Privacy Policy

Who we are

TCGSentry is operated by Treasure Cruise Trading BV, a company in Belgium (enterprise number BE 0801.179.814), Bijlokstraat 194, 3020 Herent. We are the data controller for your data. We also operate DeckBrokr (deckbrokr.com), and this policy covers it too. Questions or requests: privacy@tcgsentry.com.

What we collect

We only collect what we need to run the service:

• Account. Your email and a securely hashed password, or your name, email, and profile picture if you use Sign in with Google.
• Your collection. The cards you add, their quantity and condition, what you paid, and the sales you record. This is private to your account.
• Alerts and preferences. Your price targets and notification settings.
• Contact channels. Your email address and, if you connect it, your Telegram chat, used only to send the alerts you ask for.
• Product emails. Whether you want them, which ones we sent you, and which links you followed. We do not use tracking pixels, so we cannot tell whether you opened one.
• Technical. Your IP address (used briefly for security and not stored), a random identifier we store in your browser to run DeckBrokr, a random reference code that travels with our links to the stores we work with, and, only if you consent, basic usage analytics.

Why we use it

• To run your account, store your collection, and deliver alerts (to perform our contract with you).
• To keep the service secure and prevent abuse (our legitimate interest).
• To email you about your own collection, with a one-click unsubscribe in every message (our legitimate interest).
• For product analytics, only if you consent.
• To meet legal obligations.

Cookies, analytics and email

We use one essential cookie to keep you signed in; it does not need consent. With your consent, we use PostHog (hosted in the EU) to understand how the app is used. Analytics do not run until you accept them, and you can change your choice any time from Cookie preferences. We honour Global Privacy Control signals. We do not use advertising cookies. On DeckBrokr, with your consent, PostHog may also track your session to help us improve the tool.

Product emails. We may send you scheduled emails built from your own collection, such as a summary of cards worth selling. Turn them off any time in Settings under Notifications, or use the unsubscribe link in any one of them. Either works straight away and needs no reply from us. Account email carries on either way: address verification, password resets, and the price alerts you set up yourself. Links in these emails carry a one-time code so we can see which emails bring people back. That stays on our own servers and goes to nobody else, and the unsubscribe link is not counted.

Who we share it with

We do not sell or share your personal information for advertising. We use a few service providers who process data on our behalf under contract:

• Cloud infrastructure providers for hosting, where all app data is stored. Our servers are currently located in Canada.
• PostHog (EU) for product analytics, only if you consent.
• Resend (United States) for sending your account, alert and product emails, and for telling us when an address bounces or reports us as spam.
• Google (United States) for Sign in with Google.
• Telegram for delivering the alerts you opt into.

Store links. We take part in the affiliate programs of the stores we link to, and some outbound links are affiliate links we may earn a commission from. When you follow one you leave our service. We pass along a random reference code so the store, or the affiliate network it uses, can credit the referral to us — nothing that identifies you by name, email, or account. We never access your account there. The store’s own privacy policy governs their site.

International transfers

Our servers are currently located in Canada, which the European Commission recognises as providing an adequate level of data protection. Where a provider above is in the United States, or where we otherwise host data outside the EEA, we rely on an approved transfer mechanism such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

How long we keep it

We keep your data while your account is active. If you ask us to delete your account, we erase your personal data within 30 days, except where the law requires us to keep certain records.

If you unsubscribe, or your address bounces or reports us as spam, we keep that address and the reason for as long as we send email at all. That record is what stops us emailing you again, so deleting it would defeat the point. Which emails we sent you is deleted with your account.

Your rights

You can access, correct, delete, export, restrict, or object to the use of your data, and withdraw consent at any time. US residents can also opt out of any sale or sharing (we do none). To exercise a right, email privacy@tcgsentry.com; we respond within 30 days. You can stop product emails yourself, without asking us, from Settings under Notifications or the unsubscribe link in any email. If you are in the EEA, you may also complain to the Belgian Data Protection Authority (contact@apd-gba.be).

Security

We hash passwords with Argon2, encrypt data in transit, isolate each account's data, and limit access. No system is perfectly secure, but we take reasonable measures for the data we hold.

Children

TCGSentry is not intended for anyone under 16, and we do not knowingly collect their data. Contact us if you believe a child has given us data.

Changes

We may update this policy. If a change is material, we will update the date above and, where appropriate, let you know in the app or by email.

Contact

Treasure Cruise Trading BV, Bijlokstraat 194, 3020 Herent, Belgium · privacy@tcgsentry.com