Privacy notice

The controller for the processing described here is reachable at info (at) pokemontcgapi.com.

Raw request lines are kept for a limited time and then deleted. Aggregated counters — requests per key per day, error rates per endpoint — outlive them because they carry no IP address and no request id, and they are what a plan is billed against.

Billing records are kept for as long as tax law requires, which is a longer period than anything else on this page.

Photos sent to /v1/vision/identify or /v1/centering/measure are processed to produce the response and are not kept as stored uploads. Large multipart uploads may use temporary files while the request is handled; those files are removed at the end of the request.

The centering service processes the image and geometry in memory, disables its image cache and sends responses with Cache-Control: no-store. Recognition computes photo signatures in memory; its persistent signature index comes from catalogue images, not your uploads. Its OCR service processes image crops in memory without saving images or logging the text it reads.

The API request log records the route, status, response size in bytes and processing time, never the image or centering geometry. Keep the reviewed geometry in your own app if you need it for confirmation.

No collection data of any kind. The API has no endpoint that accepts a card list, a portfolio, a wishlist, a deck or a valuation. We cannot know which cards you own, look up or care about beyond the fact that a request for a card id passed through a log line, and that line is deleted with the rest.

No advertising identifiers, no fingerprinting, no data sold or shared with anyone for their own purposes, and no profiling or automated decision-making.

This website sets two cookies, both first-party and both httpOnly, so no script on the page, ours included, can read them. It sets no third-party or advertising cookies and runs no analytics script.

ptcgapi_attribution is set when you arrive from another website or through a link that carries campaign parameters, and not otherwise. It records how you found us: the host name of the referring site (never its full address), the utm_source, utm_medium, utm_campaign and utm_content labels if the link had them, the path of the page you landed on without its query string, and the time — once for the first such arrival and once for the latest. It holds no identifier for you or your browser. It expires seven days after the first arrival and later visits do not extend it. If you create an account within those seven days, its contents are sent with the signup and kept against the account, so that we know which channels bring people here; if you do not, it expires unused.

ptcgapi_session is set when you sign in or create an account, and holds the session token that keeps you signed in on the account pages. It is sent only to this site, over HTTPS, and it is cleared when you sign out or when the session ends.

Apart from those, the site writes one value into your browser: a localStorage key called ptcgapi-theme, holding light, dark or system, so the theme you pick survives a reload. It never leaves your browser and we never receive it. Clear your site data and it is gone.

Paid plans are processed by Stripe, which acts as an independent controller for the payment itself and as our processor for the rest. Card numbers are entered on their infrastructure and never reach ours; we keep a customer identifier, the plan, and the invoice history against your account.

The API, the database and the logs run on dedicated hardware in Germany, inside the EU. Nothing is replicated outside it. The exception is the payment processor above, which operates internationally.

If you are in the EU or the UK you have the right to ask what we hold about you, to have it corrected, to have it deleted, to receive it in a portable form, and to object to processing based on legitimate interest. There is one route to all of them.

Mail info (at) pokemontcgapi.com from the address on the account, or quote an API key id or an x-request-id if there is no account. We answer within thirty days, usually the same week. Deletion removes the account, its keys and its aggregated counters; invoices survive only because tax law requires it, and the log lines are already gone or go with it.

You may also complain to your national supervisory authority.

The date at the top is the date this text last changed, and a material change is also recorded, dated, on the changelog — so a notice quietly rewritten is not a thing that can happen here without a line about it.