Privacy Policy

At TCG-ShipSync ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains what we collect, how we use it, and how to delete it when you use ShipSync, a tracker for your Pokémon and Lorcana card collection. ShipSync is run by an individual in the United States; TCG-ShipSync is not a registered business.

1. Information We Collect

Account Information

When you create an account, we collect:

• Your email address
• Your password, if you sign up with email (handled by Supabase Auth; we never see it in plain text), or your Google or Discord account identity if you sign in with one of those
• A profile name, if you set one

Collection Data

When you use ShipSync, we store what you enter:

• Your collection: cards, condition, SKU, price paid and market price
• Sales you record: sold price and date, fees and net proceeds
• Trades: cards given and received, and any cash involved
• Binders, including any public share links you create
• Daily totals of your collection's value, to draw your value-over-time chart
• Your ZIP code, if you enter it, used to estimate shipping and as the item location when you list on eBay
• Your app settings

We do not collect your full postal address, and we no longer store orders, buyer names or addresses, or shipping expenses.

Shared Binders

If you create a share link for a binder, anyone with the link can see that binder's cards and the first word of your profile name. You can remove the share link at any time.

eBay Account Connection (optional)

If you connect your eBay account in Settings, you sign in on eBay's own page; we never see your eBay password. eBay then gives us:

• Your eBay user ID and username, so we can show which account is connected
• Access tokens that let ShipSync act on your eBay account within the permissions you approved: create and manage listings, read your business policies (shipping, returns, payment), read your orders so cards are marked sold when they sell, and read the fees and shipping-label costs for those sales so your profit is right

The tokens are stored encrypted, are only used by our servers, and are never shown in your browser. From your eBay orders we record only the sale in your collection (price, date, fees and costs), not the buyer's name or address. Listing photos you take in ShipSync are sent straight to eBay and are not stored by us.

You can disconnect at any time in Settings → eBay, which deletes the stored tokens. You can also remove ShipSync from the apps connected to your account in eBay's account settings. If you close your eBay account, eBay notifies us and we delete the connection.

Payment Information

Payments for the Pro plan are handled by Stripe (Stripe Checkout and the Stripe Customer Portal). We never see or store your card number. We store your Stripe customer and subscription IDs, your plan and subscription status, and your billing history (amounts, dates and invoice links). Stripe processes payment information under its own privacy policy.

Rate Limiting

Card search and prices work without an account. To prevent abuse, we count requests per signed-in user, or per IP address for guests. These counts are kept for 7 days.

Error Reports

We use Sentry to find and fix errors. When something breaks, Sentry receives technical details about the error (such as the page, browser and device) along with your user ID and plan. We do not send your email address. For 10% of sessions that hit an error, Sentry also records a replay of the page; all text and form inputs are masked and images and media are blocked.

We do not use analytics or advertising trackers.

2. How We Use Your Information

We use your information to:

• Provide our service: Track your collection and its value, binders and trades, and, if you connect eBay, create listings and record sales for you
• Manage your account: Authenticate you, manage your subscription, and communicate with you
• Keep the service working: Fix errors and prevent abuse
• Process payments: Handle subscription billing through Stripe
• Customer support: Respond to your questions and resolve issues

Card prices shown in ShipSync come from TCGplayer and public eBay data; we do not send your personal data to TCGplayer to get them.

3. Data Storage and Security

Your data is stored using:

• Supabase: Your account and collection data, and your encrypted eBay tokens, are stored in Supabase's database in the United States (US East)
• Stripe: Payment and subscription data is processed and stored by Stripe
• Browser Storage: Your sign-in session and app preferences are kept in your browser's localStorage, and a service worker caches the app for offline use

4. Service Providers

We share your information only with the providers that run ShipSync:

• Supabase: Database, authentication and server functions
• Cloudflare Pages: Website hosting
• Stripe: Payment processing for Pro subscriptions
• eBay: Only if you connect your eBay account, and only what's needed for the listings and sales you ask ShipSync to handle (listing details and photos you choose to send)
• Sentry: Error monitoring, as described above
• Google Fonts: Fonts are loaded from Google, which receives your IP address and browser details when they load
• Google and Discord: Only if you choose to sign in with them

We do not sell, rent, or trade your personal information.

Affiliate links: some links to eBay (and, in the future, TCGplayer) are affiliate links. If you follow one and buy something, ShipSync may earn a commission at no extra cost to you. The link carries our affiliate ID, not your personal information; the retailer may set its own cookies under its own privacy policy.

5. Data Retention and Account Deletion

We keep your data while your account is active. You can delete your account at any time in Settings → Account → Delete account (you'll be asked to type a confirmation). When you do, immediately:

• Your account, profile and settings are deleted
• Your collection, sales, trades, binders and share links, and collection value history are deleted
• Your eBay connection and stored tokens are deleted
• Your subscription records and billing history are deleted from ShipSync
• An active Pro subscription bought on the website is cancelled in Stripe straight away, with no refund for the current period. A subscription bought in the iPhone or Android app is billed by Apple or Google and must be cancelled in your App Store or Google Play subscriptions; the app reminds you when you delete your account.

Deleted data may persist in our database provider's backups for a limited time before those backups expire. We do not restore deleted accounts from backups.

Some records are kept by our providers under their own policies: Stripe keeps its invoice and payment records as required for tax and accounting, and error reports already sent to Sentry expire under Sentry's retention period.

6. Your Rights

You have the right to:

• Access your data: Email us to request a copy of the data we store about you (there is no self-serve export yet)
• Correct your data: Update your collection, settings and profile at any time in the app
• Delete your data: Permanently delete your account and all associated data via Settings, as described above
• Object to processing: Contact us to object to specific data processing activities

7. Cookies and Local Storage

We use:

• Local storage: Your Supabase sign-in session (required to stay signed in) and your app preferences
• Service worker: Caching the app for faster loading and offline use

ShipSync does not set cookies of its own, and we do not use analytics or advertising cookies. You can clear this data in your browser settings, but clearing your session will sign you out.

8. Where ShipSync Is Offered

ShipSync is offered to users in the United States. Your data is stored and processed in the United States. Some of our service providers may process data in other countries under their own policies.

9. Children's Privacy

You must be at least 13 years old to use ShipSync. If you are under the age of majority where you live, you need a parent or guardian's consent to use it. ShipSync is not directed at children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has given us personal information, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the application. The "Last updated" date at the top indicates when this policy was last revised.

11. Contact Us

12. Privacy Rights for U.S. Residents

Some U.S. states, including California, give residents rights over their personal information. Whether or not a particular state law applies to us, we offer every user the same choices:

• Know what personal information we collect, how we use it, and who we share it with (described in this policy), and request a copy of it
• Correct or delete your personal information
• We do not sell your personal information or share it for targeted advertising
• We will not treat you differently for exercising these choices

To make a request, email us at [email protected] from the email address on your account.