— LEGAL

PRIVACY POLICY

Last updated: June 2025

1. Information We Collect

We collect information you provide when creating an account (name, email address, password) and information generated by your use of the platform (card openings, token transactions, withdrawal requests including shipping address). If you sign in with Google, we receive your public profile information from that service.

2. How We Use Your Information

Your information is used to operate your account, process token transactions, fulfill physical card withdrawals, send transactional emails (account verification, withdrawal updates), and improve the platform. We do not sell your personal data to third parties.

3. Cookies & Analytics

We use session cookies required for authentication. We also use the following analytics and advertising services which may collect usage data:

Google Analytics (GA4) — page views, session data, and engagement metrics
Google Ads — conversion tracking for advertising campaigns
Google Tag Manager — manages the above tracking scripts
Vercel Analytics — anonymous performance metrics

These services operate under their own privacy policies. You can opt out of Google Analytics via Google's opt-out tool.

4. Data Storage & Security

Your data is stored on secure servers hosted by Vercel and Neon (PostgreSQL). Passwords are hashed using bcrypt and never stored in plain text. All data in transit is encrypted via HTTPS.

5. Third-Party Services

TCGRoll uses the following third-party services to operate the platform:

Stripe — payment processing. Your card details are handled entirely by Stripe and never stored on our servers. See Stripe's Privacy Policy.
Resend — transactional email delivery (account verification, withdrawal notifications). See Resend's Privacy Policy.
Google OAuth — optional sign-in method. See Google's Privacy Policy.

6. Your Rights

You may request a copy of your data, correction of inaccurate data, or deletion of your account at any time by contacting us at support@tcgroll.com. Account deletion removes all personal data within 30 days, except where retention is required by law.

California residents (CCPA): You have the right to know what personal data we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact us at the address below.

EEA/UK residents (GDPR): You have the right to access, rectify, erase, and port your personal data. You may also object to or restrict certain processing. Contact us to submit a request.

7. Children's Privacy

TCGRoll is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

8. Contact

Privacy questions or data requests: support@tcgroll.com