Privacy policy
Web, Android and iOS · Trading Cards Tracker · Version 13 October 2026
Controller and contact
Gonzalo Del Cotillo Sánchez
León, España
tradingcardstracker@proton.me
| Aliases, ratings and review messages | Your alias identifies you to other collectors in trades and the forum; your private name and email are not shown. After a completed trade, each participant can rate the other from 1 to 5. The average and number of ratings are shown in the authenticated trading area. Deleting your account removes the ratings you received; ratings you gave other accounts are retained without your identity or the proposal reference. Your photo approval or rejection summaries are private to you and are deleted with your account. |
|---|---|
| Google sign-in and registration protection | You can choose Google to sign in or create an account. We receive your account identifier, name and verified email, without accessing Gmail, contacts or files. We retain the link until you delete your account. Password registration uses Google reCAPTCHA when enabled; Google receives technical connection and device data to prevent abuse. These features are independent of Google Analytics. Also consult Google’s privacy policy and terms. |
| Account language and activity | We save the language you choose for your account and communications. Administrators can view counts of collections, cards, wishes, contributions and trades, recorded activity and the last sign-in to manage the service. These summaries do not show message contents or browsing histories. Records linked to your account are deleted with it. |
| Photos and account deletion | Deleting an account removes personal data and the link to contributions. Approved editorial photos supplied by administrators, including historical contributions authorised by the catalogue owner, and approved photos with a retention licence will remain in the catalogue. Other photos will be deleted. The new terms do not apply retroactively to other users’ contributions. You may request removal from the controller listed on this page by identifying the card and photo, even without an account. Copyright, third-party licences and data protection rights remain respected; backups have limited retention and are not public. |
| Suggestions and achievements | Issues and suggestions include private conversations between their author and administrators. Replies and status changes generate notifications in My messages. The team can also send you personalised private messages. These threads, messages and notifications are deleted when you delete your account. Achievements are calculated from your own approved contributions and are private. We do not publish user rankings. |
| Optional website metrics | If you allow this in Cookies, we count views and actions by section and day for up to 400 days. These counters do not store accounts, IP addresses, device identifiers, searches or private content. They do not represent unique visitors. You can disable them in Cookies. They are not sent to external providers and native apps do not send these metrics. |
| Profile photo | Your profile photo is optional. It is shown to participants in your conversations, not in the public catalogue. You can change or remove it in Settings. It is stored with your account and in backups for their retention period. |
| Data and purposes | We process names, email addresses and protected credentials to manage accounts; quantities, favourites and history for your personal archive; and photos and their provenance to review and publish contributions. Session data and technical logs help protect the service. We do not use this data for advertising or automated decisions with legal effects. |
| Legal bases | Account and archive management provides the service you request (Article 6(1)(b) GDPR). Security and abuse prevention rely on the legitimate interest of protecting the service (Article 6(1)(f)). Voluntary photo contributions require acceptance of their specific terms, except for the administrative editorial workflow. Uploading photos is not required to use the catalogue. |
| Email and notifications | When email is enabled, we use Resend to send recovery links, verification links and security notices to your account address. Unread message notifications require a verified email address and must be enabled in Settings; you can turn them off there at any time. The provider receives the recipient address and email content, without chat transcripts or private information about the other participant. Open and click tracking is disabled. |
| App notifications | If you enable Android notifications in Settings and grant permission on your device, we use Expo and Google Firebase Cloud Messaging to deliver them. These services receive a device notification identifier and a generic notice, without your conversation text or private information about the other participant. We store the identifier linked to your session to manage delivery; you can disable it in Settings, and it is removed when you sign out or your session is revoked. |
| Publication and recipients | Approved photos are displayed publicly. Quantities and favourites are private, except for offers and lists you choose to share through Trading. Hosting and infrastructure providers may process data to deliver the service. Price queries run on the server; external links are subject to the destination website's policy. Providers, locations and transfer safeguards are detailed in the infrastructure section. |
| Your rights | You may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent without affecting prior processing. Contact the controller using the email provided. You can delete your account from Settings. You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). |
