Effective Date: June 23, 2026 · Last Updated: June 23, 2026
This Privacy Policy explains how TCG Vault ("we," "us," or "our") — operated at pokecardtracker.com — collects, uses, discloses, and protects your personal information when you use our card show inventory management platform and related services (the "Service"). By creating an account or using the Service, you agree to the practices described in this Policy.
1. Who We Are
TCG Vault is a software-as-a-service (SaaS) inventory and sales management platform for Pokémon TCG card show vendors, operated from Florida, United States and accessible at pokecardtracker.com. The Service enables vendors to track card inventory, record sales and trades, view real-time market pricing, and generate business performance summaries.
TCG Vault is part of the PokeCardRadar platform ecosystem. For privacy inquiries, contact us at:
2. Information We Collect
2.1 Account Registration Information
Username and Display Name: The name you use to identify your vendor account within the platform.
Authentication Credentials: Your password is stored using industry-standard one-way cryptographic hashing (we never store plaintext passwords). If you register via a third-party OAuth provider, we receive only the data that provider shares per the scope you authorized.
Contact Information: Email address, if provided during registration, used for account management and service communications.
Vendor Profile: Business name and any optional profile information you choose to provide.
2.2 Inventory and Business Data You Enter
The core function of TCG Vault is to store and process the business data you input. This includes:
Card Inventory Records: Card names, set information, condition grades, quantities, purchase prices, retail prices, and market valuations you record.
Sales Transactions: Date, card(s) sold, sale price, payment method, and vendor attribution (which team member made the sale).
Trade Records: Cards exchanged, estimated trade value, and any cards received in return (including auto-generated inventory entries for received cards).
Pricing Notes and Tags: Any custom notes, labels, or tags you attach to inventory items.
This business data belongs to you. We process it solely to provide the Service. We do not analyze, share, or monetize your inventory or sales records for any purpose other than operating your account.
2.3 Market Pricing Data
The Service retrieves real-time and historical market price data from third-party APIs (such as TCGPlayer, eBay, and similar trading card market data providers) to display current market valuations alongside your inventory. We do not sell or re-share this data; it is fetched on your behalf and displayed within your account.
2.4 Usage and Technical Data
Session Tokens: Cryptographically signed tokens used to maintain your authenticated session. These are stored securely and do not contain sensitive personal data.
Server Access Logs: Standard HTTP request logs (IP address, browser type, pages accessed, timestamps) retained for security monitoring and operational diagnostics.
Feature Usage: Aggregate, non-identifying data about which features are used (e.g., inventory import, trade log) to improve the Service. This data is not linked to your identity for marketing purposes.
3. How We Use Your Information
Purpose
Data Used
Legal Basis
Create and manage your account
Username, email, hashed password
Contract performance
Provide and operate the inventory management Service
All inventory, transaction, and trade data you enter
Contract performance
Display real-time and historical market pricing
Card names fetched against third-party pricing APIs
Detect and prevent fraud, abuse, and security threats
IP address, session data, server logs
Legitimate interests
Comply with applicable legal obligations
As required by law
Legal obligation
We do not sell your personal information or business data. We do not use your inventory or sales data for advertising. We do not share your business data with competitors or third-party marketplaces.
4. How We Share Your Information
Your information is shared only as described below. We do not sell, rent, or trade your personal information.
Third-Party Pricing APIs: To display market pricing, card names from your inventory are sent to third-party market data providers (e.g., TCGPlayer, eBay pricing APIs). Only card identifiers (names, set codes) are transmitted — no personal data or account information is shared. These queries are subject to the respective providers' terms of service.
Hosting Infrastructure: Our servers are hosted by Hetzner Online GmbH (Germany). Server log data and account data at rest reside on Hetzner infrastructure, which is subject to GDPR and Hetzner's data protection policies.
Payment Processing (Future): If and when paid subscription tiers are introduced, payment processing will be handled by a PCI DSS–compliant payment processor (such as Square or Stripe). We will update this Policy accordingly and will not store raw payment card data.
Other Team Members Within Your Account: If your TCG Vault account is configured for multiple vendors (e.g., two sales reps under one account), each team member can view shared inventory and transaction records within that account. Manage your team access settings accordingly.
Legal Requirements: We may disclose your information if required by law, regulation, court order, or valid governmental authority, or to protect our rights, your safety, or the safety of others.
Business Transfer: In the event of a merger, acquisition, or asset sale, your information may transfer to the successor entity subject to equivalent privacy protections.
