Privacy Policy

Effective 11 September 2026 · Margin TCG, a product of Big Deck Energies LLC

The short version. We collect the email address you sign up with, the cards you save to your binders, and any message you send support. Photos of cards you scan are sent to Google to be identified and are not stored on our servers. We do not use analytics, we do not track you across other apps or websites, we show no advertising, and we do not sell or share your information with anyone for their own purposes.

1. Who we are

Margin TCG is operated by Big Deck Energies LLC ("we", "us"), 24 West Main Street, Suite E, Cuba, NY 14727. For anything in this policy, write to privacy@margintcg.app.

2. What we collect, and why

What	Why	Where it lives
Your email address	It is your account. Your Margin TCG account is the same account as the Big Deck Energies store.	Our WordPress/WooCommerce site
Your password	To sign you in.	Stored by WordPress, hashed. It is never sent to our pricing servers, never written to your device, and never recorded in any log.
Cards you save — name, set, number, condition, grade, and the price we calculated	So your binders are there when you come back, on any device.	Cloudflare D1, tied to your account ID
Photos you take of cards	To identify the card.	Not stored by us. See section 3.
Support messages — your name, email, message, app version, and IP address	To answer you, and to stop abuse of the contact form.	Cloudflare D1, and emailed to us

We do not ask for your real name, address, phone number or payment details. There is nothing to pay for yet.

3. Photographs of cards

This is the part worth reading closely.

When you scan a card, the photo is sent to our server, which forwards it to Google (Gemini, via Google Cloud Vertex AI) to work out which card it is. If the card is a graded slab and the certificate number cannot be read, the photo may also be sent to CardHedge to read the label.

We do not store your photos. There is no photo or image column in our database and no image file is written to our storage on the scan path. The photo passes through and is gone.
The photo does not carry your identity. It is sent with the card prompt and nothing else — no email address, no account ID, no login token.
On your device, the full-size photo is discarded as soon as the scan finishes. A small thumbnail is kept with the batch you are working on so you can see what you scanned, and is deleted with it.

Google and CardHedge handle that image under their own terms. We do not control their retention.

4. Who else sees anything

To price a card we ask several market data services about it. They receive card names, set numbers, grades and search terms — never your identity, your email, or your photo. These calls are made by our server, so those services see our server, not you or your phone.

Service	What it receives
Google (Gemini / Vertex AI)	The card photograph and the prompt
CardHedge	Certificate numbers and card identity; a photograph only when a slab label cannot otherwise be read
JustTCG, TCGdex, Pokemon Price Tracker, PokeWallet	Card names, numbers and set identifiers
eBay	A search phrase built from the card's name, number and grade. eBay is queried with our own application credentials, not on your behalf and not linked to you.
Cloudflare	Hosts our servers, database and storage
Resend	Delivers support emails to us

Tapping an eBay link in the app opens eBay in your browser. From that point eBay sees you as any website visitor would.

5. What we deliberately do not do

No analytics and no telemetry. There is no Google Analytics, no Firebase, no Sentry, no Mixpanel, no advertising SDK, and no tracking pixel anywhere in the app.
No tracking across other apps or websites.
No advertising, and no sale or sharing of your information for anyone else's marketing.
No profiling. We do not build a picture of you from what you scan.

6. What is stored on your own device

Your sign-in token and email address, so you are not asked to log in every time.
The batch you are working on, including small thumbnails.
Recent scan history, which is automatically discarded after 48 hours.

Signing out deletes the token and clears the open batch from the device.

7. How long we keep things

Data	Kept for
Your account and email	Until you ask us to delete it
Cards in your binders	Until you delete them, or until your account is deleted
Support messages	12 months, then deleted automatically
Price data we cache	72 hours. It is about cards, not about you.
Scan history on your device	48 hours
A scan history file, if you export one for support	30 days, then deleted automatically

8. Your choices

Delete individual cards or whole binders at any time inside the app. Deletion is immediate and permanent.

Delete your account and everything in it by emailing privacy@margintcg.app. We will remove your binders, your saved cards and your account.

Being straight with you: in-app account deletion is not built yet. Until it is, the email route above is how it is done, and we will do it.

Ask what we hold about you, or ask for a copy, at the same address.

Depending on where you live you may have additional rights over your personal information, including access, correction, deletion and portability. Write to us and we will honour them.

9. Children

Margin TCG is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child has created an account, write to us and we will delete it.

10. Security

Everything travels over HTTPS. Your password is held by WordPress in hashed form and never reaches our pricing servers. Sign-in tokens held on our servers are stored as a one-way hash, not as the token itself. No system is perfect, and we will tell you promptly if something happens that affects your information.

11. Changes

If this policy changes in a way that matters, we will change the date at the top and, for anything significant, tell you in the app.

12. Contact

privacy@margintcg.app for anything about your data. support@margintcg.app for everything else.