Privacy Policy

This English translation is provided for convenience. The German version is authoritative.

This privacy policy explains how personal data is processed on the website tcg1.net and in the iOS and Android app TCG Vault.

1. Controller

Marketingberatung Hannes Wirtz
Forsmannstraße 14b
22303 Hamburg, Germany
Email: [email protected]

2. Website tcg1.net

The website is a static site with no accounts, forms, or tracking. It sets no cookies and embeds no analytics services. Fonts are self-hosted.

Pull-rate check badge (Poké Life)

The pull-rate overview (/pull-rates/ and /de/pull-raten/) shows a badge from Poké Life (poke-life.com), which independently checked our pull-rate pages against their sources. The badge image is loaded from Poké Life's server so that it stays current. When you open this page, your browser connects to that server, which receives your IP address, the time of access, the requested image and the referring page. We receive no data from it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing a current, independent check of our pull rates). See the Poké Life privacy policy.

Hosting (Cloudflare)

The website is delivered via Cloudflare Pages (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, and Cloudflare, Inc., USA). When you visit the site, Cloudflare processes technically necessary connection data (in particular IP address, date and time of access, requested page, user agent) to deliver the site and to protect it against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, performant operation). Further information on international transfers: Cloudflare privacy policy.

3. Account and collection

Sign in with Apple provides an Apple identifier and, depending on what you share, your name and email or relay address. We store authentication sessions and the collection information you create, including quantities, purchase prices, lists, price rules, valuations and weekly reports. Processing supports the requested service under Art. 6(1)(b) GDPR. Some data is cached on your device for poor connectivity.

Our app servers are hosted by Hetzner Online GmbH in Germany. This does not mean that all participating providers process data exclusively in Germany. Necessary connection and error information supports secure operation and incident handling (Art. 6(1)(f) GDPR), for as long as the relevant operational or security incident requires.

Technical access logs may include IP address, time, API path including search and filter parameters, response status and technical client information. Entered search terms may therefore appear in operational logs. This is separate from optional usage analytics; necessary operational logging does not depend on analytics permission. These logs support troubleshooting and service security, not advertising.

Optional Sign in with Google

If you choose Sign in with Google, we receive a Google account identifier, your verified email address and profile name. For a new account, we store these details for sign-in and account management. When you link Google to an existing account, we store the association between the Google identifier and that account. Matching email addresses do not automatically merge collections. Processing provides the sign-in you request under Art. 6(1)(b) GDPR.

Sign-in connects your device to Google. Google may process your account identifier and IP address and estimate a general location for fraud prevention. We request only identity, email and basic profile information, with no Gmail, Drive or contacts access. Google identity tokens are sent to our server for verification and are not stored permanently; your device retains its TCG Vault session. Deleting your Vault account removes its Google association. You can also revoke the app connection in your Google account. Google may process data outside the EEA; see the Google Privacy Policy. On iOS, Sign in with Apple remains available as an alternative.

Optional subscriptions and usage allowances

Where TCG Vault+ is offered, Apple handles purchases and payments. We do not receive card or bank details. To associate and verify a subscription, we process a random account purchase token, Apple's original transaction ID, product ID, test/production environment, subscription status, expiry and verification time. The random account token is sent to Apple during purchase. We verify Apple's signed purchase data and request current subscription status from Apple; stored associations are retained until account deletion.

For allowances shared across devices, we store the account, feature, calendar month, usage time and status, and a hash to identify repeated requests. This allowance store contains no photos or recommendation text. Entries are removed after 90 days by regular cleanup, or earlier on account deletion. This processing provides and accounts for the selected feature allowances and is independent of optional analytics. Deleting your Vault account does not cancel an Apple subscription; manage it separately in your Apple subscription settings.

4. Scans, market images and push

Scanning sends your card photo to our server for recognition and stores it with the result in your scan history. It does not use OpenAI. Photograph cards only, without people or personal documents. Unrated scans are removed within 90 days; scans with feedback are retained for up to 180 days to investigate recognition errors. Legal bases are performance of the requested service (Art. 6(1)(b) GDPR) and our legitimate interest in correcting reported errors (Art. 6(1)(f) GDPR). Account deletion removes associated scans earlier.

Card, set and product images also come from Pokémon TCG API, Scrydex and TCGplayer. When an image is delivered from our server cache, that image request does not directly connect your device to the original image provider. Direct device requests disclose necessary connection information, including IP address and request details, to those providers for the requested image display (Art. 6(1)(b) GDPR). International providers may process data outside the EU. You can request information about recipients and contractual safeguards using our contact.

Push notifications are optional. After system permission, we store your device token and price rules and use Apple Push Notification Service (consent, Art. 6(1)(a) GDPR). You can disable notifications in iOS settings and delete rules in the app. See the Apple privacy policy.

