Privacy Policy

Effective October 21, 2026

TCGVendr is an iPhone app for trading-card shows. Vendors post the cards they’re bringing to upcoming shows, collectors track what they own, and everyone can browse shows, tables and cards. This policy covers what the app collects, who can see what, and how to delete it. The short version: we collect what the app needs to work, we don’t run ads, we don’t sell your data, and we don’t track you across other companies’ apps or websites.

1. Your account

You need an account to use TCGVendr. You can sign in three ways:

Email. You give us an email address and we send you a one-time code. There’s no password.
Sign in with Apple. Apple gives us the email on your Apple ID (or a private relay address if you choose to hide it), and your name the first time you sign in.
Sign in with Google. Google gives us the email and name on the Google account you pick.

After signing in you choose a display name and your home state. The app uses your home state to show you shows nearby.

Before you sign in, the app opens a temporary anonymous session so it can reach our servers. Signing in replaces it.

2. What you give us

Profile. Your display name and home state, plus an optional profile photo, bio and Instagram handle.
Your collection. The cards and sealed products you add: condition or grade, quantity, certification numbers, any asking price you set, what you paid and when, and any photos of your own cards you upload.
Show activity. Tables you publish and the prices on them, the cards you pick to bring to a show, shows you mark Going, and shows you submit for listing (including any flyer you upload).
Sales. Sales you record, including price, date and notes.
Social activity. Shows, tables and cards you favorite, vendors you follow, messages you send, people you block, and reports you file.
Card scans. When you scan, the photo goes through our servers to Cardsight, which identifies the card. Some of the reading happens on your phone first. Cardsight isn’t given your account, and we don’t keep the photo. We do count how many scans each account makes per day, for the weekly scan limit.
PSA certification numbers. When you scan a PSA slab, your phone reads the cert number off its label. When you scan or add a PSA slab, our servers send that cert number (and nothing else) to PSA to look up PSA’s photo of the slab. We keep PSA’s link to the photo for up to 30 days and reuse it for anyone with the same cert number. The photo itself loads from PSA’s servers. We keep a record of each lookup (the cert number, your account identifier and the result) for two years, as our agreement with PSA requires.
Subscriptions. If you buy TCGVendr Pro, Apple handles the payment and tells RevenueCat whether your subscription is active. We see that status for your account. We never see your card number or billing address.

3. What’s collected automatically

The app has no advertising SDKs, doesn’t use your advertising identifier, and never reads your phone’s GPS location.

Server logs. Supabase, which hosts our database and servers, keeps standard logs such as IP addresses and request times so it can run and secure the service.
Product analytics. We use PostHog to see which parts of the app get used and where people get stuck. It records the screens you open and the actions you take (for example adding a card, opening a show, or starting a subscription), when they happened, your device model, iOS version and app version. PostHog also estimates your approximate location (city, region and country) from your IP address.
Session replays. PostHog also records low-frame-rate replays of how the app is used, showing taps and screens. We mask the text you type into the app’s fields, your email address, your messages, profile pictures and the photos you attach to your cards. The Scan screen isn’t masked, so a replay can show what your camera saw while you were scanning. Replays also list the requests the app made during the session, which can include what you searched for.
Crash reports. We use Sentry to find bugs. It receives crash and error reports, a sample of performance timings, your device model, iOS version, app version and the screen you were on. It’s set up not to attach your account, and it strips email addresses and message text before anything leaves your phone.
Push token. If you allow notifications we store a token for your device so we can deliver them.

Analytics are tied to an account identifier so we can follow one session across screens. They don’t include your email address. PostHog stores this data in the United States and deletes session replays after 30 days.

4. What other people can see

TCGVendr is built for finding cards and the people who have them, so some things are visible to other users by design.

Your profile: display name, photo, bio, Instagram handle, Pro badge, home state, and the tables you’ve published.
Your collection: other users can browse it. They see each card’s name, image, set, condition or grade, quantity, any photo you added, and an asking price if you set one. They never see what you paid, your purchase history, your sales or your profit. Hiding a card takes it off your profile. Hiding is the only way to keep a card private.
Tables: a published table, with every card and price on it (including cert numbers on graded cards), is public.
Going and the cards you bring: marking Going puts you on the show’s list of people going. If you pick cards to bring, they show on the show page under the collectors bringing cards.
Favorites: when you favorite someone’s card, they get notified and can see your name on the list of people who favorited it.
Messages go to the person you sent them to. We read a message only if someone reports it.

Blocking someone hides you from each other. They can’t message you, and you disappear from each other’s collections, favorites and inbox.

