Privacy Policy

TCGBerg ("we", "us", "our") operates the TCGBerg website and is the controller responsible for the personal data described here. This policy explains what personal data we collect, why, and your rights. Browsing the market data requires no account and no login. You can reach us through our contact page, or email our data-protection contact at privacy@tcgberg.com.

• Account information, only if you sign up: your name, email address, and authentication identifiers, managed for us by Clerk.
• Content you create: the cards on your watchlist, the holdings you add to your portfolio, and any price-alert rules you set.
• Onboarding answers, if you choose to give them: right after you sign up we ask three optional questions, what kind of collector you are, the rough value band of your collection, and what you are here to do. You answer by picking from fixed options, you can skip every one, and we store what you pick on your account. We never ask what you own or what any single item is worth, and the value band is your own rough estimate, not anything we verify.
• Messages: what you send through the contact form or newsletter sign-up (name, email, and your message), delivered for us by Resend.
• Usage data: cookieless product analytics via PostHog (EU region), such as pages viewed, searches, and interactions, plus standard technical data like browser type and an approximate location derived from your IP address. If you are signed in, we tag those events with your account identifier and nothing else about you: no name, no email address. That lets us see how a signed-in session really uses the product instead of guessing from anonymous traffic.
• Security data: your IP address, processed transiently by Cloudflare Turnstile (to prevent form abuse) and Upstash (rate limiting).
• Business contact details, if you get in touch about commercial, partnership, or creator arrangements: the name and email address you give us, and our own internal notes on the conversation.

We use this data to provide and secure the Service, to power the optional watchlist and portfolio features, to send you the price alerts you set up, to respond to your messages, to send the newsletter you asked for, and to understand and improve how the Service is used. We also produce aggregated, de-identified market insights and analytics from usage patterns, including which cards are most watched, held in portfolios, and searched for, and we may show these in the product, share them, or sell them to third parties. These aggregated insights are derived so that they do not identify you and are not personal data. To be clear about the distinction: we never sell your personal data and we do not use it for third-party advertising; the aggregated, de-identified insights just described are a separate, non-identifying dataset that we may commercialise. If you have an account, we also use your own activity, such as your watchlist, portfolio, and searches, together with any onboarding answers you gave, to personalise what you see in the product and in the emails we send you, and to decide what to build next. We do not use your onboarding answers to set the price you pay, and we do not share them outside the providers listed below.

Where the GDPR or UK GDPR applies, we rely on: your consent (the newsletter, which you can withdraw at any time, and the optional onboarding answers, which you can ask us to delete); performance of a contract (providing your account features); and our legitimate interests in running, securing, improving, and personalising the Service, and in producing aggregated, de-identified market insights (analytics and abuse prevention).

Our product analytics is cookieless: PostHog keeps no cookies and no local storage. The only cookies we set are the strictly necessary authentication cookies placed by Clerk while you are signed in, and we do not use advertising or cross-site tracking cookies.

We do use your browser's local storage for a few small things that stay on your device: your light or dark theme choice, an action you began before signing in (such as adding a card to your watchlist) so we can finish it afterwards, and, if you arrived through a creator's referral link, that creator's referral code so the creator can be credited if you go on to create an account. The referral code expires on its own after 30 days. None of these entries are used to build a profile of you or to follow you across other sites.

We share personal data only with the service providers that help us run TCGBerg, each acting on our behalf under their own privacy terms:

• Clerk (account sign-in and sessions)
• Resend (contact-form and newsletter email)
• PostHog (EU) (cookieless product analytics)
• Cloudflare (anti-abuse (Turnstile) and storage)
• Upstash (rate limiting)
• Vercel (website hosting)
• Railway (backend and API hosting)
• Supabase (application database)

We are based in Switzerland, and several of our providers are based in the United States, so your data may be transferred outside your home country. Where personal data is transferred from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, principally the European Commission Standard Contractual Clauses (with the UK Addendum and Swiss amendments where they apply).

We keep personal data only as long as it is needed for the purposes above:

• Account, watchlist, portfolio, alert, and onboarding data: while your account is active. When you delete your account we delete this straight away. There is no recovery window and we cannot restore it, so export anything you want to keep before you delete.
• Contact and support messages: up to 24 months after we close your request.
• Newsletter subscription, with the consent and opt-out records that prove it: until you unsubscribe, plus a short retention tail so we can honour and evidence your choice.
• Business and partnership records, including the contact details above: while the arrangement is live, and afterwards for as long as accounting and contract rules require.
• Security and abuse-prevention logs: a short period, typically days to a few weeks, unless a specific investigation requires longer.
• Referral and commission records, where you signed up through a creator link: we keep the commission entry for as long as accounting rules require and so we can evidence what we paid our partners. If you delete your account we remove your identifiers from those entries, leaving an anonymous financial record that no longer identifies you.

Aggregated, de-identified insights are not tied to your account and may be kept indefinitely, since they no longer identify you.

Depending on where you live, you may have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent for anything based on it (with effect going forward). To exercise any of these, email us at privacy@tcgberg.com or use our contact page; we may ask for enough information to verify your identity before we act. You can also unsubscribe from the newsletter at any time using the link in any issue. EU/UK users may complain to their local data-protection authority, and users in Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC). If you are a California resident, you may also have the right to know, delete, correct, and opt out of the sale or sharing of personal information; as noted above, we do not sell or share your personal data.

When we show market listings, we never display the identity of the seller: eBay seller usernames are pseudonymised before we store anything, so no seller identity is exposed on TCGBerg.

TCGBerg is not directed to children. Creating an account or subscribing to the newsletter requires you to be at least 16, unless a parent or guardian has given consent that is valid under your local law and we have verified it. Children under 13 must not send us any personal data without verified parental consent, and if you are in Quebec and under 14, consent from your parent or guardian is generally required. We do not knowingly collect personal information from children in breach of these rules; if we learn that we have, we will delete the account and associated personal data. If you believe a child has given us data, please contact us.

We may update this policy as the Service evolves. The "Last updated" date above always reflects the current version.