Privacy policy

1. Controller

Responsible for data processing in the TCGollector app:

Muhammed Cam
Linsentalstrasse 5
8482 Sennhof
Switzerland
Email: info@tcgollector.com

For all privacy questions and to exercise your rights, simply send an email to the address above.

2. Account and sign-in

You sign in with your Google account. Google provides us with your email address, name and profile picture. Name and email are not visible to other users; only your chosen @username is public. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3. Hosting and database

All app data is stored with Supabase (Supabase Inc., USA) in a data centre in Zurich (Switzerland). Switzerland is covered by an EU adequacy decision. A data processing agreement with Supabase is in place. We only use US-based services that are certified under the Swiss-US or EU-US Data Privacy Framework or covered by standard contractual clauses.

4. Collection, decks, wishlist, boosters

We store the cards you add (printing, condition, language, quantity), your decks, wishlist, booster openings, price alerts and achievements. Your collection, wishlist, collection value and price alerts stay private. Decks you share, your badges and – in trading – cards you mark for trade are public. To find matching traders, we compare the wishlists of active traders with offered cards.

5. Camera and scanner

The scanner uses the camera on your device only: card code and image are recognised locally (Google ML Kit, without transfer to Google). For confirmed scans we store an anonymous colour fingerprint (a few numbers, no image) to improve recognition for all users. Card photos to improve recognition: for confirmed scans the app uploads some photos of the straightened card area (only the card, nothing around it, no location or device data; at most five photos from different users per card). The photos are not public and are not shown to anyone; we use them solely to improve printing recognition, including training our own recognition model. You can turn this off anytime in the scan properties (“Share scans to improve recognition”); “Undo” removes the photo of that scan, and deleting your account removes all your photos.

6. Community and trading

Posts, photos, videos, comments, likes and followers are visible to all signed-in users. Uploaded photos and videos can also be accessed via their web address. Trade requests and trade chats are only visible to the two participants. We may review and remove reported content. Blocked users no longer see your content.

7. Push notifications

If you allow notifications, we store a device token and your app language. Delivery uses the Expo Push Service (650 Industries, USA) and Firebase Cloud Messaging (Google, USA); both are certified under the EU-US Data Privacy Framework. You can turn notifications off anytime in your profile.

8. Premium and payments

Purchases are processed by Google Play. We use RevenueCat (RevenueCat Inc., USA, EU-US Data Privacy Framework) to manage subscriptions; your user ID, receipts and subscription status are processed. We do not receive payment details. Legal basis: performance of a contract.

9. Card data and images

Card images are loaded from TCGplayer servers (USA); your IP address is transmitted to TCGplayer. Prices come from Cardmarket and TCGplayer, are updated daily and are provided without guarantee.

10. No ads, no tracking

TCGollector shows no ads and uses no analytics or tracking services.

11. Retention and deletion

We store your data as long as your account exists. Under Profile → “Delete account” you can delete your account at any time; all your data (collection, decks, posts, media, trades, badges, device tokens) is removed permanently. You also need to cancel an active subscription in Google Play.

12. Your rights

The Swiss Federal Act on Data Protection (FADP) applies and – for users in the EU – the GDPR. You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 25 ff. FADP, Art. 15–21 GDPR). You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or the data protection authority of your country of residence.

Last updated

2026-10-17