Privacy notice

The controller for the processing described here is [OWNER: legal entity name and registered address of the controller] reachable at [email protected]. [OWNER: whether a Data Protection Officer is required and, if so, their contact]

Raw request lines are kept for [OWNER: retention period for raw request logs — proposed: 30 days] and then deleted. Aggregated counters — requests per key per day, error rates per endpoint — outlive them because they carry no IP address and no request id, and they are what a plan is billed against.

Billing records are kept for as long as tax law requires, which is a longer period than anything else on this page. [OWNER: statutory retention period for invoices in the chosen jurisdiction]

No collection data of any kind. The API has no endpoint that accepts a card list, a portfolio, a wishlist, a deck or a valuation. We cannot know which cards you own, look up or care about beyond the fact that a request for a card id passed through a log line, and that line is deleted with the rest.

No advertising identifiers, no fingerprinting, no data sold or shared with anyone for their own purposes, and no profiling or automated decision-making.

This website sets no cookies and runs no analytics script. Nothing on it needs a consent banner, which is why it does not have one.

It writes exactly one value into your browser: a localStorage key called ptcgapi-theme, holding light, dark or system, so the theme you pick survives a reload. It never leaves your browser and we never receive it. Clear your site data and it is gone.

Paid plans are processed by Stripe, which acts as an independent controller for the payment itself and as our processor for the rest. Card numbers are entered on their infrastructure and never reach ours; we keep a customer identifier, the plan, and the invoice history against your account.

[OWNER: confirm the Stripe entity that contracts with us and that a DPA plus SCCs are signed and linkable]

The API, the database and the logs run on dedicated hardware in Germany, inside the EU. Nothing is replicated outside it. The exception is the payment processor above, which operates internationally.

[OWNER: hosting provider name and data-centre location to publish, plus its DPA reference] [OWNER: the sub-processor list to publish and keep current]

If you are in the EU or the UK you have the right to ask what we hold about you, to have it corrected, to have it deleted, to receive it in a portable form, and to object to processing based on legitimate interest. There is one route to all of them.

Mail [email protected] from the address on the account, or quote an API key id or an x-request-id if there is no account. We answer within thirty days, usually the same week. Deletion removes the account, its keys and its aggregated counters; invoices survive only because tax law requires it, and the log lines are already gone or go with it.

You may also complain to your national supervisory authority. [OWNER: name the lead supervisory authority once the establishment is decided]

The date at the top is the date this text last changed, and a material change is also recorded, dated, on the changelog — so a notice quietly rewritten is not a thing that can happen here without a line about it.