Privacy Policy

Last updated: 2026-05-15

This Privacy Policy explains what data Easy TCG Lister ("we", "the service") collects, how we use it, who we share it with, and your rights over it. The service is operated by Minden TCG / Chongor Consulting and is primarily designed for individual TCG card sellers in the United States.

1. Data we collect

• Account data: email address, name (optional), password hash (managed by Supabase Auth — we never see your plaintext password).
• eBay seller credentials: OAuth access and refresh tokens issued by eBay, plus your eBay username. Stored encrypted at rest with AES-128-GCM (Fernet).
• Scan images: photographs of trading cards you upload, stored on Cloudinary's CDN once a listing is published.
• Listing data: card identifications, prices, condition, sale history.
• Billing data: a Stripe customer ID linking back to your subscription. Stripe sees your name, email, billing address, and card details — we do not.
• Operational data: IP address (for rate limiting and lockout), user agent (for audit log), recent authentication events.

2. How we use it

• To identify cards you scan via OpenAI's vision API (single request/response — OpenAI does not retain your images).
• To create and manage eBay listings on your behalf via the official eBay Sell API.
• To process payments for your subscription via Stripe Checkout.
• To store your card images on Cloudinary so eBay can fetch them via HTTPS URLs.
• To send you transactional emails (verification, password reset) via Supabase Auth.
• To detect abuse and protect your account (rate limiting, login lockout, anomaly detection).

3. Subprocessors

We use the following third-party services to handle customer data. Each is bound by its own privacy policy:

• Supabase — authentication and database.
• OpenAI — vision-AI card identification (single request/response, no retention per their API terms).
• Stripe — payment processing + subscription billing + VAT/GST collection.
• Cloudinary — card image hosting (so marketplaces can fetch your scans over HTTPS).
• eBay — listing creation, business policies, order data (per-user OAuth).
• Shopify — cross-listing to your connected Shopify store (per-user OAuth, optional).
• Whatnot — bulk-restock CSV exports the seller uploads themselves; we don't transmit data to Whatnot.
• TikTok Shop — cross-listing via TikTok's Open Platform (per-user OAuth, optional, US/UK/SEA markets).
• Resend — transactional email (welcome, setup, low-credits, token-expiry).

Each marketplace + service connection is opt-in. We never share data with a third-party service unless you've explicitly authorized us to. We also use standard cloud infrastructure providers (application hosting, error monitoring) that do not process customer-identifying data.

EU / UK customers can request a signed Data Processing Agreement (DPA) by emailing legal@easytcglister.com.

4. What we don't do

• We don't sell your data to anyone.
• We don't use your data for advertising.
• We don't use your data or your card scans to train machine-learning models.
• We don't share your eBay credentials with anyone outside of authenticated eBay API calls on your behalf.

5. Cookies

We use the following cookies:

• Essential (always set): sb_access_token + sb_refresh_token after sign-in. HttpOnly, SameSite=Lax, Secure in production. Strictly for authentication.
• Preferences (always set, no personal data): tcg-theme stores your light/dark/auto choice in localStorage. tcg-welcome-seen records that you've dismissed the welcome modal. Both stay in your browser; we never read them server-side.
• Analytics (opt-in, EU + California users see a consent banner): currently we don't use any third-party analytics cookies. If we later add product analytics (e.g. PostHog), we'll surface an explicit opt-in toggle and only set the cookie after you consent.

You can review or change your cookie category choices any time via Cookie Preferences (in the footer) or the Cookie Policy. Your choice is stored first-party in your browser as etcg_cookie_consent and contains no personal data.

6. Data retention

• Active accounts: data is retained for as long as your account is active.
• Deleted accounts: account data, scan images, eBay tokens, and credit history are deleted immediately. Financial records (sales, subscription history) are pseudonymized (user ID replaced with a one-way hash) and retained for 7 years to comply with US tax requirements (IRS Section 6001).
• eBay deletion notifications: when eBay tells us a user has deleted their eBay account, we delete the linked tokens immediately.

7. Your rights

• Access / export: download a full JSON export of your data at Settings → Download my data.
• Deletion: delete your account immediately at Settings → Danger Zone.
• Correction: edit listings and account details directly in the app; for anything else, email support.
• Portability: the JSON export is machine-readable and structured for re-import.

8. Children

Easy TCG Lister is not intended for users under 18. We do not knowingly collect data from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email to your registered address.

10. Contact

Questions, requests, or concerns: chongor.goncz@gmail.com.