Privacy Policy

Overview

tcgpile (www.tcgpile.com) is a Magic: The Gathering collection manager. This policy explains what data we collect, how we use it, and your rights regarding that data. It covers both the web platform and the TCGPile Companion browser extension.

Account data

When you create an account, we store:

• Email address — used for authentication, password resets, and transactional emails (trial reminders, friend requests, lending notifications).
• Password — hashed and managed by Supabase Auth. We never store or have access to your plaintext password.
• Username and display name — optional, used for public profiles and the community directory.
• Profile info — optional bio and location, visible in the community directory based on your visibility setting.

Collection data

Your card collection, buy list, sell list, decks, want list, order sheets, set trackers, and lending records are stored in our database. This data is tied to your account and protected by row-level security — only you can access your own data unless you explicitly share it via public links.

Card metadata (names, images, prices) comes from Scryfall, a public MTG card database. We sync this data periodically. No personal information is sent to Scryfall.

Sharing and visibility

Your data is private by default. You control what's visible to others:

• Public links — trade binder, buy list, decks, and order sheets can be shared via unique URLs. Only the data you choose to share is visible.
• Community directory — your profile appears in the community based on your visibility setting (everyone, friends of friends, or nobody).
• Friends — accepted friends can see your collection and request card loans. You can remove friends at any time.

Payments

Pro subscriptions are processed by Stripe. We store your Stripe customer ID and subscription ID to manage your plan. We do not store credit card numbers, billing addresses, or any payment card details — those are handled entirely by Stripe.

Emails

We send emails via Resend for two purposes:

• Transactional — friend requests, lending notifications, trial reminders, and welcome messages. These are triggered by actions you or your friends take.
• Newsletters — occasional product updates and feature announcements. You can unsubscribe from newsletters at any time via the link at the bottom of each email.

Cookies

We use a strictly necessary authentication cookie managed by Supabase to keep you signed in. This is essential to provide the service and does not require consent.

We also use non-essential analytics cookies (see "Analytics" below), which run only with your consent. Visitors are asked via a cookie banner; signed-in users consent as part of accepting our Terms at sign-up. You can withdraw consent at any time by declining the banner, clearing the consent choice in your browser, or emailing us. We do not use advertising cookies or tracking pixels.

Analytics and tracking

We use Vercel Analytics to collect anonymous, aggregated traffic data (page views, visit duration, device type). This is cookieless and cannot identify individual users.

With your consent, we also use PostHog (hosted in the EU) for product analytics — which features are used and how people navigate the app — including page views, in-app events, and session replays. Session replays mask all text input so we do not capture what you type (passwords, card notes, messages). For signed-in users this data is linked to your account identifier so we can improve the experience; for visitors it is not linked to an identity.

Analytics traffic is routed through our own domain (a reverse proxy) and is hosted in the EU. The legal basis is your consent, which you can withdraw at any time. We do not use Google Analytics, advertising trackers, build profiles for advertising, or sell your data to third parties.

Browser extension (TCGPile Companion)

The TCGPile Companion browser extension enhances third-party MTG websites with your collection data. Here's how it handles your information:

Data storage

• Settings and filter presets are stored in your browser via chrome.storage.sync and synced across your Chrome devices through your Google account. The extension developer has no access to this data.
• Collection cache is stored locally via chrome.storage.local and refreshed every 15 minutes. This allows instant badge rendering without network requests.

Authentication

No passwords are stored in the extension. When you visit tcgpile.com while logged in, the extension reads your existing session token from the site's cookies. This token is used to authenticate API requests. You can disconnect your account at any time from the extension popup.

Permissions

• Storage — persist settings, filters, and cached collection data.
• Tabs — reload affected tabs when settings change and apply Cardmarket filters. The extension does not read or log tab URLs beyond what is needed for these actions.
• Alarms — schedule periodic collection sync in the background.
• Host permissions (tcgpile.com, cardmarket.com, tcgplayer.com, mtgstocks.com, mtgdecks.net, mtggoldfish.com, tcdecks.net) — inject content scripts that add ownership badges, import buttons, and Reserved List markers.

Third-party services

The extension loads country flag images from flagcdn.com in the Cardmarket filter panel. No user data is sent to this service. The extension contains no analytics, telemetry, tracking pixels, or advertising scripts.

Data deletion

You can delete your account from Settings. This permanently removes all your data: collection, decks, trade binder, buy list, friends, follows, sessions, and user settings. This action cannot be undone.

To disconnect the browser extension without deleting your account, click "Disconnect" in the extension popup. This clears all locally cached data and stored tokens.

Data location

The platform is hosted on Vercel and the database on Supabase (PostgreSQL). Both services process data in compliance with GDPR.

Changes to this policy

If this policy is updated, the changes will be reflected on this page with an updated date. We do not notify users of minor policy changes. For significant changes affecting your data rights, we will notify registered users via email.

Contact

For questions about this privacy policy, contact us at hey@tcgpile.com or through the contact form.