Privacy policy

The short version

• You can use DealDigger without an account. We only ask for an email address if you sign up.
• We don't sell your data, show ads that track you, or use analytics trackers.
• Your collection is private unless you make your profile public.
• Card scanner photos never leave your device.
• You can download your collection, and delete your account and everything in it, from the Account page at any time.

Who we are

TCG DealDigger ("DealDigger", "we") is a UK website that helps collectors find trading card deals and track their collections. For anything about your data, contact support@tcgdealdigger.com or use the feedback form. We are the data controller for the information described here, under UK GDPR and the Data Protection Act 2018.

What we store, and why

If you create an account

• Email address: to sign you in, send password reset links and send the price alerts you ask for.
• Username: shown on your public profile and the community page only if your profile is public.
• Password: stored only as a salted hash. We can't see or recover it.
• Security records: failed sign-in counts and one-time reset links (stored hashed, and they expire), to protect your account.
• Settings: games you follow, your public/private choice, and a Discord webhook if you add one for alerts.

Things you add

• Collection (cards, quantities, condition, print, what you paid), watchlist and price alerts, pack openings, bargains you've logged (a snapshot of the eBay listing you bought from), and emoji reactions on the community page.
• Tickets you send through the feedback form, with the page you sent it from and, if you're not signed in, the email address you choose to give us.

We use these to run the features you're using. The legal basis is providing the service you've asked for (contract). For security records it's our legitimate interest in keeping accounts safe.

What other people can see

By default, nothing. If you turn on a public profile, others can see your username, badges, favourite cards, set progress, and any pack openings or bargains you share (including the prices on those). They can also see your name on leaderboards and the community page. Your email, your collection's total value and cost, and your full collection are never shown. Turn it off at any time in Account.

Anonymous statistics

For "Trending cards", we count how often each card is viewed, scanned or searched each day. These counts aren't linked to you or your account in any way.

The card scanner

The camera image is processed in your browser. Only a short picture "fingerprint" (a string of numbers) and any text read from the card are sent to us to find a match. The photo itself is never uploaded or stored.

Server logs

Like any website, our hosting keeps short-lived technical logs (IP address, pages requested, errors). We use them to keep the site working and to stop abuse (for example, limiting repeated sign-in attempts).

Cookies

We use one cookie, dd_session. It keeps you signed in (for up to 14 days) and protects forms against cross-site attacks. It's strictly necessary, so it doesn't need consent, and we don't use advertising or analytics cookies.

Clicking through to eBay or another shop takes you to their site, where their own cookies and policies apply. That includes affiliate tracking, described below.

Services we use

• Railway hosts the website and database.
• Brevo sends our emails (password resets, alerts, ticket replies). Brevo receives your email address and the message.
• eBay provides the listing search through its official API. We send it search terms, never who you are.
• Card data comes from TCGdex, Scryfall, YGOPRODeck and the OPTCG API, and exchange rates from the European Central Bank (via Frankfurter). We send them card or set names only.
• Images and fonts: card pictures load straight from TCGdex, Scryfall, OPTCG API and eBay's image servers, and the site font from Google Fonts. Like any image or font on the web, your browser connects to those servers, so they see your IP address.
• Discord: alerts go to a Discord webhook only if you add one yourself.

Some of these services process data outside the UK (for example in the US or EU). Where that happens, they rely on UK-approved safeguards such as adequacy regulations or standard contractual clauses.

Affiliate links

Some links to eBay and other shops are affiliate links. If you buy something after clicking one, we may earn a small commission at no extra cost to you. This keeps the site free. The shop may use cookies to record that you came from us. We never receive your personal or payment details from them.

How long we keep it

• Account data and everything you've added: until you delete it or your account.
• Deleting your account removes your account, collection, watchlist, alerts, openings, bargains, reactions and tickets immediately. Anonymous trending counts aren't linked to you, so they stay.
• Password reset links: they expire after a short time and are cleared out.
• Tickets: until they're resolved and no longer useful, or until you delete your account.

Keeping it safe

Everything is sent over HTTPS. Passwords are hashed. Sign-in, scanning and forms are rate-limited. Every form is protected against cross-site attacks, and only you can see or change your private data.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Much of this you can do yourself:

• Export your collection as a spreadsheet from the Collection page.
• Change your username, password and privacy settings in Account.
• Delete your account and all its data in Account.

For anything else, email support@tcgdealdigger.com. We'll reply within one month. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

You need to be 13 or older to create an account. If you think a child under 13 has signed up, contact us and we'll delete the account.

Changes

If we change this policy, we'll update it here and change the date at the top. For significant changes, we'll also tell signed-up users by email or on the site.