5. Optional usage analytics

Additional usage analytics is off by default. You can enable it under Settings → Privacy & AI. We then process account-linked events such as opened sections, successful actions, technical failures, session identifier, app version and build to improve usability. Search text is not stored in optional analytics; see section 3 for technical access logging. With analytics permission, AI actions may also record response duration and the number of tools used, without conversation text in those analytics events. There is no advertising tracking or sale of these data.

The legal basis is consent (Art. 6(1)(a) GDPR and, where required, § 25(1) TDDDG). Events are deleted within 30 days. Disabling analytics stops collection and deletes the account's existing analytics events. Core functions remain available without permission.

6. Optional external AI and age eligibility

Collection management, scans, price observations and the calculated weekly report do not require external AI or AI age eligibility. Optional OpenAI features are initially available only to adults aged 18 or older. Before using AI, we require confirmation that you are at least 18 and separate explicit data permission. On iOS 26 or later, age is shared through Apple's Declared Age Range feature. On supported older iOS versions, you explicitly confirm yourself that you are at least 18. Self-declaration is not an Apple age signal; neither method is an identity check performed by us.

On Android, your action requests age eligibility through Google Play Age Signals. The app sends the resulting age signal and its source to our server for access checks. If Google Play does not provide sufficient eligibility, external AI remains blocked. Explicit self-declaration may be available in separately identified development builds; it is not a Google age signal. See the Google privacy policy.

We store neither your date of birth nor identity documents. We store the signed-in session's AI age eligibility, its source and expiry time, expiring within 24 hours. Without positive age confirmation, external AI remains blocked while other features remain available. A current negative platform age signal cannot be replaced by self-declaration. The legal basis for this access control is our legitimate interest in enforcing the initially adults-only AI access (Art. 6(1)(f) GDPR).

With your permission, an AI request sends OpenAI, as provider of the OpenAI API, your message, current conversation and, depending on the function, collection positions and values, likes, dislikes, budget, holding period, matching recommendations and market data. The legal basis is consent under Art. 6(1)(a) GDPR. Previous Google/Gemini consent does not apply to OpenAI; the new recipient requires new consent.

Under OpenAI's data controls, API inputs and outputs are not used for model training by default. We disable storage of Responses for later API retrieval. This is not a promise of Zero Data Retention: OpenAI may generally retain content in abuse-monitoring logs for up to 30 days, or longer when legally required. Processing may take place outside Germany and the EEA. You can request details of the API project, recipients and contractual transfer safeguards using our contact.

AI permission is optional and can be withdrawn for future requests under Settings → Privacy & AI. Withdrawal cannot recall requests already transmitted. A subscription or acknowledgement of general risk information replaces neither age information nor AI permission.

To speed up repeated requests, recommendations may be reused for the same user for up to 30 minutes. This cache stays in server memory and is not saved to disk as recommendation history. Changes to the market data, collection and likes/dislikes used in the recommendation cause a fresh result. Withdrawing AI permission or deleting the account clears the associated cache.

7. Feedback and quality assessment

If you explicitly rate an answer or recommendation or report it as inappropriate, we store the rating and related context for up to 30 days to investigate errors. Chat feedback may contain the rated question and answer; recommendation feedback may contain the selection and explanation. Automatic chat operational logs do not contain conversation text. They contain account association, time, status, message count, response length and processing duration and are retained in identifiable form for at most 30 days. This is separate from conversation history in the app and OpenAI’s processing of permitted requests. Processing voluntary feedback serves our legitimate interest in investigating errors and improving the app (Art. 6(1)(f) GDPR).

At expiry or account deletion, personal records including free text are removed. Only accumulated fixed categories, such as helpful, unhelpful, reported content or failed request, remain. Totals contain no account/session identifiers, text, timestamps, product lists or budgets and do not form continuing user profiles.

8. Account deletion and backups

Settings → Delete account removes the account, collection, lists, reports, events, push associations and scan photos. Personal chat/feedback records are removed as described above; aggregate quality counts remain. Otherwise collection data remains until the relevant content or account is deleted.

You can also request deletion by email without the app installed. Follow the steps on Delete your account and data.

The minimum technical token needed to revoke Sign in with Apple may be retained separately until revocation succeeds. Failures are retried; no usable app account remains for this purpose.

Regular backups are limited to 30 days. New backups exclude personal chat/feedback text and active AI/analytics permissions. A separate deletion record derived using a secret key is used by the restore procedure to prevent deleted accounts from being reactivated from an older snapshot. It contains no names, content or authentication tokens and expires after 30 days. It is separate from anonymous quality statistics. Expired backups must not be put back into service.

9. Your rights

Under the GDPR you have rights to access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Consent can be withdrawn for the future without affecting the lawfulness of prior processing. Contact [email protected]. You may complain to a data protection supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information. Automated market information does not make legally binding decisions about you; you decide whether to buy or sell.