Privacy Policy

This Privacy Policy explains how TCG Tracker (“TCG Tracker”, “we”, “us” or “our”) collects, uses, discloses and protects your personal information when you use our website, Telegram bot, and related notification services (together, the “Service”). We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

TCG Tracker is operated by TCG Tracker. By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Information we collect

We only collect personal information that we need to provide the Service. This includes:

• Account & identity. Your email address and, optionally, your name or display name, created when you sign up or sign in.
• Telegram information.If you connect Telegram, we receive your Telegram user ID, username, first/last name and language as provided by Telegram's Login Widget and bot, so we can deliver alerts and link your account.
• Authentication data. Sign-in details handled by our authentication provider (for example one-time email codes / magic links, or third-party sign-in if offered).
• Subscription & billing. Your plan, subscription status and a payment-provider customer reference. Payments are processed by Stripe — we do not collect or store your full card number or security code; those are handled directly by Stripe.
• Preferences & settings. The games, products, stores and alert settings you choose, and your notification preferences.
• Usage & technical data. Limited log and device information (such as IP address, browser/device type, pages viewed and timestamps) generated when you use the Service, used for security, diagnostics and aggregate analytics.
• Communications. Messages, requests and feedback you send us.

2. How we use your information

We use personal information to:

• provide, operate and personalise the Service, including delivering stock alerts;
• create and manage your account and authenticate you;
• process subscriptions, payments, renewals and refunds via our payment provider;
• send you service, transactional and account messages;
• respond to your enquiries and provide support;
• monitor, maintain, secure and improve the Service and prevent abuse or fraud; and
• comply with our legal obligations and enforce our terms.

We do not sell your personal information. We do not use your information for unrelated marketing without your consent, and any marketing emails will include an unsubscribe option.

3. Disclosure & third-party processors

We share personal information only as needed to run the Service, with trusted providers acting on our behalf under their own privacy and security obligations:

• Supabase — account database and authentication.
• Stripe — subscription billing and payment processing.
• Telegram — delivery of bot messages and login.
• Resend — delivery of transactional/authentication emails.
• Vercel — website hosting and privacy-respecting, aggregate analytics.

We may also disclose information where we reasonably believe it is necessary to:

• comply with the law, a court order, or a lawful request from a public authority;
• protect the rights, property or safety of TCG Tracker, our users or others; or
• complete a merger, acquisition, financing or sale of assets, in which case information may be transferred as part of that transaction.

4. Storage & overseas disclosure

Our providers may store and process information on servers located outside New Zealand, including in Australia, the United States, the European Union and other jurisdictions. Where personal information is disclosed overseas, we take reasonable steps to ensure it is protected by comparable safeguards consistent with the Privacy Act 2020 (including IPP 12). By using the Service, you acknowledge that your information may be processed in those locations.

5. Cookies & analytics

We use a small number of strictly necessary cookies (for example to keep you signed in and secure your session) and aggregate, privacy-respecting analytics to understand overall usage. We do not use cookies to build advertising profiles of you. You can control cookies through your browser settings, although disabling necessary cookies may stop parts of the Service from working.

6. Data retention

We keep personal information only for as long as necessary for the purposes described in this Policy, to provide the Service, and to meet our legal, accounting and record-keeping obligations. When information is no longer required, we will delete or de-identify it. You can ask us to close your account, after which we will delete or anonymise your personal information except where we are required or permitted to retain it.

7. Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, disclosure or alteration — including encryption in transit, access controls and reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Under the Privacy Act 2020 you have the right to request access to, and correction of, the personal information we hold about you. You may also ask us to delete your account or update your preferences. To make a request, contact us at kizmetsol@proton.me. We may need to verify your identity before actioning a request, and will respond within the timeframes required by law.

9. Children

The Service is not directed at children and is intended for users aged 16 and over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will take steps to delete it.

10. Third-party sites

The Service links to third-party websites, including online retailers and store listings. We are not responsible for the content, products or privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be notified through the Service or by email where appropriate. Continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact & complaints

For any privacy question, request or complaint, contact our privacy contact at kizmetsol@proton.me. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz.