Last updated 23 October 2026

TCG Vendor is made by Critical Hit Collectables Ltd (“we”), registered in England and Wales, company number 16296003. Registered office (not for returns or post about orders): Adams & Company Accountants Limited, 3C Holborough Road, Snodland, Kent, ME6 5NL. This policy covers the TCG Vendor app; our shop at criticalhitcollectables.co.uk has its own privacy policy. We collect only what we need to run your account and the service. There are no adverts and no tracking across other apps or websites, and we never sell your data.

Your account

To use TCG Vendor you sign in with Apple, Google or your email address. We keep your email address, a user ID and which sign-in method you used, so we can sign you in and apply your plan. If you use Sign in with Apple and choose to hide your email, we only see Apple’s private relay address. We do not receive your Apple or Google password. Accounts are run on Supabase, which stores this data for us in the EU.

Subscriptions

If you subscribe to TCG Vendor Pro, payment is handled entirely by Apple (App Store) or Google (Google Play). We never see your card or bank details. We use RevenueCat to check whether your account has an active subscription; it receives your user ID and the purchase receipts from Apple or Google, but not your name or email.

Crash reports

When the app or our server hits an error or crashes, a report is sent to Sentry (sentry.io), which stores it for us in the EU (Frankfurt). A report contains the error and where in the code it happened, your device model, operating system and app version, and the last few screens you visited and requests the app made. It does not contain your name, email address, account ID, IP address or scan photos. Reports are kept for no more than 90 days.

Shop, Shopify and eBay connections

If you connect your eBay seller account (Pro), you sign in on eBay’s own page. Our server keeps the sign-in it receives (encrypted) and your eBay user name, so it can list your stock and fetch your orders; it never sees your eBay password. Your eBay orders, including the buyer’s eBay user name, are passed straight to your phone for your records and are not kept on our server. Disconnecting eBay in the app, deleting your account, or closing your eBay account removes the sign-in. If you connect a WooCommerce shop, its API keys are kept only in your phone’s secure storage and are only ever sent to your shop. If you connect a Shopify shop (Pro), you approve TCG Vendor in your Shopify admin. Our server keeps the sign-in Shopify gives it (encrypted), so it can add products, set stock levels and prices and fetch your orders; it never asks Shopify for your customers’ details. Disconnecting, uninstalling the app in Shopify, or deleting your account removes the sign-in. Orders from your shops are passed straight to your phone for your records and are not kept on our server; a WooCommerce order includes the buyer’s name, a Shopify order does not.

Anonymous statistics

If you leave “Share anonymous deal statistics” on (Settings), the app sends the cards you add to deals with their finish, condition, market value and the offer you make or pay. Our server also counts which cards are scanned and priced each day. These records are stored without your account, user ID or any other identifier, so they can’t be linked to you, and we use them to improve prices and the app.

Usage counts

On the free plan we count how many different cards you price each day, so we can apply the daily allowance. We store your user ID, the date and the card ID, and delete these records after 7 days.

Camera images

When you scan, the app crops the photo to the card in the frame and sends that image securely (HTTPS) to our server, which identifies the card and returns it. Images are processed in memory and discarded straight away. We do not store them, look at them, share them or use them to train anything. If you scan with no signal, the cropped photo is kept on your phone only until it can be identified, then deleted.

A random app identifier

The app creates a random identifier the first time it runs and sends it with each request to help stop any one device overloading the service. It is not linked to your device hardware or any advertising identifier, and is deleted if you delete the app.

Server logs

Like any web service, our server records technical details of requests (IP address, time, the request made and the app version) to keep the service secure and working. These logs are kept for no more than 30 days.

Stored on your device only

Your stock, collection, books (purchases, sales and expenses), trades, shows, saved prices and settings are stored on your phone, not on our server. Backups you make are saved wherever you choose to put them (for example iCloud Drive or Google Drive). You can delete everything on the phone in Settings → Your data, or by deleting the app.

Other services

Card pictures are loaded directly from TCGdex (assets.tcgdex.net), which will see your IP address when your device downloads an image. Prices come from third-party market data providers, which our server asks for the card being priced only, never anything about you. Links you choose to open open in your browser under that site’s own privacy policy.

Deleting your account

You can delete your account at any time in Settings → Account → Delete account. This permanently deletes your account, your usage records and your subscription record with RevenueCat. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play settings first, or you will keep being charged.

We process your account data to provide the service you signed up for (contract), and server logs to keep it secure (legitimate interests). Under UK data protection law you can ask for a copy of your data, or ask us to correct or delete it. Contact [email protected]. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Children

TCG Vendor is a business tool and is not directed at children under 13.

Changes

If we change how the app handles data we will update this policy and the date above before the change takes effect.

Back to top