow. Turning notifications off removes the subscription.

Followed Cards

The cards you choose to follow and your alert settings, so we can send you price-movement alerts by email or push notification.

2. How We Use Your Data

Your data is used to:

Provide the Service

Authenticate your identity, display your collection, analyze observed market data, and personalize your experience.

Improve the Service

Analyze usage patterns to improve features, fix bugs, and develop new functionality.

AI-Powered Analysis

When you use AI features, the data needed to produce or translate the analysis is sent to our AI provider, OpenAI. Its processing and retention are subject to OpenAI’s applicable terms.

Communications

Send account-related notifications such as password resets or critical service updates.

3. Cookies and Similar Technologies

TCG Forecast sets one essential cookie. Other cookies and similar technologies are used only by third parties and, for advertising, only if you consent.

tcgforecast_session

An httpOnly session cookie containing your authentication token (JWT). This cookie is strictly necessary for the Service to function and cannot be disabled. It is not used for tracking or advertising.

Advertising (Google AdSense)

Google AdSense is loaded on every page. If you are in the European Economic Area, the United Kingdom or Switzerland, Google’s consent message (Privacy & messaging) is shown to you before personalised ads are served, so you can choose whether Google and its advertising partners may store or read cookies and similar identifiers on your device to personalise and measure ads and to limit how often you see them. Your choice is stored on your device, and you can change or withdraw it at any time with “Cookie settings” in the footer; withdrawing reloads the page. Without your consent, personalised ads are not served. Because the AdSense script is requested when the page loads, Google receives your IP address and browser details before you choose.

Analytics (Vercel)

We use Vercel Web Analytics and Speed Insights to measure page views and page performance. According to Vercel, Web Analytics does not use cookies and does not identify individual visitors. The data recorded for each page view is the page address, referrer, country, browser, operating system and device type.

Preferences stored in your browser

We also keep preferences such as your language and market choice in your browser’s local storage. This stays on your device.

4. Third-Party Services

We share data with the following service providers and recipients only as needed to operate the Service. Some of them are located outside the European Economic Area.

OpenAI

When you use the AI Advisor, we send OpenAI what it needs to write the analysis. For your collection, that is the card names, variants and quantities, the purchase price recorded when you added each card, the current prices and recent price history. The text of the generated analysis is sent to OpenAI again to translate it into other languages. Our requests set OpenAI’s API option not to store responses (store=false); OpenAI’s own retention and abuse-monitoring rules still apply to API data. Market summaries and leaderboard analyses use public market data only.

Scrydex

Scrydex is our card-recognition and market-data provider. Card data and market prices are fetched from Scrydex, including the card names you type when you search or add a card by name. Photos you scan with the card scanner are sent to Scrydex to identify the card; Scrydex may process them to operate and improve its service. Your browser also loads card images directly from Scrydex’s image servers, so Scrydex receives your IP address and browser details. Your account details are not shared with Scrydex.

Stripe

Payment processing for premium subscriptions. When you subscribe, we send Stripe your email address, username and account ID so it can create your customer record. You enter payment details on Stripe’s pages and Stripe handles them. We do not store credit card numbers.

Resend

Email delivery. We send Resend your email address, your username and the content of the emails we send you, such as verification, password reset and billing notices, and the update emails you have not turned off.

Vercel

Hosting of the website, plus Web Analytics and Speed Insights. Vercel receives the requests your browser makes to load the site, including your IP address, and, through its analytics tools, page addresses, referrer, country, browser, operating system and device type.

Railway

Hosting of our server and database, which store the data described in this policy.

Browser Push Services

If you turn on push notifications, your browser’s push service (for example Google, Mozilla or Apple, depending on your browser) receives your subscription address and delivers our notifications. The notification content is encrypted for your browser; the push service can see the delivery address and timing.

Google AdSense

Advertising and Google’s consent message. Google receives your IP address and browser details when the page loads and, depending on your choice in the consent message, the identifiers described above to serve and measure ads.

Font Awesome, GitHub and PokeAPI

Icons, Pokémon artwork and Pokédex data are loaded from Font Awesome, GitHub and PokeAPI. When your browser fetches them, those services receive your IP address and browser details, as with any website resource.

5. Data Storage & Security

Your data is stored in a secure PostgreSQL database. Passwords are hashed using bcrypt and are never stored in plain text. Authentication tokens are transmitted via httpOnly cookies to prevent cross-site scripting attacks. We implement reasonable technical and organizational measures to protect your data, but no system is completely secure.

6. Your Rights

You have the following rights regarding your data:

Access

You can view your account information, collection, and watchlist data at any time through your account dashboard.

Correction

You can update your account information through your account settings.

Deletion

You can delete your account and all associated data through your account settings. This action is irreversible.

Data Export

You may request an export of your data by contacting us.

7. GDPR Compliance (EU Users)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your data is your consent (provided at registration) and legitimate interest (to operate and improve the Service). You have the right to withdraw consent at any time by deleting your account. You may also lodge a complaint with your local data protection authority.

8. Children's Privacy

TCG Forecast is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service or sending an email. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at tcgforecastsupport@gmail.com