1. Data controller
The MyTCGPrice website (www.mytcgprice.com) is published by MyTCGPrice, based at Enghien-les-Bains, France.
For any question regarding your personal data: contact@mytcgprice.com
2. What we collect and why
MyTCGPrice only collects the data needed to operate. No data is ever sold or transferred to third parties for commercial purposes.
a) User account
- Data
- email address, password, username, chosen avatar, creation date and last login date.
- Purpose
- to create and secure your account and let you sign in.
- Legal basis
- performance of a contract (the terms accepted when creating the account).
- Important
- your password is never stored in clear text. Only a cryptographic hash (scrypt) is kept; it cannot be reversed to recover the original password.
- Signing in with Google
- if you choose “Continue with Google”, all we receive from Google is your email address and a technical identifier tied to your Google account, used to recognise you from one sign-in to the next. Your name, photo, contacts and any other Google account data are not shared with us, and we have no access to any Google service on your behalf. You can revoke this access at any time from your Google account settings; set a password on MyTCGPrice first so you can still sign in. No Google script is loaded on the sign-in pages: nothing is sent until you click the button.
b) Your collection and your balance
- Data
- cards added, quantities and history of your collection's total value. For “My balance”: the purchases you enter (product, quantity, price paid and currency, date) and the cards you link to them. These amounts stay private: other members only see them if you choose to share an opening session in the Dojo.
- Purpose
- to provide the collection tracking and balance features you use.
- Legal basis
- performance of a contract.
c) The Dojo: XP, belts and member profile
- Data
- XP earned and history of rewarded actions (page views, collection additions, shares…), belt, day streak and claimed trainings. If you turn them on yourself: member-visible profile, shared dupes, shared collection value and stated region.
- Purpose
- to run the Dojo (progress, leaderboard) and, at your request, show your profile to other members. Your username, belt and XP may appear on the Dojo leaderboard.
- Legal basis
- performance of a contract; consent for the member-visible profile and sharing, which you can turn off at any time from your account page.
d) Dojo posts
- Data
- displayed username, shared card, optional comment, optional free-text location.
- Purpose
- to display cards shared by the community.
- Legal basis
- performance of a contract.
- Please note
- these posts are visible to every signed-in member of the site (the Dojo and profiles require an account; they are not open to visitors without an account or to search engines). Do not include anything you would not want other members to see.
e) Abuse prevention
- Data
- a hash of your IP address.
- Purpose
- to limit spam and automated posting.
- Legal basis
- legitimate interest (protecting the service and its users).
- Important
- your IP address is never stored in clear text. Only a salted SHA-256 hash is kept, which cannot be traced back to the original address.
f) Email contact
If you write to us, your email address and the content of your message are used solely to reply to you. Legal basis: legitimate interest (answering your request).
3. Retention periods
- Account, collection and Dojo progress
- kept for as long as your account exists. They are deleted immediately and permanently when you delete your account.
- Dojo posts
- deleted at the same time as your account.
- Verification and reset tokens
- a few hours, then they expire automatically.
- Anti-spam IP hashes
- kept for as long as needed to limit abuse.
- Email exchanges
- for as long as needed to handle your request.
3 bis. Your shop orders
If you place an order in the shop, your cart is kept in a session cookie on this site for the duration of your visit. It contains only product references and quantities.
At checkout you are redirected to the secure page of Shopify, acting as our processor for payment, order management and shipping. That is where your delivery details and payment data are entered: they do not pass through our servers and are never stored there.
Order data (name, delivery address, email, order contents and amount) is kept by that provider on our behalf, and by us under our accounting obligations, for ten years from the end of the financial year. The carrier Mondial Relay receives only the information needed for delivery.
4. Who has access to your data
Your data is hosted on a server rented from OVH, located in the European Union. No one other than the site's publisher has access to it.
Technical providers are involved:
- Email delivery
- address verification, password reset: OVH RoundCube.
- Shop and payment
- Shopify International Limited (Ireland): payment page, orders, shipping. Payment data is handled by its banking providers, never by us. See the Your orders section.
- Delivery
- Mondial Relay: name, contact details and chosen pickup point, to deliver the parcel.
- Signing in with Google
- Google Ireland Limited, only if you use this sign-in method. The exchange happens between our servers and Google's; this service may transfer data to the United States under the EU–US Data Privacy Framework.
- Audience measurement
- Google Analytics, provided by Google Ireland Limited. This service may transfer data to the United States under the EU–US Data Privacy Framework.
Displayed prices come from external sources (TCGplayer, eBay, Cardmarket). These sources provide market data only: no data about you is sent to them.
5. Cookies and analytics
Necessary cookies: MyTCGPrice sets a session cookie to keep you signed in and remember your language. These cookies are essential to the site and do not require your consent.
Analytics: the site uses Google Analytics to understand traffic. This service sets cookies which do require your prior consent.
You can configure your browser to block cookies at any time, or use the opt-out add-on provided by Google.
6. Your rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Access
- to know what data we hold about you.
- Rectification
- to correct inaccurate data. Your username, avatar and password can be changed directly from your account page.
- Erasure
- to delete your account and all your data. You can do this yourself and immediately from your account page, without contacting us.
- Portability
- to receive your data in a machine-readable format.
- Objection and restriction
- to object to certain processing or ask that it be restricted.
To exercise a right that is not directly available from your account, write to contact@mytcgprice.com. You will receive a reply within one month at the latest.
7. Lodging a complaint
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
8. Security
The site is served over HTTPS only, passwords are hashed (scrypt) and IP addresses are kept as hashes only. No online service can, however, guarantee absolute security.
9. Minors
Creating an account is reserved for people aged 15 or over. Below that age, the consent of a parent or legal guardian is required.
10. Changes
This policy may change. Registered users will be informed of any significant change.
