1. Introduction
TCGFlip ("we", "us", "our") operates the website tcgflip.app and the TCGFlip mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
2. Information We Collect
Account Information: When you create an account, we collect your email address and authentication credentials via our authentication provider (Clerk). If you sign in with Google, Discord, or other OAuth providers, we receive your name, email, and profile picture from those services.
Profile Information: You may optionally provide a username, display name, bio, favorite Pokemon, avatar, Discord username, and timezone.
Collection Data: Card details, purchase prices, grading submissions, sales records, pack openings, and other inventory data you enter into the Service.
Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, and timestamps.
Device Information: Browser type, operating system, device type, and IP address.
Push Notification Tokens: If you enable push notifications on the mobile app, we store your device push token to send notifications.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Process your transactions and manage your account
- Send you notifications about your account, grading submissions, price alerts, and other Service-related updates
- Display your public profile to other users (based on your privacy settings)
- Calculate portfolio values, profit/loss analytics, and grading ROI
- Respond to your comments, questions, and support requests
- Monitor and analyze usage trends to improve the Service
- Detect, prevent, and address fraud and abuse
4. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
- Public Profiles: If your profile is set to "public", your username, bio, favorite Pokemon, pinned cards, collection value, and card count are visible to other users. If set to "private" or "hidden", this information is restricted per your settings.
- Organization Members: If you join a business organization, other members of that organization can see your membership and role.
- Service Providers: We use third-party services including Clerk (authentication), Stripe (payments), Vercel (hosting), and Neon (database hosting). These providers only access data necessary to perform their services.
- Legal Requirements: We may disclose your information if required by law, court order, or governmental regulation.
5. Cookies and Analytics
We use cookies and similar technologies to operate and improve the Service:
- Essential Cookies: Required for authentication, session management, and core functionality.
- Analytics: We use analytics services to understand how visitors interact with the Service, including pages visited, time spent, traffic sources, and general usage patterns. This data is collected in aggregate and helps us improve the user experience. You can opt out of analytics tracking through your browser settings or by using browser extensions that block analytics scripts.
6. Third-Party Services
Our Service integrates with:
- Clerk: Authentication and user management. Clerk Privacy Policy
- Stripe: Payment processing for subscriptions. Stripe Privacy Policy
- PokemonPriceTracker API: Card pricing data. We send card identifiers to retrieve market prices.
- Expo: Push notification delivery for the mobile app.
- Apple: In-app purchase processing and subscription management for iOS users. Apple Privacy Policy
- Cloudflare R2: Secure image storage for organization logos and uploaded media.
- Profanity.dev: Content moderation. Text from posts, comments, and messages is sent to this service to detect inappropriate language. No personal identifiers are included — only the text content is transmitted.
7. Content Moderation
To maintain a safe and respectful community, we automatically screen user-generated content — including feed posts, comments, and direct messages — for inappropriate language using a third-party profanity detection service (Profanity.dev). Only the text content is sent for analysis; no personal information, usernames, or account details are transmitted. Content that is flagged as inappropriate will be rejected and will not be posted. We reserve the right to remove content or suspend accounts that repeatedly violate our community standards.
8. In-App Purchases and Subscriptions
TCGFlip offers subscription plans (Pro, Premium, Business) that can be purchased through:
- Stripe: For web-based subscriptions, payment is processed by Stripe. We store your Stripe customer ID but do not store credit card numbers or payment details directly.
- Apple In-App Purchase: For iOS app subscriptions, payment is processed entirely by Apple through the App Store. We do not receive or store your payment method details. Apple provides us with a transaction ID and subscription status to manage your access. Subscription management, renewals, and cancellations are handled through your Apple ID account settings. Apple's terms and privacy policy govern these transactions.
Regardless of payment method, your subscription tier and status are stored in our database to provide you with the appropriate level of service.
9. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes. Anonymized and aggregated data may be retained indefinitely.
10. Data Security
We implement appropriate technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), secure database hosting, and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Your Rights and Choices
- Access and Update: You can view and update your profile information at any time through your account settings.
- Privacy Controls: You can set your profile to public, private, or hidden.
- Notifications: You can manage notification preferences in your profile settings.
- Data Export: You can request an export of your data by contacting us.
- Account Deletion: You can request deletion of your account by contacting us at the email below.
- Push Notifications: You can disable push notifications through your device settings at any time.
12. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.