Privacy policy

The data controller is Oskar Kurek, ul. Tykocińska 23, Warsaw, Poland, contact: kontakt@tcgx.pl.

Account (optional, on sign-in): email, first name, last name, birth year, Pokémon Player ID, screen name.

Google or Discord sign-in: the provider gives us your email address and account identifier. We never see your password or any other data from that account.

Email code sign-in: the address we send the one-time code to.

Data you create: tournaments, decklists, card collection, game records - linked to your account.

Technical data (only after analytics consent): IP address, device/browser info, pages visited - collected by Google Analytics in aggregate form.

Running your account and site features (tournaments, collection, records) - necessary to provide the service (Art. 6(1)(b) GDPR).

Traffic analytics to improve the site - based on your consent (Art. 6(1)(a) GDPR). Without consent, analytics is off.

Strictly necessary: login session cookie (Supabase) - required to stay signed in. No consent needed.

Functional: remembering language and currency; game records and preferences in browser storage (localStorage). Used only to run the site.

Analytics: Google Analytics - set ONLY after your consent (cookie banner). Off by default (Google Consent Mode).

Security: the sign-in screen may run Cloudflare Turnstile (bot protection). It stores a short-lived verification token, required for sign-in to work; it is not used for tracking.

We use Google Analytics 4 (Google Ireland Ltd.) for traffic statistics. The script runs in Consent Mode - until you consent, it sets no cookies and collects no identifying data.

You can withdraw consent at any time (see the consent section).

Supabase (database and auth hosting) - as a processor under a data-processing agreement.

Brevo (Sendinblue) - delivery of sign-in code emails; receives only your email address and the message.

Google and Discord - if you sign in with their account (identity providers).

Cloudflare - if bot protection is enabled on the sign-in screen.

Ko-fi - the support button is a plain link; nothing loads from their server until you click it. Clicking takes you to Ko-fi, where their policy applies. (On the Polish version of the site the same button points to buycoffee.to.)

Google (Analytics) - only after your consent.

We do not sell data. Card data is fetched from external sources onto OUR server outside your visit - while browsing you never connect to them and we share nothing about you with them.

Account data - until you delete your account or request removal. Analytics data - per Google Analytics settings.

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent at any time. You may also lodge a complaint with your data protection authority.

You give (or reject) analytics consent in the cookie banner. You can change it anytime via the “Cookies” link in the footer - the banner reopens.

For data matters: kontakt@tcgx.pl.