Privacy Policy

Last updated: October 2, 2026

What we collect

Browsing TCG Strat does not require an account and does not require you to give us your name, email address, or payment information. We use Vercel Web Analytics, Vercel Speed Insights, Umami, Microsoft Clarity, and Google Analytics to understand aggregate traffic, performance, and how visitors use the site. These collect anonymized or pseudonymized usage data (pages visited, referrer, device type, country, and, via Umami and Clarity, aggregated click/scroll behavior, heatmaps, and session recordings). Vercel Analytics, Umami, and Clarity do not set cookies. Google Analytics sets a first-party cookie to distinguish returning visits; we do not enable Google Signals, advertising features, or cross-site ad personalization. Session recordings and heatmaps are used only to understand on-site usability and are not sold or shared for advertising targeting.

Interaction events

Alongside page views, we record which site features are used: searches run (including the search terms), cards added to a buy list, filters and chart ranges changed, links to retailers followed, share buttons used, and how far down an article a page is read. These events are tied to an anonymous session, not to an identified person, and we do not use them to build advertising profiles.

Accounts and collections

If you create an account, we store your email address, display name, account identifier, and the collection, deck, and price-alert data you choose to save. Where password sign-in is available, passwords are stored as one-way hashes rather than readable text. Collection profiles are private by default. They become publicly visible only if you explicitly publish one, and appear in the public directory only if you additionally opt in to discovery; you control separately whether your total market value and exact serial or certification numbers are shown. You can unpublish at any time. Account and collection data is never sold, and we do not use it for advertising.

We deliberately do not run analytics or session recording on the account page, so your email address and password are never captured by any analytics tool. The collection area is covered by the same analytics described above.

Google, Apple, and passwordless sign-in

When these sign-in options are available, we use WorkOS to authenticate accounts through Google, Apple, or a one-time code sent to your email address. Google or Apple may provide your email address, name, profile image, and provider account identifier. Apple may provide a private relay address when you choose Hide My Email. We use this information to identify your account, sign you in, and associate the data you save with your account. Email-code sign-in does not require a password.

We request basic identity information for sign-in, not access to your Gmail messages, contacts, Google Drive files, or Apple account content. We do not sell sign-in data or use it for advertising. WorkOS processes authentication information on our behalf, and Google and Apple process sign-in requests under their own privacy policies. Authentication services may also process request and device information to help detect abuse and secure your account.

Account data, retention, and deletion

We use account data to provide the features you request and retain it while your account is active. To request access, correction, or deletion of your account and saved data, contact admin@tcgstrat.com from the email address associated with your account. We verify ownership before handling account requests. Removing TCG Strat's access in your Google or Apple settings does not itself delete the data saved with TCG Strat; contact us to request deletion.

What we store in your browser

Essential session cookies keep you signed in and help protect account actions against unauthorized requests. Temporary authentication cookies support sign-in and verification. Site features such as the buy list, and a collection started before you sign in, may store data in your browser's local storage. That data stays on your device unless you create an account, at which point a list or collection you built while signed out is transferred to that account so it is available across your devices.

Third parties

Fonts are self-hosted. Price data and card images are loaded from our own services and from content delivery networks (Cloudflare, wsrv.nl). Outbound links to retailers such as TCGplayer or Scryfall are governed by those sites' own privacy policies.

Contact

Questions about this policy or your account data can be sent to admin@tcgstrat.com.