Privacy policy

TCSell (“we”) is a European marketplace for Magic: The Gathering, Pokémon, and One Piece singles. This policy explains what we collect, why, and your rights under the GDPR.

Who is responsible

Until the operating company is fully registered, you can reach the controller at hello@tcsell.com. Statutory name and address will appear on the imprint as soon as they exist.

What we process

• Account: name, username, email, country, password hash or linked Google/Apple id.
• Selling: TOTP secret (encrypted), listings, shipping address you save, and Stripe Connect account id if you get paid.
• Orders: items, amounts, status, tracking, pack photo URL, dispute text, and the address used to ship.
• Technical: session cookie, and IP used to suggest your country at signup, for rate limits, and for security logs. A first-party visitor count hashes IP + browser user-agent + a server salt. That hash is kept about a day in a live log and a couple of days on the daily unique tally. The same log stores the country of the network (not the IP), a mobile/desktop/tablet label, the page path, and the referring site hostname. Daily totals without the raw IP are kept about 90 days. Admins see those totals and a live map. There is no profile and no third-party analytics. The Grade hunt free-slip cookie stores up to three card ids for 30 days so a visitor can reopen those slips. It is not tied to an account.

Why (legal bases)

• Contract — create your account, list cards, checkout, ship, and support an order.
• Legal obligation — invoices, tax, and marketplace reporting when those rules apply.
• Legitimate interest — keep the site secure, prevent fraud, improve the catalog, and see how the marketplace is used (unique visitors, country, device, page, and referrer host).
• Consent — only if we later add optional marketing or third-party analytics. We do not do that today.

Processors

Payments go through Stripe. The site and Postgres run on a dedicated Hetzner server we operate with Coolify. Transactional email is sent over SMTP from that same server. If SMTP is not configured, a Resend API fallback may still send sign-in mail. Google or Apple only if you choose those sign-in buttons. Each acts as a processor or independent controller under their own terms.

How long

Account data until you delete the account. Orders and invoices for the statutory bookkeeping period (usually 7 years in the EU). Sessions expire after 30 days of inactivity.

Your rights

You may access, correct, delete, or export your data, object to processing, and lodge a complaint with your local data-protection authority (in the Netherlands: Autoriteit Persoonsgegevens). Write to hello@tcsell.com.

Cookies

See the cookie notice. We only set what the site needs to run.