Effective date: August 5, 2026
This policy describes what TCGdeck (the “Service”) collects, why, who else sees it, and how to get rid of it. It is written from what the application actually does rather than from a template, so where something is less private than you might assume — photographs stored at public web addresses, a summary of your collection sent to an AI provider — it says so plainly.
TCGdeck is a small, invite-only hobby project operated by its administrator. There is no company behind it and no data is sold to anyone, ever. For any question about this policy or about your data, use the support page.
Your account. Your email address and password, handled by our authentication provider — passwords are stored hashed and are never visible to us or to anyone else. Your display name, avatar initials, friend code, plan and role.
What you put in the app. The cards in your collection with their quantities, finishes, notes and any custom values you set; sealed products; decks and deck notes; grading reports; battles; friends and friend requests; trade posts and trade messages; and your conversations with DeckAI.
Photographs. Card photos you take to scan, photographs you attach to a card, and the photos you submit for a grading report.
Usage records. Each AI action records which feature was used, which model, how many tokens and what it cost, so credits can be metered honestly. Each scan records how long it took and how many cards were detected, matched and saved. We keep a short rolling window of server logs for diagnosing faults; these can contain card names and internal identifiers.
Payment records. If you subscribe or buy credits, our payment processor holds your card details. We never see or store a card number. We store your customer and subscription identifiers, your plan, and what you were charged.
We do not use advertising trackers, analytics pixels, or any third-party profiling of any kind.
Cookies: your session, and nothing else. Signing in sets an authentication cookie, and during sign-in a short-lived one that completes the exchange. They exist solely to keep you signed in. We set no analytics, advertising or profiling cookies, which is also why this app has no cookie banner — a session cookie is strictly necessary and exempt from consent requirements.
Local storage: three preferences. Whether you dismissed the “add to your home screen” offer, which announcements you have already closed, and the identifier of a scan still running — so reloading the page mid-scan does not lose work you have paid for. None of it is personal and none of it is sent anywhere.
Other people's cookies. Going to the payment processor's checkout puts you on their site, where their cookies apply. Card pictures are loaded from the card databases' own image servers, which we neither control nor read.
Every photograph you take — a card's picture, the front and back you submit for grading, anything the bulk scanner processes — is stored privately. None of it can be opened by web address. Each view is authorised first and then served through a link that stops working within the hour, so a link that leaves the app is worthless by the time anyone follows it.
One photograph is shared on purpose: if you photograph a card no card database has a picture of, and that photo becomes the card's picture, everyone who owns that card sees it. That is what the feature is for. Photos you submit for grading are never shared this way — they are yours and the administrator's.
Until August 2026 the card-picture bucket was readable by anyone holding the web address. This section used to say so. It no longer applies, and the change was applied to photographs already stored, not only to new ones.
Our hosting and database providers store everything above on our behalf.
Anthropic processes AI requests. This means: photographs you scan or submit for grading; the questions you ask DeckAI or the deck coach; and, for assistant questions, a summary of your collection and decks so the answer can be about your actual cards. Card photographs are also read by AI to transcribe what a card does when no card database describes it. Anthropic processes this to answer the request and does not use it to train its models.
Our payment processor handles checkout, subscriptions and card details.
Card and price databases — pokemontcg.io, TCGdex, Pokémon Price Tracker, PokeTrace and eBay — are asked about cards, not about you. They receive card names, numbers and set names. They are never sent your identity, your collection, or anything that could be linked back to you.
We disclose data otherwise only where the law requires it. We do not sell or rent personal information, and there is nobody to sell it to.
A family group lets one adult invite up to five members and set their AI usage caps. The organiser can see each member's usage and remaining credits, and can remove a member. They cannot read a member's DeckAI conversations, and collections are visible to each other only through the app's ordinary sharing — friends, decks and trades — exactly as they would be between any two members.
The Service is not intended for children under 13, and you must be 13 or older to hold an account. A younger person should not create one. If you are under the age of majority where you live, use the Service only with a parent or guardian's knowledge and consent — a family group is the intended way for a parent to set one up and keep an eye on it. If we learn that an account belongs to a child under 13, we will delete it and its data.
Your data stays while your account exists. Deleting your account removes it: the account itself, your collection, decks, grading reports, battles, friends, trades, usage ledger and family memberships all go with it and are not recoverable.
Two things survive deliberately and neither identifies you: the shared card catalogue, including any card record created because you scanned something the databases didn't have, and payment records our processor is required to keep for tax and accounting.
See it. Everything in your collection is on screen, and the collection can be exported to a spreadsheet from the collection page.
Correct it. Every card, quantity, finish, note and value is editable, and your account details are editable in Settings.
Delete it. Settings → Account → Delete account, which tells you exactly how many cards, decks and reports are about to go, and then does it immediately. You do not have to ask us, and there is no waiting period.
Depending on where you live you may have further rights over your personal data — to access it, correct it, export it, or have it erased. The three buttons above cover all of them; if you would rather ask, use the support page.
Traffic is encrypted in transit. Database access is restricted per account so one member cannot read another's rows, and the writes that must not be tampered with — credits, family caps, moderation — are performed server-side only. No system is perfectly secure, and we would rather say that than imply otherwise.
If this policy changes in a way that affects what is collected or who sees it, the effective date above changes and the app will say so. Continuing to use the Service after that means the new policy applies.
See also the Terms of Service.