Privacy Policy
Last updated September 5, 2026
What TrackYourTCG stores
We store your stable Google account identifier, verified email address and display name supplied through Google sign-in; collection records you create; profile and sharing settings; accepted or pending friend relationships; price history; provider-usage counters; and operational events needed to secure and maintain the service. Google authentication happens on Google’s pages; we never see your Google password. You can also use the app without signing in: an anonymous guest collection is tied only to a session cookie in your browser, and signing in later moves it onto your account.
Cookies and local storage
TrackYourTCG sets three first-party cookies and no third-party cookies: a sign-in session cookie (30 days), an anonymous guest session cookie (one year) if you start without signing in, and a short-lived cookie (10 minutes) that protects the Google sign-in hand-off. All are HttpOnly, Secure, and limited to this site. The browser’s local storage holds display preferences and whether you have seen the product tour. We do not use analytics or advertising trackers.
Card scanning
Card photos are processed in your browser for optical character recognition. TrackYourTCG does not upload or retain the photo. The recognition engine and its language data are downloaded on first use from a public CDN (jsDelivr), which sees your IP address like any other download. Extracted card-name and number text is sent to our catalog search so the app can show likely matches.
Friends and portfolio sharing
Your collection is private by default. A collector can see the card-only portfolio you share only after both accounts become accepted friends and while portfolio visibility remains set to Friends. Purchase costs, notes, certification numbers, email addresses, and owner credentials are never included in a friend portfolio.
If you opt in to the weekly digest and provide an address, that address and the digest content are sent through Resend, our email delivery provider. Every digest carries a one-click unsubscribe, and turning the digest off in settings stops all sending. Nothing is sent unless you opt in.
Service providers
We use Cloudflare infrastructure for application delivery and database storage. Card searches and price checks may contact TCGCSV, TCGdex, OPTCG API, Scryfall, YGOPRODeck, and JustTCG, and card images may be loaded from those providers or from TCGplayer’s image servers. PSA is contacted only to verify a certificate number you enter, never for pricing. Links out to TCGplayer, eBay, PSA, and PriceCharting open those sites directly and are not affiliate links.
Your data, your copy
You can export your products and cards, and your tax summary, as CSV files from Settings at any time. The export is built in your browser from the records the app already shows you.
Retention and deletion
Live account data remains until you delete it. Operational events are retained for up to 90 days. Anonymous guest sessions that were never used to store anything are removed after a period of inactivity; a guest collection that holds records is kept. To delete your account, open Profile, then Settings, scroll to Delete account, and enter “DELETE MY ACCOUNT”. This deletes your live account, friendships, collection, settings, and stored price history, and signing in later creates a new empty account. See the account-deletion page.
Security and contact
Requests are authenticated, tenant-filtered, and rate-limited. No internet service can guarantee absolute security. During the beta, for privacy and deletion questions, contact the site owner through the same channel that provided your access.