Privacy notice

What TCG Passport collects

TCG Passport stores account identifiers and email verification state, public profile information, deal terms and item details, deal status, feedback, and technical security logs. Seller Hub also stores inventory entries, quantities, asking prices, visibility choices, and store settings. Card requests store selected item details, preset questions, replies, offers, and request history. Enabled commerce features also store order records and conversations, delivery details, payment, refund and dispute statuses, provider references, shipping-label and tracking information, and postage accounting entries. Inventory entries are excluded from the public store unless the seller makes them visible there. Request messages are not public and are available to the participating buyer and seller within the request. Invitation email addresses, private notes, invite tokens, and uploaded evidence photos are treated as private deal data.

What can become public

Public profiles may show a handle and transaction-backed reputation. A seller’s store can show their store name, tagline, chosen cover, Best Offer setting, and selected payment-method labels. Cards the seller makes visible can show their catalog details, condition, finish, available quantity, and asking price. Payment-method labels describe preferences; they do not process payments or publish payment account identifiers. Under the current completed-deal policy, both participants accept that successful completion automatically creates a privacy-safe record showing participant handles, the items exchanged, an agreed cash amount when applicable, the completion date and status, and structured feedback.

Public responses do not include account email addresses, invitation tokens, private notes, addresses, payment identifiers, or private evidence photos.

How information is used

Information is used to operate and improve Store, checkout, orders, shipping, support and agreement workflows, protect accounts, enforce access boundaries, create transaction-backed records, and investigate reports. TCG Passport does not sell personal information or use it for targeted advertising.

Optional public-page analytics

TCG Passport uses Google Analytics only after you choose Allow analytics, and only on public service pages such as the homepage, privacy notice, terms, and contact page. The only event TCG Passport authors is a manual page view with a fixed page name and canonical URL without query strings, fragments, or referrers. Google Analytics may derive session and engagement measurements from those permitted visits. TCG Passport does not send account identifiers, email addresses, user IDs, deal or invite identifiers, private routes, public-profile or completed-record paths, private notes, evidence, or advertising data.

Your choice is stored in this browser and can be changed through the Analytics choices control. Global Privacy Control and browser Do Not Track signals keep analytics off. Google Analytics is configured without advertising personalization or Google signals. When allowed, its browser identifier expires after 90 days and is not extended by later activity.

Account signup and credentials

Email-and-password signup, sign-in, and recovery are handled directly by Supabase Auth. TCG Passport does not store your password. If CAPTCHA protection is enabled for this environment, Cloudflare Turnstile processes the anti-bot check before signup.

Service providers and requests

Cloudflare provides the website edge and security layer. Supabase provides authentication, database, private storage, and server functions. Resend supports account and application email delivery. Stripe processes payments and related refund and dispute events for enabled payment flows. EasyPost supports shipping-label purchase and carrier tracking for enabled shipping flows. For an access, correction, or deletion request, email [email protected]. Limited order, payment, postage and completed-record facts may need to be retained for transaction integrity, accounting, recovery and support.