Privacy Policy

Last updated: October 2026

The deck builder works without an account. Use it that way and we never learn who you are: no sign-up, no profile, no analytics, no ads, no tracking pixels. If you choose to create an account, we store the little we need to run it. Here's exactly what happens either way.

Without an account

Nothing personal. We don't ask for your name or email, there's no contact form that stores data, and we don't build a profile of you. Without an account, your deck lives only in your own browser (see below); decks you save to your account are stored on our server.

With an account

• Your email address — to verify the account, let you sign in, and reset your password. Nothing else. We don't send marketing.
• A username — shown to other users when you share a deck.
• Your password, hashed — a one-way scramble (bcrypt). We never store or see the password itself, which is also why we can't recover it for you: we can only let you set a new one.
• Your Google account id and email — only if you choose "Continue with Google".
• Your invite code — during closed beta, and who invited you.
• Content you create — decks you save, share, rate, and groups you join, as those features roll out.

Beta waitlist

If you apply for a closed-beta invite, we store the email address you give us and use it for exactly one thing: sending you that invite. No newsletter, no follow-ups. We delete the list when the beta ends, or your entry sooner if you ask us to remove it.

What stays in your browser

To make the tool work, we save a few things in your browser's local storage — this never leaves your device and we can't see it:

• The deck you're building and its name
• Your format/filter preferences and your light/dark choice
• If you have an account: which of your saved decks is open in the builder
• The daily currency rate and meta-deck list (cached to avoid re-downloading)

Your browser also keeps its usual cache of the files it downloads from us (pages, fonts, card data), like on any website. You can clear all of it any time via your browser's "clear site data", or by clearing the deck in the app.

Cookies

One cookie, and only if you have an account: TCGSESS, which keeps you signed in for up to 30 days. It's strictly necessary for a feature you asked for, so no consent banner is required. We use no tracking or advertising cookies. There is nothing to consent to, so we don't ask.

Your IP address

Two places, both unavoidable and both short-lived:

• Anti-abuse counters — so nobody can sit there guessing passwords or burning through invite codes. These hold your IP (and, on the sign-in and password-reset forms, a one-way hash of the email typed) for about two hours at most; an hourly clean-up deletes them.
• Server logs — the standard access logs our host (Hostinger) keeps for a limited time to run and secure the server, as every web server does. We only look at them to investigate abuse.

Separately, the third-party services below see your IP simply because your browser talks to them directly.

Third-party services

Card data, prices and the site's fonts are served from our own server: we collect the card data and prices once a day from the public pokemontcg.io dataset, without sending anything about you.

A few things still load straight from other services. As with any web request, they can see your IP address and standard request info. We don't send them anything about you beyond the request itself:

• Scrydex — card images
• Limitless TCG — tournament decklists and Pokémon icons
• Frankfurter and ExchangeRate-API — the daily USD→EUR rate for card prices
• Cardmarket and TCGplayer — price links, contacted only if you click them

And these handle account data on our behalf:

• Hostinger (EU) — hosting and the database.
• Brevo (France) — sends the account emails (verification, password reset) and the beta invite. They receive your email address to deliver them.
• Google (USA) — only if you use "Continue with Google".

Hostinger and Brevo keep data in the EU. Google is in the US: that transfer relies on the EU–US Data Privacy Framework. Please refer to each service's own privacy policy for how they handle requests.

Why we're allowed to hold this, and for how long

We process account data to provide the service you signed up for (GDPR art. 6(1)(b), contract), we keep the anti-abuse counters because a login form without them gets brute-forced (art. 6(1)(f), legitimate interest), and we hold beta-waitlist emails because you asked us to contact you (art. 6(1)(a), consent).

• Account data — until you delete your account, then it's gone.
• Beta-waitlist email — until the beta ends or you ask us to remove it.
• Email verification links — expire in 24 hours. Password reset links — 1 hour.
• Anti-abuse counters — about two hours at most.

Your rights

From your profile you can export everything we hold about you as a JSON file, or delete your account permanently, both without asking us. You can also contact us for access, correction, erasure, to restrict or object to how we process your data, or to withdraw your consent for the beta waitlist at any time. If you think we've handled your data badly, you can complain to the CNPD, the Portuguese data protection authority.

Age

The deck builder is a card-game utility, safe for all ages, and needs no account. Creating an account requires you to be 16 or older.

Changes

We'll update this page when the policy changes, and flag significant changes on the site. If we ever add something that needs your consent, we'll ask first rather than assume.

Contact

Questions about privacy, or want your data? Reach out at contact@tcgwrap.com.

← Back to TCGwrap · Terms of Service