Privacy Policy

TCG Marketplace (“we”, “us”) operates tcgmarketplace.ca. We help Canadian players compare singles, sealed products, and graded slabs across local game stores, and we help those stores list inventory on the site.

We are based in Canada. This policy applies to the public website, store onboarding, and the Shopify app we install on partner stores.

Privacy questions: sales@tcgmarketplace.ca.

Information you give us

• Account. If you register with email, we store your email, first name, last name, and a hashed password. We never store your password in plain text. Email accounts must verify the inbox before sign-in.
• Google, Microsoft, Discord, or Facebook sign-in. If you continue with one of these providers, it sends us your name, email, and an identifier so we can recognize the same login next time. Google, Discord, and Facebook may also send a profile photo. We request basic profile and email access only. We do not receive your password from any of these providers.
• Collection and binders. Cards you add (game, name, set, condition, finish, quantity, optional purchase price) stay on your account. Only you can see this.
• Wishlists. Wishlist name, game, and the card list you save. If you create a share link, anyone with that link can see the wishlist name, game, and list — not your email.
• Favourite stores. Retailers you pin in Settings (up to 25).
• Saved search location. The coordinates, label, radius, sorting preference, and reported accuracy you explicitly save in Settings. Browser-provided coordinates may be precise; city and postal-area coordinates are approximate. You can replace or remove this preference in Settings. It is deleted with your account.
• Store onboarding. If a shop emails us to connect, we receive the unique Shopify domain, preferred store name, and public website URL you send to sales@tcgmarketplace.ca.

Information we collect automatically

• Session. A signed cookie keeps you logged in and gives your browser a random visitor ID so we can tell repeat visits apart without knowing who you are.
• Page path while you are on the site. While a tab is open, we record the current path (for example /search) so we can see live usage. We do not record the query string or fragment.
• Searches and product actions. We record when a search finishes, when filters are applied, and similar product events. Search text is shortened and dropped if it looks like an email or a URL.
• Outbound store clicks. When you leave to a retailer, we store the store, product, price, destination URL, visitor ID, and whether you were signed in. If you are signed in, that click can be tied to your account for our internal reports.
• IP address. Used only to rate-limit abusive traffic. We do not save IP addresses in click or analytics tables.

Information we do not collect

• Payment card numbers or checkout details (we never charge you).
• A partner store's Shopify customers, orders, or customer personal information.
• Your device location automatically or continuously. A browser location request requires your action, and we only store its coordinates on your account when you explicitly save them in Settings.

We use these on-device and measurement tools:

• Session cookie named tcg-marketplace-session. It is HTTP-only, uses SameSite=Lax, and lasts 7 days. On production it is marked Secure. It holds your login and visitor ID.
• Local storage for theme (light/dark) and your preferred game. Wishlist cache on the device is cleared when you sign out.
• Google Tag Manager, which loads Google Analytics (GA4). We send page views, card searches, card views, and store clicks. Google may set its own cookies and process that data under Google's privacy policy.

We do not use advertising pixels such as Meta, and we do not run separate tools such as Plausible, PostHog, or Mixpanel on the site.

• Provide search, comparison, wishlists, and collection tools.
• Keep you signed in and secure the site against abuse.
• Send account email (verification links from noreply@tcgmarketplace.ca). We do not send marketing newsletters.
• Understand how the marketplace is used and which store listings are opened, so we can operate and improve the service.
• Connect a partner store's catalog and keep prices and stock up to date.
• Respond when you email us.

We do not sell personal information. We do not use it to build advertising profiles for third-party ad networks.

Partner stores install the TCG Marketplace Shopify sales channel. After connecting, they choose which products to publish. We receive catalog updates and copy product information so their listings can appear on TCG Marketplace. Older store connections may use separate custom apps until they migrate to the shared channel.

• What we use: product and inventory data, channel product feeds and publications, publishing feedback, and a public storefront connection for attributed checkout links. Shopify may add a restricted permission for the channel's own orders during review; we do not use it to import order records or customer data. Buyers complete payment on the retailer's checkout.
• What we store from that access: store name, *.myshopify.com domain, storefront URL, province, currency, app credentials, the access and refresh tokens, channel identifiers, the public storefront token, publishing status, and product/inventory fields needed to show listings (titles, SKUs, prices, stock, images, and similar catalog data).
• What we do not receive from Shopify: customers, orders, checkout records, or other shopper personal information from that store. If Shopify sends a customer data request or customer redaction webhook, we confirm we hold no customer data.
• If you disconnect: we stop channel publishing and hide the store's listings. You can reconnect from the channel screen. If you uninstall the app: we deactivate the connection and delete the access token so we can no longer read the store. When Shopify sends its shop data deletion request after uninstall, we erase copied catalog, feed, and connection data. Minimal inactive store identifiers prevent old search listings from reappearing. Email sales@tcgmarketplace.ca if you want that data removed sooner.

When you submit feedback while signed in, we send your message, account name, email address, and account ID to our team through a private Discord channel so we can review it and respond. Please do not include passwords or payment details in feedback.

The website, database, and search index run on cloud infrastructure we operate. Some processors are outside Canada, including in the United States:

• Google (sign-in and Tag Manager / Analytics)
• Discord (Discord sign-in and feedback you submit)
• Meta (if you sign in with Facebook)
• Microsoft (if you sign in with Microsoft)
• Resend (account verification email)
• Shopify (partner store install and catalog sync)

When you follow a listing, you leave TCG Marketplace and the retailer's own privacy policy applies to anything you do on their site.

• Session cookie: 7 days, or until you sign out (which clears the session immediately).
• Live page presence: deleted after 7 days of inactivity.
• Account, collection, wishlists, favourite stores: until you delete them or ask us to delete your account.
• Click history and usage events: kept for operating and reporting on the marketplace until you ask us to delete them or we no longer need them. We do not run an automatic purge of that history today.
• Email verification links: expire after 24 hours.
• Partner Shopify data: the access token is deleted when the app is uninstalled. Catalog data we copied is deleted within 6 months of uninstall, or sooner if you email us.

Under Canadian privacy law (including PIPEDA), you can ask us what personal information we hold, ask us to correct it, and ask us to delete it.

• You can edit collection items, delete wishlists, and change favourite stores while signed in.
• To delete your account and stored profile, email sales@tcgmarketplace.ca. We will delete the profile and data tied to it (wishlists, collection, binders, and favourite stores). There is no self-serve delete button today.
• Store owners can disconnect from the channel screen or uninstall the Shopify app from their admin. After uninstall, we then delete the catalog data we copied within 6 months, or sooner if you email us.

You can also use Google, Microsoft, Discord, or Facebook account settings to stop those services from sharing login details with us going forward.

TCG Marketplace is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will delete it.

We will update this page when our practices change. The “Last updated” date at the top is the current version. Continued use of the site after a change means you have had a chance to review the new policy.

TCG Marketplace
sales@tcgmarketplace.ca

See also the FAQ and store onboarding.