5. How we use it

To run the app: showing shows, tables and collections, pricing cards, delivering messages and notifications.
To keep it safe: enforcing our Terms, reviewing reports, honoring blocks and limiting spam.
To improve it, using the analytics and crash reports above.
To email you sign-in codes and, now and then, a note about your account or a change to the app. Reply and ask, and we’ll stop the occasional notes.

We don’t sell personal information, and we don’t share it with anyone for their own marketing.

6. Notifications

Notifications stay off until you allow them. You can turn each kind off in the app under Settings, Notifications:

New messages, when someone messages you.
Favorites, when someone favorites one of your cards.
Daily market update, one a day with what your collection is worth and your biggest mover. The notification text includes that value, and it’s delivered through Expo and Apple.

If you start a free trial of Pro and have notifications on, the app also schedules a reminder on your phone before the trial ends. To turn notifications off entirely, use iOS Settings.

7. Companies that help run the app

Each of these gets only what its job needs and works on our behalf.

Supabase: our database, sign-in, file storage and servers. It holds the data described above.
Apple: app distribution, Sign in with Apple, push delivery and payment for Pro.
Google: Sign in with Google, if you use it.
RevenueCat: tracks whether Pro is active, keyed to your account identifier. It gets the receipt from Apple, never your payment details.
Scrydex: the card catalog and market prices. Searches go through our servers, so Scrydex isn’t given your account. Card images load straight from Scrydex’s image servers, which see your IP address.
Cardsight: card recognition for scans, as described above.
PSA: official slab photos, looked up by cert number only. The photos load straight from PSA’s servers, which see your IP address.
PostHog: product analytics, session replays and website visit counts.
Sentry: crash and error reports.
Expo: delivers push notifications through Apple.
Brevo: sends the email with your sign-in code. It also sends us a note when someone submits a show, which includes the submitter’s email address.
Frankfurter: exchange rates (published by the European Central Bank) for the display currency setting. Your phone asks for the rates directly, without any account information.

8. Keeping and deleting data

We keep your data while your account exists. You can delete your account at any time in the app under Settings, Account, Delete account. It happens right away and can’t be undone. It removes your profile and photo, your collection and purchase history, card photos you uploaded, your sales, tables and the cards you picked to bring, your favorites, follows and Going marks, your conversations and messages, your push tokens and notification settings, your scan counts, and your RevenueCat record.

Some things stay:

Shows you submitted stay listed, with their flyers, because other people rely on them. Your name is removed from them.
Copies of messages or content that were reported stay while we review the report.
Records of subscription billing events from RevenueCat, which we keep for our accounts.
The record of PSA lookups (cert numbers and account identifiers), kept for two years under our agreement with PSA.
Analytics and crash data in PostHog and Sentry aren’t removed automatically. Email us and we’ll delete yours.
Backups expire on a rolling schedule.

Deleting your account doesn’t cancel a Pro subscription, because Apple bills it. Cancel it in iOS Settings under your name, then Subscriptions. If you signed in with Apple, you can also remove TCGVendr in iOS Settings under your name, then Sign in with Apple.

9. Your choices

You can see and edit your profile and collection in the app, hide any card, and delete your account. You can also email support@tcgvendr.com to ask for a copy of your data, to correct something, or to delete data we hold about you, including analytics. Depending on where you live you may have more rights under local law, and we’ll honor them.

10. Children

TCGVendr is for people 13 and older. We don’t knowingly collect personal information from children under 13. If you think a child under 13 has an account, contact us and we’ll delete it.

11. Security

Data is encrypted in transit. Sign-in uses one-time codes, Apple or Google, so there’s no TCGVendr password to steal, and session tokens are kept in your phone’s keychain. Access rules run on our servers, so an account can read only what the visibility rules above allow.

12. This website

tcgvendr.com doesn’t use cookies or advertising trackers. It counts visits with PostHog: the page you opened, the site or app that sent you there (for example TikTok), your device type, and whether you tapped through to the App Store. PostHog estimates your approximate location from your IP address. Each visit gets a random identifier that your browser forgets when you close the tab, so visits aren’t linked to you or to each other, and nothing here is tied to an app account. The site is hosted on GitHub Pages, which keeps standard server logs such as IP addresses.

If you’re on Android, you can leave your email to hear when TCGVendr comes to Android. We store that address (with the page you signed up on and the app you were browsing in, such as TikTok) on our servers, use it only to send you that one email, and never share or sell it. The visit counts above record that someone signed up, never the address. Email support@tcgvendr.com to have it removed.

13. Changes and contact

If this policy changes in a meaningful way, we’ll update this page and the date at the top. Questions or requests, including deletion: support@tcgvendr.com.