Privacy Policy

We collect account and profile information such as your user identifier, email address, nickname, optional profile photo and biography, sign-in provider and account preferences.

When you use marketplace features, we process your card collection, wishlist, sale and wanted listings, prices, card details, basket contents, transaction history, ratings, reports, blocked-user relationships and messages exchanged to arrange a trade.

If you use the map, the app may access your device location with permission to center the map. A map pin and its visibility radius are stored only when you choose to create or update a pin. You can remove the pin or disable its visibility in the app.

We also process push-notification tokens, security and server logs, support communications and technical information needed to operate, protect and troubleshoot the Service.

We use this information to authenticate users, provide collections and listings, show relevant cards and nearby public pins, deliver messages and notifications, process and document transactions, pay sellers, provide support, enforce our Terms, investigate reports and prevent fraud or abuse.

We do not sell personal information. We do not use app analytics for advertising, marketing profiles or tracking you across apps and websites owned by other companies.

We process account, marketplace, messaging and transaction information where necessary to provide the Service and perform our contract with you. We process security records, reports and relevant account, order, transaction and communication information where necessary for our legitimate interests in protecting users, investigating misuse, preventing fraud, resolving disputes and enforcing our Terms. We process information where necessary to comply with legal obligations, including applicable payment, tax, accounting and law-enforcement requirements. Analytics and crash diagnostics are processed only with the permission described below.

Authorized administrators may access reports and related user identifiers, contact information, transaction details, and relevant chat or order records only where reasonably necessary to investigate abuse, enforce our Terms, protect users, prevent fraud, provide support or handle disputes. Administrative access is authenticated, restricted to authorized persons on a need-to-know basis and logged for security and accountability. Administrators must not use this information for unrelated purposes.

A report may contain information written by another user. Please do not include sensitive or unrelated personal information in a report. We disclose report information only where necessary to investigate or respond to the incident, protect another person's rights, establish or defend legal claims, or comply with law.

TCG Cycle uses Firebase Authentication to manage email, Google and Apple sign-in; Firebase Realtime Database to deliver chat updates; Firebase Cloud Messaging to deliver push notifications; and Firebase Crashlytics to diagnose crashes and technical failures. These services may process account identifiers, authentication tokens, messages or chat metadata, push tokens, device information and network information as needed to provide those functions.

Google acts as a service provider for these Firebase services. Access is limited to the purposes described here and is subject to Google's applicable data-protection terms and security controls.

With your permission, the TCG Cycle app uses Google Analytics for Firebase, a service provided by Google, to understand how the app is used and where the experience may cause friction. For example, analytics can show where users stop a flow or stop returning to the app. We use these insights only to improve usability, reliability, and product performance. We do not use analytics data for advertising or to track you across apps or websites owned by other companies.

Analytics data may include a randomly generated app-instance identifier, device model, operating system and app version, language, approximate region, session information, screens viewed, feature categories used, aggregate counts and technical performance events. We do not send names, email addresses, account user IDs, chat IDs, transaction or order IDs, imported file names, message contents, payment details, precise location or the contents of card listings to Google Analytics.

With the same permission, Firebase Crashlytics processes crash stack traces, technical error information, timestamps, app and operating-system versions, device model and state, and randomly generated Crashlytics and Firebase installation identifiers. We do not deliberately attach your name, email address, account user ID, messages, listing contents, payment details or precise location to crash reports.

Analytics and crash-report collection are disabled until you make a choice in the app. If you consent, event-level analytics data is retained for up to 2 months. Crashlytics keeps crash traces and associated installation identifiers for 90 days before beginning their removal from live and backup systems. Google processes this data on our behalf under its applicable Firebase terms and controls.

You can refuse analytics and crash diagnostics without losing access to the app. You can also withdraw or grant consent at any time in the app's Settings. Changing your choice stops or resumes future uploads; it does not retroactively remove information already processed. Crash information created while reporting is disabled may remain temporarily on your device and can be submitted if you later enable diagnostics. You may contact [email protected] with privacy questions or requests.

Payments, refunds, seller identity verification and payouts are processed by Stripe. Stripe receives the payment, identity, contact, bank-account or card information that you provide in its hosted flows. TCG Cycle receives transaction identifiers, amounts, currency, payment and payout status, refund status and connected-account status, but does not store full payment-card details.

Stripe may retain payment and verification records under its own legal and regulatory obligations. Stripe's privacy notice applies to information you submit directly to Stripe.

Reasonable technical and organizational measures are used to protect collected information. No online system can guarantee absolute security, but appropriate steps are taken to reduce risk and limit unauthorized access.

Account, profile, collection, wishlist, listing, map-pin and preference data is normally kept while your account is active and is removed when you delete the relevant item or your account, unless limited retention is required for security, fraud prevention, disputes or law.

Active chats are kept while a trade is open. When a transaction is completed or canceled, its chat becomes read-only and remains available to the participants from transaction history for 90 days. The archived chat is then deleted from the active database unless it must be preserved for a reported incident, dispute, security investigation or legal obligation.

Transaction, refund, payout and report records may be retained after account deletion. The retention period for a report and its related evidence is determined by the time reasonably needed to investigate and resolve the incident, detect repeated abuse, enforce our Terms, protect affected users, establish or defend legal claims, and comply with applicable payment, tax, accounting or other legal obligations. When continued identification is no longer necessary for those purposes, the information is deleted or anonymized. Push tokens are removed when they are no longer associated with an active session or account. Analytics event data is retained for up to 2 months and Crashlytics data for 90 days as described above.

You can access or update profile information and preferences in the app. You can delete your account in Settings or use our dedicated account-deletion page. Apple authorization is revoked when an Apple-authenticated account is deleted. We may ask you to verify ownership before fulfilling a request.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection by emailing [email protected]. You may also complain to your local data-protection authority. If this policy changes, we will publish the updated wording and date on this page.