tcg-vault · legal

Privacy policy

Last updated September 2026

tcg-vault is a small, independent Pokémon TCG collection tracker run by one person, Carlos Cativo (“I”), from El Salvador. I am the controller of the data described here. This page explains what the app stores about you, why, and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR) as well as Salvadoran law, since anyone can visit the public galleries.

What I collect

Your account: name, username, email address, and your password (stored only as a one-way hash, never readable). Name, email and password are needed to have an account.
Your collection: the cards you add and everything you enter about them — variant, condition, grade, quantity, notes and photos. Location and other details your phone embeds in a photo (such as the device and when it was taken) are removed before the photo is stored; only its rotation and colour profile are kept.
Invites: the email address an invite was created for, and who created, accepted or revoked it. The invited address receives the invite by email, once when it is created and again only if staff resend it; nothing else is sent to it unless an account is created.
Feedback you send: your message, its type, your username and email, and the page you were on.
Cookies: a session cookie and a security (CSRF) cookie, plus — only if you tick “Remember me” — a login cookie that lasts up to about 400 days; and, only if the age check at signup fails, a cookie that blocks another attempt (see “Children”). All are strictly necessary for the app to work, so no consent is asked. Your light/dark theme choice is saved in your own browser only.
Error and debug records: see “Where your data lives” below.

There is no advertising, no analytics and no tracking across other sites. No automated decisions are made about you.

Why, and on what legal basis

To run your account and show your collection — performance of the service you signed up for.
To keep the app secure and fix errors — legitimate interest in a working, safe service.
To read and answer your feedback — legitimate interest, and your choice to send it.

Children

At signup you enter your birth month and year. It is only used to check your age at that moment and is not stored. If the check fails, a cookie means you can’t sign up from that browser for a year. You must be at least 13 to create an account, and have a parent’s or guardian’s permission if you’re under 18 (confirmed with a checkbox at signup). If I learn that an account belongs to someone younger than 13, or to a minor without that permission, I’ll delete it. A parent or guardian can ask me to at admin@cativo.dev.

Public and private

Every account with a username has a page at /your-username. Your collection starts private: the page then shows only your username and name, and no cards. If you switch it to public (on My Collection), anyone can see your cards, their values and your activity there. You can switch back to private at any time.

Card photos are stored at long, unguessable web addresses. They are only linked from your page while your collection is public, but anyone who already has a photo’s exact address could still open it.

Where your data lives, and who else touches it

Hosting: the app, its database and your photos run on a server rented from Hetzner Online GmbH in Nuremberg, Germany (EU).
Email: feedback and account emails (such as password resets and invitations) are sent through Resend, Inc., in the United States.
Error reports: when something breaks, a report goes to a self-hosted Bugsink instance on my own server infrastructure. It includes the request that failed, which can contain other things you typed.
Debug records: a short-lived log of failed requests and errors, which can include your IP address, account name and email, and the request details. It is deleted within 3 days. Passwords you type are masked before either record is kept.
Card data and artwork: card images load directly from tcgdex (assets.tcgdex.net) and, for the few cards tcgdex has no image for, from TCGplayer (tcgplayer-cdn.tcgplayer.com), so your browser contacts their servers and they see your IP address.

Where data goes to the United States (Resend), the transfer relies on the EU–US Data Privacy Framework or the provider’s Standard Contractual Clauses. I don’t sell or share your data with anyone else.

How long I keep it

Your account and collection: until you delete them.
A login session: up to a year unless you log out; the “Remember me” cookie up to about 400 days.
Debug records: deleted within 3 days. Error reports: kept only as long as needed to fix the problem.
Feedback emails: kept in my inbox for as long as needed to follow up.
An invite nobody accepted: deleted within 31 days of expiring or being revoked. An accepted invite is deleted with the account it created.
Password reset links: expire after an hour and are deleted within a day.
Emails the app sends (invites, password resets, feedback): the email provider keeps a copy for 30 days.
Backups: a copy of the database and your photos is taken every night and kept on the same server for 14 days, then deleted. It exists only to recover from a mistake or a failure, and is not used for anything else.
If staff suspend or delete an account: a record of that, holding the account’s internal number but not its name or email, kept for a year.

Your rights

You can, at any time:

Get a copy of your collection — “Export CSV” on My Collection downloads every card with all its details (photos are not included).
Correct your details on your Profile, and your cards on My Collection.
Delete your account from your Profile. This immediately and permanently removes your account, your whole collection with its notes and photos, and the invite you signed up with. Copies in short-lived debug records and error reports expire on the schedule above, and your data is gone from the nightly backups within 14 days. If a backup ever has to be restored in that time, I delete your account again.
Ask for access to what I hold about you, or for restriction or portability of it; object to how it’s used; or withdraw a choice such as making your collection public.
Complain to your local data protection authority.

I reply to requests within one month. If a breach puts your data at risk, I’ll tell you without undue delay.

Contact

Write to admin@cativo.dev, or use “Feedback” in the app’s top bar while logged in.

Changes

If this policy changes in a way that matters, I’ll update the date above and email members.