Privacy Policy

TCG Marketplace (“we”, “us”) operates tcgmarketplace.ca. We help Canadian players compare singles, sealed products, and graded slabs across local game stores, and we help those stores list inventory on the site.

We are based in Canada. This policy applies to the public website, store onboarding, and the Shopify app we install on partner stores.

Privacy questions: sales@tcgmarketplace.ca.

Information you give us

• Account. If you register with email, we store your email, first name, last name, and a hashed password. We never store your password in plain text. Email accounts must verify the inbox before sign-in.
• Google, Microsoft, Discord, or Facebook sign-in. If you continue with one of these providers, it sends us your name, email, and an identifier so we can recognize the same login next time. Google, Discord, and Facebook may also send a profile photo. We request basic profile and email access only. We do not receive your password from any of these providers.
• Collection and binders. Cards you add (game, name, set, condition, finish, quantity, optional purchase price) stay on your account. Only you can see this.
• Wishlists. Wishlist name, game, and the card list you save. If you create a share link, anyone with that link can see the wishlist name, game, and list — not your email.
• Favourite stores. Retailers you pin in Settings (up to 25).
• Store onboarding. If a shop emails us to connect, we receive the unique Shopify domain, preferred store name, and public website URL you send to sales@tcgmarketplace.ca.

Information we collect automatically

• Session. A signed cookie keeps you logged in and gives your browser a random visitor ID so we can tell repeat visits apart without knowing who you are.
• Page path while you are on the site. While a tab is open, we record the current path (for example /search) so we can see live usage. We do not record the query string or fragment.
• Searches and product actions. We record when a search finishes, when filters are applied, and similar product events. Search text is shortened and dropped if it looks like an email or a URL.
• Outbound store clicks. When you leave to a retailer, we store the store, product, price, destination URL, visitor ID, and whether you were signed in. If you are signed in, that click can be tied to your account for our internal reports.
• IP address. Used only to rate-limit abusive traffic. We do not save IP addresses in click or analytics tables.

Information we do not collect

• Payment card numbers or checkout details (we never charge you).
• A partner store's Shopify customers, orders, or customer personal information.
• Your location beyond the fact that you used the website.

We use these on-device and measurement tools:

• Session cookie named tcg-marketplace-session. It is HTTP-only, uses SameSite=Lax, and lasts 7 days. On production it is marked Secure. It holds your login and visitor ID.
• Local storage for theme (light/dark) and your preferred game. Wishlist cache on the device is cleared when you sign out.
• Google Tag Manager, which loads Google Analytics (GA4). We send page views, card searches, card views, and store clicks. Google may set its own cookies and process that data under Google's privacy policy.

We do not use advertising pixels such as Meta, and we do not run separate tools such as Plausible, PostHog, or Mixpanel on the site.

• Provide search, comparison, wishlists, and collection tools.
• Keep you signed in and secure the site against abuse.
• Send account email (verification links from noreply@tcgmarketplace.ca). We do not send marketing newsletters.
• Understand how the marketplace is used and which store listings are opened, so we can operate and improve the service.
• Connect a partner store's catalog and keep prices and stock up to date.
• Respond when you email us.

We do not sell personal information. We do not use it to build advertising profiles for third-party ad networks.

Partner stores connect through a custom Shopify app we create for their store. After the owner installs it, we receive an access token and periodically copy catalog data so listings can appear on TCG Marketplace.

• What we can access: only read_products and read_inventory. We do not request or use access to customers, orders, or checkout data.
• What we store from that access: store name, *.myshopify.com domain, storefront URL, province, currency, app credentials, the access token, and product/inventory fields needed to show listings (titles, SKUs, prices, stock, images, and similar catalog data).
• What we do not receive from Shopify: customers, orders, checkout records, or other shopper personal information from that store. If Shopify sends a customer data request or customer redaction webhook, we confirm we hold no customer data.
• If you uninstall the app: we deactivate the connection and delete the access token so we can no longer read the store. We delete the catalog data we copied from Shopify within 6 months of uninstall. Email sales@tcgmarketplace.ca if you want that data removed sooner.

The website, database, and search index run on cloud infrastructure we operate. Some processors are outside Canada, including in the United States:

• Google (sign-in and Tag Manager / Analytics)
• Discord (if you sign in with Discord)
• Meta (if you sign in with Facebook)
• Microsoft (if you sign in with Microsoft)
• Resend (account verification email)
• Shopify (partner store install and catalog sync)

When you follow a listing, you leave TCG Marketplace and the retailer's own privacy policy applies to anything you do on their site.

• Session cookie: 7 days, or until you sign out (which clears the session immediately).
• Live page presence: deleted after 7 days of inactivity.
• Account, collection, wishlists, favourite stores: until you delete them or ask us to delete your account.
• Click history and usage events: kept for operating and reporting on the marketplace until you ask us to delete them or we no longer need them. We do not run an automatic purge of that history today.
• Email verification links: expire after 24 hours.
• Partner Shopify data: the access token is deleted when the app is uninstalled. Catalog data we copied is deleted within 6 months of uninstall, or sooner if you email us.

Under Canadian privacy law (including PIPEDA), you can ask us what personal information we hold, ask us to correct it, and ask us to delete it.

• You can edit collection items, delete wishlists, and change favourite stores while signed in.
• To delete your account and stored profile, email sales@tcgmarketplace.ca. We will delete the profile and data tied to it (wishlists, collection, binders, and favourite stores). There is no self-serve delete button today.
• Store owners can uninstall the Shopify app from their admin. We then delete the catalog data we copied within 6 months, or sooner if you email us.

You can also use Google, Microsoft, Discord, or Facebook account settings to stop those services from sharing login details with us going forward.

TCG Marketplace is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will delete it.

We will update this page when our practices change. The “Last updated” date at the top is the current version. Continued use of the site after a change means you have had a chance to review the new policy.

TCG Marketplace
sales@tcgmarketplace.ca

See also the FAQ and store onboarding.