Privacy Policy

Last updated: 2026-10-07

Telmo Filipe Ribeirinho Pereira, sob a designação comercial TCG Community Hub, located at Rua da Rapadoura, nº3, 4930-000 Valença, Portugal, is the controller for personal data processed through this service.

This Privacy Policy explains what personal data we process when you use TCG Community Hub, why, who receives it and what choices you have.

We do not sell personal data, show third-party advertising, or use analytics or advertising trackers.

1. Data we collect

Account and sign-in data (name, email, password hash, two-factor settings); profile and settings (avatar, bio, language, currencies, active games, discovery area); your cards, binders, decks, wishlists and wanted lists; trades, local sales, orders, pickup, consignment and settlement records; listing and card-condition photos and other uploads; games, matches, tournament and league registrations, pairings, results and ratings; community activity (posts, comments, likes, follows, RSVPs and chat messages); business, store and staff details for professional users; bug reports (description, page address, browser details and optional screenshots); push-notification subscriptions (device name and browser details); and technical data such as IP address and logs needed to run and secure the service.

2. Legal bases for processing

Depending on the feature, we process data to perform our contract with you (providing the features you use), for our legitimate interests (security, abuse prevention, improving the service), to meet legal obligations (for example tax and payment records) and, where required, with your consent (for example camera, microphone, current location and push notifications, which you can withdraw at any time).

3. How we use data

We use data to provide and secure the service; show local and community results first; run games, tournaments, leagues and rankings; operate pickup and marketplace transactions; document custody and settlement workflows; send the notifications you enabled; enable Stripe onboarding; detect abuse; comply with legal obligations; and fix problems you report.

4. What other people can see

Your public player profile, public decks and binders, and your place on leaderboards are shown only if you turn on your public profile. Posts and comments on public store pages, events, leagues and tournaments are visible to anyone who can open that page, together with your name and avatar; likes and follows are shown as totals. Tournament and league participants and organisers see registrations, pairings, results and standings. Shared links (wishlists, wanted lists, decks) can be opened by anyone who has the link.

5. Location and local discovery

Discovery is local and community focused by default. If you choose "use current location", the browser supplies coordinates for that request and nearby-distance filtering only. You may separately save a discovery centre, region, country and radius in Settings. Public business, event, tournament, playgroup, pickup or meeting locations may be shown to other users as part of the feature. Your shipping address is never used as your live device location.

6. Digital Table and webcam play

When you play, we process the game you create or join (format, mode, opponent, decks used, game actions and state, round-clock times, result and reason) and the in-game chat. These records are kept with your account to show your games, results and ratings and to handle reports of abuse, for as long as they are needed for those purposes. Camera and microphone are used only after you allow them in your browser. Video and audio travel directly between players over encrypted WebRTC connections or, when needed, through an encrypted TURN relay; we do not record or store them unless an organiser starts a broadcast. A card-back image you upload to a deck is stored with that deck and shown to your opponents.

7. YouTube, Twitch and live chat

When an organiser connects YouTube or Twitch, we store the channel identifier and name and encrypted OAuth tokens, and use YouTube API Services or the Twitch API only to create and manage the broadcasts they request and, if enabled, to read the live chat of that broadcast. Chat messages (author name and text) are relayed to the producer studio while the broadcast runs and are not stored afterwards. Players shown in a broadcast are visible to its viewers. We do not use this data for advertising. Access can be revoked in the producer panel or from your Google (myaccount.google.com/permissions) or Twitch account settings.

YouTube Terms of Service · Google Privacy Policy · Twitch Terms of Service

8. Emails and push notifications

We send account and transactional emails (verification, password reset, orders, invitations). Push notifications are sent only to devices where you allowed them; you choose which kinds you receive in Settings (for example tournament rounds, league updates, posts from stores you follow or comments on store posts). Push messages are delivered through your browser vendor's push service.

9. Payments

Payment operations are handled by Stripe and Stripe Connect under their own terms and privacy notices. We store only the payment status and identifiers needed to manage platform workflows; we never receive your full card number.

10. Service providers and data sharing

We use service providers acting on our behalf: Amazon Web Services for hosting and file storage in the European Union (Spain); our email provider; Stripe for payments; your browser vendor's push service; and STUN/TURN servers for live video. Loading pages also contacts content networks for icons, fonts and scripts (Font Awesome, Bunny Fonts, jsDelivr, cdnjs), which receive your IP address and browser details. Card, price and product data providers (such as Scryfall or OpenTCG) receive search requests from our servers, not your personal data. Transaction participants and an accepted drop-off business receive the listing, pickup, custody, order and settlement information needed for their role. We may also disclose data when required by law.

11. Data retention

We keep personal data only for as long as needed to provide the service, meet legal obligations, resolve disputes, prevent fraud and enforce agreements. When you delete your account, your profile and private data are removed; records that other users or the law depend on (such as completed sales, tournament results and pairings) may be kept in anonymised or minimal form.

12. Security

We use encryption in transit, encrypted storage of integration tokens, access controls, optional two-factor authentication and other safeguards. No method of storage or transmission is fully secure, but we keep improving our controls.

13. International data transfers

Our main hosting is in the European Union. When a provider processes data outside the European Economic Area (for example Stripe, Google or Twitch), we rely on appropriate safeguards required by applicable law, such as standard contractual clauses.

14. Your privacy rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, to data portability and to withdraw consent. You can edit your profile, change your visibility and notification settings, and delete your account yourself in Settings; for anything else contact us. You may also complain to your local data protection authority.

15. Cookies

We use only essential cookies for sign-in, security (CSRF protection), session continuity and the shopping cart. We do not use analytics or advertising cookies.

16. Storage on your device

The app also keeps some settings in your browser (for example Digital Table preferences, phase stops, auto-yields, panel positions and the last tab you opened) and, when installed as an app (PWA), caches static files such as scripts, styles and images so it loads faster. You can clear this at any time in your browser settings.

17. Children and minors

The service is not directed to children under the minimum age required by local law to consent to data processing. If we learn that we hold data from a minor without valid consent, we will delete it.

18. Policy updates

We may update this Privacy Policy to reflect legal, technical or product changes and will show the date of the latest change at the top.

19. Contact

For privacy requests or data protection questions, contact: support@tcgcommunityhub.com