Privacy Policy
1. Who We Are
TCG IMS ("the app", "we", "our") is operated by Fantasy TCG, based in the United States. You can reach us at support@fantasytcg.com for any privacy-related questions or requests.
2. Information We Collect
Account information
When you create an account, we collect your email address and a securely hashed password. If you sign in with Google, we receive your name and email address from Google — we do not receive or store your Google password.
Inventory and app data
When you use TCG IMS, we store your inventory records, vendor/show logs, categories, and app settings in our database (Cloudflare D1) so your data persists across devices and survives browser data clearing. This data is associated with your account and accessible only to you.
Payment information
All payments are processed by Stripe. We never see, receive, or store your credit card number, CVV, or bank details. Stripe provides us with a customer ID and subscription status only. You can review Stripe's privacy policy at stripe.com/privacy.
Usage data
We do not run analytics software, ad trackers, or third-party pixels on TCG IMS. We do not sell, rent, or share your data with advertisers. Cloudflare may log basic request metadata (IP address, timestamps) as part of infrastructure operation — this is governed by Cloudflare's privacy policy.
Guest sessions
If you use TCG IMS as a guest, we record your IP address to enforce the 24-hour trial limit and 7-day cooldown between trials. Guest IP records are not linked to any personal identity and are not used for any other purpose.
3. How We Use Your Information
| Data | Purpose |
|---|---|
| Email address | Account identification, password reset emails, essential account notices |
| Password (hashed) | Authentication — stored as a one-way PBKDF2 hash, never readable |
| Google name & email | Account creation and sign-in via Google OAuth |
| Inventory & app data | Syncing your data across devices and restoring it after browser data clears |
| Stripe customer ID | Managing your subscription and billing portal access |
| Guest IP address | Enforcing the free trial limit per IP address |
We do not use your data for advertising, profiling, or any purpose not listed above.
4. Data Storage and Security
Your data is stored on Cloudflare D1 (SQLite at the edge) and processed by a Cloudflare Worker. All communication between the app and our servers uses HTTPS/TLS encryption. Passwords are hashed using PBKDF2 with SHA-256 and a random salt — they cannot be reversed or read by anyone, including us.
Access tokens are randomly generated 32-byte hex strings stored in your browser's localStorage. They expire automatically — user sessions after 30 days, guest sessions after 24 hours.
No data is stored on our own servers. We rely on Cloudflare's infrastructure, which maintains SOC 2 compliance.
5. Data Retention
- Active accounts: data is retained for as long as your account exists.
- Deleted accounts: all account data, sessions, and inventory records are permanently deleted immediately when you request account deletion from within the app.
- Guest IP records: retained for up to 7 days after your last guest session, then automatically purged.
- Password reset tokens: expire after 1 hour and are deleted immediately upon use.
6. Third-Party Services
| Service | Purpose | Privacy Policy |
|---|---|---|
| Cloudflare | Hosting, database, and edge compute | cloudflare.com |
| Stripe | Payment processing and subscription management | stripe.com |
| Optional Google Sign-In (OAuth 2.0) | policies.google.com | |
| Resend | Transactional email (password resets) | resend.com |
| Google Fonts | Typography (Inter, Space Grotesk) | policies.google.com |
We do not share your personal data with any of these services beyond what is necessary to provide the service described.
7. Your Rights
You have the right to:
- Access — request a copy of the data we hold about you
- Correction — update your email or password at any time from within the app
- Deletion — permanently delete your account and all associated data via Settings → Delete Account, or by emailing us
- Data portability — export your full inventory at any time using the Export function
- Opt out — you can use TCG IMS as a guest without creating an account
For any request, email support@fantasytcg.com. We will respond within 30 days.
8. Children's Privacy
TCG IMS is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If we learn we have received data from a child under 13, we will delete it promptly. If you believe a child has submitted information, please contact us.
9. Changes to This Policy
We may update this policy from time to time. When we do, we will update the effective date at the top. Continued use of TCG IMS after changes are posted constitutes acceptance of the updated policy. For material changes, we will notify registered users by email.
10. Contact
Fantasy TCG
Email: support@fantasytcg.com
Website: fantasytcg.com