What we collect without an account
Two analytics tools run on this site: Google Analytics and Yandex Metrica. They record the usual things — which page you opened, where you came from, roughly where in the world you are, what browser you use, and how long you stayed. They set cookies in your browser to tell one visit from the next.
We use this to see which pages are worth writing more of and which are broken. We do not build profiles, do not run ads and do not sell any of it.
Session replay — the feature that records your mouse and typing as a video — is deliberately switched off. We did not want to collect it, so we do not.
Both tools wait for your first interaction — a scroll, a tap, a key. If you touch nothing, they still start a few seconds after the page finishes loading: a visit nobody counted teaches us nothing. With JavaScript switched off, Yandex Metrica records the page view through a one-pixel image instead.
When you press a “buy” button
Buy buttons go through our own address first, so we can count how many people reach a store. That row holds the card, the store, its price at that moment, the page you came from and whether the request looked like a robot. Your IP address is not among it: what we store is a one-way hash of it, salted with a secret only this server has. It lets us tell two visitors apart on the same day. Nobody who copies the database can read an address out of it, because the salt is not in there; we could in principle work backwards with the salt in hand, and we do not — but you deserve the honest version of that sentence rather than a promise no hash can keep.
These rows are kept for 90 days and then deleted automatically. Long enough to see whether a season or a price level changes how people click, short enough that nothing accumulates without a reason.
eBay then sees the click on their side, as they would for any link, and matches it to a purchase if one happens. That part follows their privacy notice, not ours. We never learn what you bought or what you paid.
What we collect if you sign in
An account is optional and exists for two things: keeping a collection across devices and sending price alerts. If you create one, we store:
- your email address — it is the only way to sign you in and the only way to send an alert;
- a display name, if you set one;
- the cards you added to your collection and the alerts you set up;
- the time and IP address of your last sign-in — for security, so a stolen session is noticeable.
There is no password, so there is no password to leak. Signing in works by a one-time link sent to your email; the link is single-use and expires in twenty minutes. What we keep in the database is not the link itself but a one-way fingerprint of it, and the same is true for your session key.
The collection calculator
Without an account the collection lives entirely in your browser. It is never sent to us — not for calculation, not for storage. The share link encodes the card list in the address itself, which is why such links can get long. If you do sign in and press “Save to account”, the list is copied to our database and stays there until you clear it.
Cookies
| Cookie | Who sets it | What for |
|---|---|---|
tcg_s | us | keeps you signed in; set only after you sign in |
tcg_c | us | protects forms from being submitted by another site |
tcg_g | us | ties a “sign in with Google” attempt to the browser that started it; lives minutes, deleted on return |
theme | us (local storage) | remembers light or dark theme |
_ga, _ga_* | Google Analytics | tells one visit from the next |
_ym_* | Yandex Metrica | the same; session replay is switched off |
Ours are strictly functional: without tcg_s you cannot stay signed in, without
tcg_c forms would be open to abuse from other sites. The analytics ones you can refuse —
see below.
How to opt out
- Analytics. Any content blocker stops both tools. Google also publishes an opt-out add-on, and Yandex has its own. The site works exactly the same with them blocked.
- Click counting. There is no switch for it, because there is nothing to switch off: nothing that identifies you is stored. If you would rather we did not count the visit at all, copy the store link from the button instead of pressing it.
- Everything else. Do not sign in. Nothing on the price side of the site requires it.
Deleting your data
Write to [email protected] from the address you signed up with and we delete the account, the collection and the alerts. No forms, no retention period, no “we will keep a copy for legitimate interests”.
Who else sees your data
Nobody we chose. The analytics providers named above receive what their scripts collect. eBay, TCGplayer or Cardmarket receive the click when you press a button that leads to them, and only then — each sees its own click and nothing else. Our server is in Finland, rented from a German company; Cloudflare sits in front of it and sees request metadata as any CDN does. Both countries are in the EU, so your data does not leave it. We do not transfer data to anyone else, and there is nothing to sell even if we wanted to.
Children
The site is not aimed at children under 13 and we do not knowingly keep data from them. If you believe we have, write and it will be deleted.
Changes
If this policy changes in a way that matters, the date at the top changes with it. We do not back-date edits.