Privacy Policy
Last updated: October 2026
The deck builder works without an account. Use it that way and we never learn who you are: no sign-up, no profile, no tracking analytics, no ads, no tracking pixels. If you choose to create an account, we store the little we need to run it. Here's exactly what happens either way.
Without an account
Nothing personal. We don't ask for your name or email, there's no contact form that stores data, and we don't build a profile of you. Without an account, your deck lives only in your own browser (see below); decks you save to your account are stored on our server.
With an account
- Your email address: to verify the account, let you sign in, and reset your password. Nothing else. We don't send marketing.
- A username: shown to other users when you share a deck.
- Your password, hashed: a one-way scramble (bcrypt). We never store or see the password itself, which is also why we can't recover it for you: we can only let you set a new one.
- Your Google account id and email: only if you choose "Continue with Google".
- Your invite code: during closed beta, and who invited you.
- Content you create: decks you save; decks you choose to share with the community (visible to everyone with an account, with your username, the description and the More info text and images you add (images are saved again on our server without their hidden data, such as location), the average rating and how many players opened it); the ratings you give (only the average is shown, never who voted what); and which shared decks you opened in the builder (only the total per deck is shown). If you use groups: the groups you create or join (name, members' usernames, pending invites) and the decks you share in them, visible only to that group's members. If you add them, links to your social profiles, shown on your player page; and any badge we give your account (like Verified), shown next to your username.
Beta waitlist
If you apply for a closed-beta invite, we store the email address you give us and use it for exactly one thing: sending you that invite. No newsletter, no follow-ups. We delete the list when the beta ends, or your entry sooner if you ask us to remove it.
What stays in your browser
To make the tool work, we save a few things in your browser's local storage. This never leaves your device and we can't see it:
- The deck you're building and its name
- Your format/filter preferences and your light/dark choice
- If you have an account: which of your saved decks is open in the builder
- The daily currency rate and meta-deck list (cached to avoid re-downloading)
Your browser also keeps its usual cache of the files it downloads from us (pages, fonts, card data), like on any website. You can clear all of it any time via your browser's "clear site data", or by clearing the deck in the app.
Cookies
One cookie, and only if you have an account: TCGSESS, which keeps you signed in for up to 30 days.
It's strictly necessary for a feature you asked for, so no consent banner is required. We use no tracking or
advertising cookies. There is nothing to consent to, so we don't ask.
Anonymous visit counts
To know how the site is doing, we count visits without tracking anyone. When a page opens, your browser tells our
server which page it was, the site you came from (or a campaign tag like ?ref=) and your time zone,
which we turn into a country. We keep only daily totals: page views, visitors, where visits came
from and which countries.
To count each visitor once per day, the server mixes your IP address and browser type with a random value that changes every day and keeps only a one-way hash of the result. The next day the hash and that random value are deleted, so the totals can never be linked back to you. No cookies, nothing stored on your device, no profile, no third party involved.
Your IP address
Three places, all unavoidable and all short-lived:
- Anti-abuse counters: so nobody can sit there guessing passwords or burning through invite codes. These hold your IP (and, on the sign-in and password-reset forms, a one-way hash of the email typed) for about two hours at most; an hourly clean-up deletes them.
- Visit counts: only inside the daily one-way hash described above, deleted the next day.
- Server logs: the standard access logs our host (Hostinger) keeps for a limited time to run and secure the server, as every web server does. We only look at them to investigate abuse.
Separately, the third-party services below see your IP simply because your browser talks to them directly.
Third-party services
Card data, prices and the site's fonts are served from our own server: we collect the card data and prices once a day from the public pokemontcg.io dataset, without sending anything about you.
A few things still load straight from other services. As with any web request, they can see your IP address and standard request info. We don't send them anything about you beyond the request itself:
- Scrydex: card images
- Limitless TCG: tournament decklists and Pokémon icons
- Frankfurter and ExchangeRate-API: the daily USD→EUR rate for card prices
- Cardmarket and TCGplayer: price links, contacted only if you click them
And these handle account data on our behalf:
- Hostinger (EU): hosting and the database.
- Brevo (France): sends the account emails (verification, password reset) and the beta invite. They receive your email address to deliver them.
- Google (USA): only if you use "Continue with Google".
Hostinger and Brevo keep data in the EU. Google is in the US: that transfer relies on the EU–US Data Privacy Framework. Please refer to each service's own privacy policy for how they handle requests.
Why we're allowed to hold this, and for how long
We process account data to provide the service you signed up for (GDPR art. 6(1)(b), contract), we keep the anti-abuse counters because a login form without them gets brute-forced and count visits anonymously to know how the site is used (both art. 6(1)(f), legitimate interest), and we hold beta-waitlist emails because you asked us to contact you (art. 6(1)(a), consent).
- Account data: until you delete your account, then it's gone.
- Beta-waitlist email: until the beta ends or you ask us to remove it.
- Email verification links: expire in 24 hours. Password reset links: 1 hour.
- Anti-abuse counters: about two hours at most.
- Visit counts: the daily hash is deleted the next day; the daily totals, which contain nothing about you, are kept.
Your rights
From your profile you can export everything we hold about you as a JSON file, or delete your account permanently, both without asking us. You can also contact us for access, correction, erasure, to restrict or object to how we process your data, or to withdraw your consent for the beta waitlist at any time. If you think we've handled your data badly, you can complain to the CNPD, the Portuguese data protection authority.
Age
The deck builder is a card-game utility, safe for all ages, and needs no account. Creating an account requires you to be 16 or older.
Changes
We'll update this page when the policy changes, and flag significant changes on the site. If we ever add something that needs your consent, we'll ask first rather than assume.
Contact
Questions about privacy, or want your data? Reach out at contact@tcgwrap.com.