Privacy Policy

1. Who we are

PokéPrice ("we", "us", "our") is a Pokémon TCG price comparison platform at pokeprice.gg. We are operated by an individual based in the Netherlands, acting as data controller, and are subject to the General Data Protection Regulation (GDPR).

Privacy questions and data requests: use the contact form, which reaches us directly, or email privacy@pokeprice.gg. You can also reach us on X at @pokepricegg.

2. What we collect

Most of PokéPrice works without giving us anything. You can browse every card, price, set and guide without an account and without identifying yourself. The data below is collected only in the situations described.

Email address — only if you ask for price alerts

If you subscribe to the watchlist, we store your email address and the cards you are watching. We use double opt-in: the address is not used for alerts until you confirm it by clicking a link we email you. Alongside it we store your alert settings — which price sources you want (TCGplayer, eBay, tokenized), your percentage-change threshold, and any per-card target price and grade you set.

We use your address only for the alerts you asked for. We send no marketing, and we do not share or sell it. Every alert email carries a one-click unsubscribe link.

Games — a pseudonymous player, no account

Playing PokéDraft, Deal or Rip, or the Daily Pack Rip creates a random player identifier and a display name you choose. Scores linked to that identifier appear on public leaderboards. We do not ask for an email address to play. Please don't use your real name or any other personal detail as a display name — it will be public.

Shared collections — published by you

Your collection lives in your browser by default. If you choose to share it, we store the card list and generate a public link at /c/… that anyone holding the URL can open. Sharing is entirely optional, and you can delete a shared collection at any time from the collection page.

Analytics and server logs

We use Google Analytics 4 to understand traffic — page views, referrers, approximate location, device and browser. GA4 sets cookies in your browser (see section 4). Our host, Vercel, records standard server logs including IP address for security and performance, and we run Vercel Speed Insights to measure page-load performance.

Stored in your browser, not by us

These stay on your device in localStorage and are never sent to us unless you take an action that requires it — subscribing, sharing, or submitting a score:

• Light/dark theme preference
• Your collection (pokeprice_collection_v1)
• Your watchlist and price targets (pokeprice_watchlist_v1)
• Your game player identifier (pokeprice_pokedraft_player_v1)
• Your shared-collection token (pokeprice_share_v1)

Clearing your browser storage removes all of it.

We never collect payment details, wallet addresses, private keys, or seed phrases. PokéPrice does not process transactions.

3. Why we process it (legal bases)

• Consent (Art. 6(1)(a)) — price-alert emails, and analytics cookies. You can withdraw consent at any time by unsubscribing or by blocking/clearing cookies; withdrawal does not affect processing already carried out.
• Legitimate interests (Art. 6(1)(f)) — keeping the service running, rate limiting, preventing abuse and fraud, and measuring performance. We weigh this against your rights and keep the data minimal.
• Performance of a service you requested (Art. 6(1)(b)) — storing a shared collection or a game score you chose to submit.

4. Cookies and analytics

PokéPrice sets no advertising cookies and runs no ad network. We do use Google Analytics 4, which sets cookies (typically _ga and _ga_*) to distinguish visitors. They are not used for advertising or profiling, and we do not sell the data.

Analytics is off until you allow it. On your first visit we ask, and Google Analytics is not loaded at all unless you accept. Declining is remembered and nothing on the site stops working — every page, price and tool behaves identically either way. To change your mind later, clear this site's data in your browser and you'll be asked again.

You can also:

• Block cookies for this site in your browser settings, or browse in a private window
• Send a Global Privacy Control or Do Not Track signal — a declined choice is stored locally either way
• Install Google's Analytics opt-out browser add-on
• Use any standard tracker-blocking extension — nothing on PokéPrice breaks without analytics

Outbound marketplace links (eBay, TCGplayer, Cardmarket, tokenized platforms) carry affiliate parameters so a referral can be attributed. Those platforms set their own cookies once you land on them, under their own policies.

5. Who else processes your data

• Vercel (USA) — hosting and server logs. Privacy policy.
• Supabase (EU-hosted) — our database. Stores watchlist subscribers, shared collections, game scores, and cached card data.
• Resend (USA), delivering via Amazon SES — sends verification and price-alert emails. Your address is shared with them solely to deliver those messages. Privacy policy.
• Google Analytics (USA) — traffic measurement. Privacy policy.
• GitHub Actions — runs scheduled data-refresh jobs. No personal data passes through them.

We also read data from the sources below. No personal data about you is sent to them:

• Pokémon TCG API — card details, images, and TCGplayer market prices
• Silph Co Analytics — recent sold-price comparables
• eBay Browse API — active listing prices by grade
• Collector Crypt, Courtyard, RIP.FUN, Beezie — public tokenized listing data
• CoinGecko — crypto spot rates for USD conversion

6. International transfers

Vercel, Resend and Google are based in the United States, so some processing takes place outside the EEA. These transfers rely on the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as set out in each provider's own terms. Our database is hosted in the EU.

7. How long we keep it

• Watchlist email and settings — until you unsubscribe or ask us to delete them.
• Unconfirmed subscriptions — removed if the double opt-in is never completed.
• Shared collections — until you delete them.
• Game scores and display names — kept while the leaderboard runs; may be reset when a season or game mode ends.
• Server logs — up to 30 days.
• Google Analytics — up to 14 months.
• Cached card, price and listing data — indefinitely. It contains no personal data.

8. Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to its processing, withdraw consent, and receive a copy in a portable format.

In practice most of this is immediate and in your hands: unsubscribe from any alert email to erase your subscription, delete a shared collection from the collection page, or clear your browser storage to remove everything held locally. For anything else, use the contact form or email privacy@pokeprice.gg, and we will respond within one month.

If you are unhappy with how we handle a request, you can complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

9. Children

PokéPrice is a price-research tool intended for adult collectors and buyers, and is not directed at children. In the Netherlands, consent to information-society services requires an age of at least 16. If you are under 16, please do not subscribe to price alerts or submit a display name. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

Data is transmitted over HTTPS and stored in access-controlled infrastructure. Watchlist management links are unguessable single-use tokens delivered by email, which is why we never ask you for a password. No system is perfectly secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this policy as the site changes. The "Last updated" date above always reflects the current version. If we make a change that materially affects how we use data you have already given us, we will say so on the site.