| Mobile applications | Android and iOS use the same backend and purposes. Session credentials are stored in the device's secure storage. Camera or library access is requested when you choose that feature; you can revoke it in system settings. We do not request continuous location access or use advertising SDKs. |
| Catalog views | We count card views by day to prioritize price updates. These counters store no accounts, IP addresses or visitor identifiers, use no cookies, and are visible only to administrators. They do not represent unique visitors. |
| Trading and shared lists | Cards marked for trade enable matching. When preparing a trade, signed-in users can browse the entire collection and free copies of a collector who offers cards, or someone with whom they already have a conversation. Unmarked cards can also be requested; their owner decides when accepting the proposal. Only the public alias is shown, never the private name or email address. We retain messages, proposals and confirmations to provide trading between the participants; these are deleted when either participant deletes their account. Lists are only published through an owner-activated, revocable link. Anyone with that link can view the shared cards. No payments are processed. |
| Optional app statistics | If you accept, we send Trading Cards Tracker counts of screen views and actions such as updating quantities or favourites, submitting suggestions or contributing photos. We only store the day, Android or iOS, action type and section; no names, emails, messages, search text, cards or device identifiers. We do not use Google Analytics or advertising in the app. You can reject and continue using the whole app. Your choice is remembered on this device for 180 days and can be changed in Settings → Privacy and statistics. Aggregate counters are kept for 400 days; they cannot identify or remove an individual contribution. Technical service logs follow the Privacy policy. |
| Optional website analytics | With your consent, Google Ireland Limited provides Google Analytics through Tag Manager to measure visits, sessions, traffic sources, devices and feature use. Cookie identifiers and technical data are processed; we do not send account identity, messages, search text or personal inventories. Google receives the network connection; according to its documentation, GA4 does not log or store IP addresses. Processing may involve international transfers under Google’s terms and safeguards. User and event data are retained for up to 14 months without resetting on activity; aggregate reports have separate retention. You can withdraw consent in Cookies; Android and iOS do not include this tracking. |
| Traffic sources and registrations | On the website, with your permission, we measure whether you arrive from TikTok and complete registration with email or Google. Campaign attribution is kept in this tab for up to 30 minutes of inactivity and removed when you withdraw permission. We do not use the TikTok pixel or store its click identifiers. |
Infrastructure and transfers
Google privacy and data processing
Alojamiento: Hetzner Online GmbH. La aplicación, PostgreSQL y las fotografías se alojan en Núremberg, Alemania. DNS e infraestructura: Cloudflare, Inc. gestiona el DNS y el receptor técnico de bajas de eBay. Las copias de seguridad se guardan cifradas con restic en un bucket privado de R2 con jurisdicción UE; no sirve las fotografías públicas. El proxy de la web de Cloudflare no está activado. Correo transaccional: Resend, Inc. envía recuperación, verificación y avisos de seguridad. El dominio utiliza la región de envío de Irlanda; esta selección no garantiza que todos los datos del proveedor permanezcan en la UE. Resend puede tratar datos en Estados Unidos. El seguimiento de aperturas y clics está desactivado. Resend y Cloudflare publican acuerdos de tratamiento y cláusulas contractuales tipo para las transferencias internacionales que correspondan: https://resend.com/legal/dpa y https://www.cloudflare.com/cloudflare-customer-dpa/ . Información de Hetzner: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/ . Puedes solicitar información sobre los proveedores y las garantías al correo de privacidad. Las comunicaciones dirigidas al correo de privacidad se reciben mediante Proton Mail, Suiza. Las consultas de precios a eBay se hacen desde el servidor sobre cartas del catálogo, sin enviar tu email ni tu colección privada. Los enlaces externos están sujetos a las políticas de sus destinos.
Retention
Los datos de cuenta, cantidades, favoritos y preferencias se conservan mientras la cuenta esté activa. Puedes eliminarla desde Ajustes; se retiran los datos personales y el vínculo con tus aportaciones conforme a la política de eliminación publicada. Las fotografías aprobadas con autorización de conservación pueden permanecer en el catálogo sin identificar al aportante, respetando sus licencias y las solicitudes de retirada que correspondan. Las aportaciones sin esa autorización se eliminan según la política de cuenta y moderación. Los enlaces de recuperación y verificación caducan a los 30 minutos. Los registros de retos caducados se limpian tras siete días; los trabajos de correo finalizados y recibos técnicos se limpian a los treinta días. Los proveedores de correo aplican también sus propios períodos de conservación. Las copias de seguridad son privadas y cifradas. En esta fase inicial la purga automática está desactivada y su conservación se revisa manualmente para permitir la recuperación del servicio; no prometemos una eliminación automática de las copias a los treinta días. No se usan para consultar perfiles ni enviar mensajes. Puedes contactar con privacidad para ejercer tus derechos, también respecto de información presente en copias.
Cookies and local storage →