Privacy

Effective 16 October 2026.

Your collector data

Binder entries, purchase costs, notes, wishlist, watchlist, followed sellers, saved searches, recent cards and preferences are stored in this browser’s IndexedDB. Search history is stored in localStorage. When you sign in to a cloud account, collector data (including purchase costs and notes) is also stored in Supabase and associated with your wallet address. Guest data is uploaded only when you choose to merge it into your account. Exported backups contain your private data; keep them secure.

Seller Studio

Seller profiles, contact email, shipping and return policies, inventory descriptions and uploaded photos are stored privately in Supabase under your signed-in wallet account. Drafts are not published for purchase. Export your seller data in Seller Studio; deleting your cloud account also deletes these profiles and drafts.

Purchasing Desk

Purchase requests store your wallet address, contact email, shipping address, item URL, notes, quotes and fulfillment records in Supabase. Only your wallet account and the configured purchasing operator can access them through the app. The operator may share necessary delivery details with the merchant and carrier to fulfill your request. On-chain payments and order-reference memos are public. Export your records from Purchasing Desk. Account deletion is blocked for quoted or paid purchases until operator reconciliation; refunded, canceled, rejected and unquoted requests can be removed with account deletion.

Hosted merchant browser

Full Grip Games guest checkout uses a separate temporary browser on Vercel. Checkout screens and typed information pass through PHYSICALTCG’s server and the isolated browser to the merchant and its payment services. Application code does not log or store screenshots, card details or typed fields. The browser is destroyed when closed or after 15 minutes; customer sessions are never snapshotted. A private HttpOnly cookie controls access. Infrastructure metadata and hashed rate-limit identifiers may be retained. Keep your receipt: merchant checkout does not create a cloud purchase record.

Requests and hosting

Searches and page requests are processed through Vercel hosting and may appear in ordinary infrastructure logs with request metadata such as IP address. The server queries CardFlow and TCGdex. Remote catalog images connect your browser to the image provider, which can receive your IP address and request metadata. External marketplace links open third-party services with their own privacy policies.

Wallets and notifications

Wallet addresses are read after you connect. Your wallet may contact its RPC provider for network and balance requests. Cloud sign-in messages are verified by the server. Single-use challenges expire after five minutes; an HttpOnly session cookie expires after seven days. Push subscription endpoints and encryption keys are stored only after you enable background notifications. Your browser’s push service delivers alerts. Background alert records and public asking-price observations are retained for 90 days.

Control and deletion

Remove individual entries in the collector tools, or clear this site’s browser storage to delete all local data. Use “Delete cloud account data” on Profile to delete the cloud collection, subscriptions, alerts and sessions. Export first if you want a backup. Disconnecting a wallet does not delete your binder, and clearing browser data cannot be reversed without a backup.

Tracking

This release does not install advertising cookies or third-party analytics. Infrastructure providers and external merchants have their own policies.