Account details: name, email, and password (encrypted), or your identity from Google if you sign in that way.
Content you post: listings, photos, descriptions, messages to other users, offers, your collection and wishlist.
Photos you scan: if you use camera scanning to identify a card, the photo is sent for analysis (see section 4). A photo can capture more than the card — background, hands, surroundings.
Technical information: IP address and browser data, a session cookie that keeps you signed in, and basic usage analytics (page views, device type, country) collected without cookies.
Your listings, photos and name are visible to anyone browsing the site, and your messages are visible to the user you send them to. We don't moderate or automatically blur anything in the images and text you post.
So don't put anything in a listing, photo or message you wouldn't want a stranger to see — an address, a phone number, or whatever happens to be in shot behind the card.
To run the service: authenticate you, display listings, enable messages and offers between users, identify cards from a photo, and estimate card market prices.
To send email related to your use of the service: email verification, password resets, notifications about new messages or offers.
To keep the service secure and prevent abuse.
This processing is based on performing our contract with you, except security and usage analytics, which rest on our legitimate interest in a working service.
We don't sell your personal data. We use the following providers to run TCGTrade:
Google — if you choose to sign in with a Google account.
An email delivery provider — to send email on our behalf (verification, notifications).
Hosting and database providers — hosting for the site, database, and images you upload, plus usage analytics.
An AI provider — photos you scan with the card scanner are sent there to read the text on the card, and only when you use the scanner yourself.
Public card databases and price sources — public card data and price references; no personal data of yours is sent there.
These providers are US companies, so information may be processed outside the EEA under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
If you'd like to know which specific company handles a given task, get in touch and we'll tell you.
We use a single necessary cookie to keep you signed in. Our usage analytics sets no cookies, and we don't use third-party advertising or tracking cookies.
Passwords are encrypted and never stored in plain text. We apply reasonable security measures but can't guarantee complete security of data transmitted over the internet.
We keep your information for as long as your account is active. To close your account and delete your data, send a request to hjalp@tcgtrade.is and we'll action it within one month.
Under data protection law you have the right to access, correct, or delete your personal data, receive it in a portable format, object to processing, and withdraw consent where applicable. Contact us to exercise these rights.
You also have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is) if you believe we haven't handled your personal data properly.
The service is intended for people aged 18 and over, and younger users may only use it with a guardian's consent. We don't verify age at sign-up — if you're a guardian and believe a child has registered without your consent, contact us and we'll delete the account.
We may update this privacy policy from time to time. The date of the last change is shown at the top of this page.
TCGTrade is the controller of the personal data described here. Questions about how we handle it can be sent to hjalp@tcgtrade.is.