5. Your Data — Ownership and Portability
Your business data belongs to you. All inventory records, transaction logs, trade records, and pricing notes you create in TCG Vault are your data. We act as a data processor on your behalf to store and display this data — we do not claim ownership of it.
Data Export: You may request a full export of your account data (inventory, transactions, trades) at any time by contacting . We will provide the export in a standard format (CSV or JSON) within 10 business days.
Account Deletion: Upon account deletion, all your inventory and transaction data is permanently removed from our active systems within 30 days. Backup copies are purged within 90 days.
6. Data Retention
Active accounts: Account and business data are retained for the duration of your active account.
Deleted accounts: All personal data and business data are deleted from active systems within 30 days and from backups within 90 days of account deletion.
Inactive accounts: Accounts inactive for more than 24 months may be subject to data archiving or deletion. We will provide at least 30 days' notice to your registered email before any such action.
Server access logs: Retained for up to 90 days for security purposes, then permanently purged.
Session tokens: Expire per session settings or upon sign-out.
7. Security
We implement comprehensive technical and organizational measures to protect your account and business data:
All data in transit between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
Passwords are stored using industry-standard one-way cryptographic hashing (e.g., bcrypt). We never store or transmit plaintext passwords.
Session tokens are cryptographically signed and expire automatically.
Server infrastructure is protected by firewall rules, key-based SSH access, and network isolation.
We do not store payment card data — all future payment processing will be delegated to PCI DSS–certified processors.
API keys and secrets for third-party integrations are stored as server-side environment variables, never exposed in client-side code or public source repositories.
We conduct periodic security reviews. In the event of a data breach that affects your personal information, we will notify affected users as required by applicable law.
8. Your Rights and Choices
You have the following rights with respect to your personal information and business data. We honor these rights regardless of your location:
Right to Access: Request a copy of your personal data and business data.
Right to Correction: Request correction of inaccurate personal account information.
Right to Deletion: Request deletion of your account and all associated data.
Right to Portability: Request your data in a structured, machine-readable format (CSV or JSON).
Right to Object: Object to specific processing activities based on legitimate interests.
Right to Restrict Processing: Request that we limit how your data is processed.
Right to Opt-Out of Sale: We do not sell personal information. If this changes, we will notify you and provide an opt-out before any sale occurs.
Submit requests to . We will acknowledge within 5 business days and respond fully within 30 days.
California Residents CCPA / CPRA
California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information. Contact to exercise your rights. We will not discriminate against you for exercising your privacy rights.
European Economic Area / United Kingdom Residents GDPR / UK GDPR
EEA and UK residents have rights under the GDPR and UK GDPR, including rights of access, rectification, erasure, restriction, portability, and the right to lodge a complaint with your local supervisory authority. We process your data on the basis of contract performance and legitimate interests. To exercise your rights or for questions about our legal basis for processing, contact .
9. Children's Privacy COPPA
TCG Vault is a business tool intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has created a TCG Vault account, please contact us immediately at . We will promptly investigate and delete the account and associated data.
10. Cookies and Session Management
We use minimal, purposeful cookies and storage mechanisms:
Token / Storage
Purpose
Duration
Type
Session authentication token
Maintains your authenticated session after sign-in. Cryptographically signed reference to your account.
Session / configurable
First-party, essential
Local UI preferences
Stores your UI settings (e.g., selected view, sort preferences) locally in your browser.
Persistent (local storage)
First-party, functional
We do not use advertising cookies, behavioral tracking cookies, or third-party analytics cookies.
11. Third-Party Pricing and Market Data Services
TCG Vault integrates with third-party market data providers to display real-time card pricing. When you view market valuations for cards in your inventory, the card name and set identifier are transmitted to these services to retrieve pricing data. These API calls are governed by the respective providers' terms:
Only card identifiers are shared for pricing lookups — no personal information is transmitted to these services.
12. International Data Transfers
TCG Vault is operated from the United States. Your data may be transferred to, stored, and processed in the United States and Germany (Hetzner hosting). We implement appropriate safeguards for international transfers. EEA and UK users may contact us for details on transfer mechanisms.
13. Changes to This Privacy Policy
We may revise this Privacy Policy to reflect changes in the Service, our data practices, or applicable law. When we make material changes, we will:
Update the "Last Updated" date at the top of this page;
Display an in-app notice on your next login where material changes affect you; and
Where required by law, send notice to your registered email address.
Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy.
We will acknowledge all privacy inquiries within 5 business days and respond fully within 30 days. If you are not satisfied with our response, you retain the right to contact your local data protection authority.