Privacy policy | tcgpricing

1Who is responsible#controller

TCG Buy and Sell Inh. Robles Gasser, Höheweg 10, 2553 Safnern, Switzerland, privacy@tcgpricing.dev ("we").

This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, the legal bases named below apply as well.

2What tcgpricing is#what

tcgpricing is a server-side interface (API) for trading card catalogue and price data. It has no user accounts and no signup. Only client applications holding an API key can use it, and they reach it from their servers. People use a client application, not tcgpricing.

Each client application has its own operator and its own privacy policy. That policy says who is responsible for the application, what it does with its users' data, and refers to this page for the part handled by tcgpricing.

3Our role#role

For the technical data described in section 4 (network addresses, logs, counters), which we process to run and protect the API, and for visits to this website (section 5), we are the controller.
Where the operator of a client application has agreed a data processing agreement with us, we process the data covered by that agreement on its behalf, as its processor. That operator is then the controller, its privacy policy applies, and requests about that data are best sent to it. We pass on requests that reach us.

4What client applications send, and what we keep#shared-processing

This section is the reference for the privacy policies of client applications.

When a client application looks up a card or a price, its server sends tcgpricing only what the lookup needs:

search text, card and product numbers;
for card scanning: the text read from the card's front, the set code and number, and a short numeric fingerprint of the picture (a 64-bit hash). Scan images are not sent to tcgpricing and are not stored by it.

Client applications must not send names, e-mail addresses, account ids or collection contents of their users, and tcgpricing has no field for them. tcgpricing cannot tell which user a request belongs to. Data from different client applications is not combined, and nothing in tcgpricing links the users of one client application to those of another.

Technical data

Data	Purpose	Kept for
IP address of the caller. This is normally the client application's server. Where a client application still sends a lookup from the user's browser, that user's IP address reaches us.	Delivering the response, rate limiting, blocking repeated failed key attempts, detecting leaked keys	In memory for up to one minute; in shortened form (network prefix: first three blocks of an IPv4 address, /64 of an IPv6 address) per API key for 30 days after the last request from that network
API key id, time of last use, request counts per minute	Authentication, rate limits	Counters 1 day; key records for as long as the key exists
Technical log lines (time, method, path, status, key id). When a call to the monitoring endpoint is refused, the line also holds the caller's network (first three blocks of an IPv4 address, /64 of an IPv6 address). Our own log lines never contain a full IP address.	Operation, troubleshooting, security	7 days in our API hosting provider's log store
Operating metrics (requests per route, status code, key, duration)	Monitoring, alerts	As long as needed for monitoring; they contain no IP addresses, search text or identifiers of persons

Our API hosting provider and its network provider (section 7) keep their own access logs of requests, which include the full IP address of the caller, for the period their own policies set.

Legal basis under the GDPR, where it applies: Art. 6(1)(f) (our legitimate interest in running the service securely and reliably).

We do not use this data for profiling or advertising, and we do not sell it.

5Visiting this website#website

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, on its worldwide network.

When you open a page, Vercel processes on our behalf:

your IP address,
date and time of the request,
the page or file requested, the referring page if your browser sends it,
browser type and operating system (user agent),
the status of the response and the data centre that answered.

We need this to deliver the site and to keep it stable and secure (GDPR Art. 6(1)(f)). The access logs are kept by Vercel for up to 3 days and then deleted. We do not combine them with other data and do not try to identify visitors.

Because Vercel is a US company and serves pages from data centres around the world, this data can be processed in the USA and in other countries. See section 8.

The website sets no cookies and stores nothing on your device. It uses no analytics, no tracking, no advertising and no social media plug-ins, and it loads no fonts, scripts or images from third parties. The one request your browser sends anywhere else is the status page's health check, described next.

Status page. The status page (tcgpricing.dev/status) is part of this website, so the above applies to it as well. To show whether the service is available, your browser asks our API for its health check directly. That request needs no key and carries no data about you other than what every web request carries: your IP address and browser type reach our API hosting provider and its network provider (section 7) and appear in their access logs for the period their own policies set. We keep no record of it ourselves beyond the anonymous request counts in section 4, and it is not counted against any API key. The status page asks for this check without cookies, so no cookie is stored.

E-mail. If you write to us, we process your message and address to answer you, and keep the correspondence for 2 years.

6Where the catalogue and price data come from#third-party-data

The catalogue and price data come from the sources listed under Data sources. They describe products, not persons.

7Recipients and service providers#recipients

We do not pass personal data on to third parties for their own purposes, and we do not send personal data to client applications. These providers process data on our behalf. Where we act as a processor for a client application, the providers marked "API" are our sub-processors.

Provider	Used for	Data	Where
Supabase Inc., USA	API: database and runtime	Everything in section 4; health check requests from the status page (section 5)	Database in the EU (Ireland); runtime on Supabase's network
Cloudflare, Inc., USA	API: network and protection in front of the API (used by Supabase)	IP address, request metadata	Worldwide network
Grafana Labs	API: monitoring, alerts, uptime checks	Operating metrics without personal data	Switzerland (Zurich)
GitHub, Inc. (Microsoft), USA	API: runs the scheduled data imports and tests	No data about users of client applications	USA
Vercel Inc., USA	Website: hosting of tcgpricing.dev, including the status page	Access logs of website visitors (section 5)	USA and worldwide network
Proton AG, Geneva, Switzerland (Proton Mail)	E-mail: handling e-mail to privacy@tcgpricing.dev	Correspondence (section 5)	Switzerland; no transfer abroad

Alert messages to our operations team are sent through Telegram and contain no personal data.

8Transfers abroad#transfers

API data (section 4) is stored in the EU and in Switzerland. Website access logs (section 5) are processed by Vercel in the USA and on its worldwide network.

Several of our providers are US companies. The USA does not have a general level of data protection equal to that of Switzerland or the EU. For these providers we rely on:

their certification under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework, which Switzerland and the EU recognise as providing adequate protection for certified companies; and
in addition, or where a provider is not certified, the standard contractual clauses of the European Commission in the provider's data processing agreement, with the adjustments for Switzerland.

Where a worldwide network delivers a page from a data centre in another country, the same safeguards apply. You can ask us for a copy of the safeguards at privacy@tcgpricing.dev.

9Your rights#rights

You can ask us whether we process data about you and request access, correction, deletion, restriction or a copy, and you can object to processing based on legitimate interests. Write to privacy@tcgpricing.dev. tcgpricing has no accounts and keeps only shortened network addresses and short-lived access logs, so we often cannot identify a person from what we hold. For the data in your account with a client application, use the contact given in that application's privacy policy.

You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), in the EU the authority at your place of residence.

10Security#security

API keys are stored only as hashes. Each client application has its own key. Only the API reaches the database, with restricted roles. Network addresses are shortened before they are stored or logged.

11Changes#changes

We update this policy when the service changes. The date at the top shows the current version. Changes to the list in section 7 are published here.