Privacy policy
Last updated: 28 September 2026
TCG House is an app for scanning, valuing and managing trading cards. This policy explains which data the app processes, why, and what your rights are. It applies to the Android app, the iOS app and the web version at app.tcg-house.com.
Data controller: Lourens Meek, dev@tcg-house.com.
1. The app also works without an account
You can use TCG House without registering. In guest mode your collection stays exclusively on your own device and nothing is linked to an account. If you create an account later, you can sync that local data to the cloud.
2. Which data we process
| Data | Why | Where |
|---|---|---|
| Email address | Creating your account, signing in and resetting your password | Firebase Authentication (Google Ireland) |
| Name and profile photo | Showing your name in the app; only if you enter it or sign in with Google or Apple | Firebase Authentication and Firestore |
| Your collection: cards, wishlist, sealed products, price alerts, trade history, goals, storage boxes and grading submissions | Storing your collection and using it on multiple devices | Cloud Firestore, readable only by your account |
| Marketplace listings: card, price, shipping cost, description and photos of the front and back | Offering your card for sale; other users see the listing with your profile name | Cloud Firestore; visible to other users while the listing is online |
| Orders: buyer, seller, card, amounts, status, carrier and tracking code | Handling a purchase, holding the money until the buyer has the card, and resolving disputes | Cloud Firestore; visible only to the buyer, the seller and administrators |
| Buyers' payment details; sellers' identity, address and bank account | Processing payments and paying out sellers, including the identity check that comes with it | Stripe (payment provider); we never see card or account numbers, only the status of the payment and payout |
| Messages: direct messages and conversations about a listing or order | Contact between collectors and between buyer and seller | Cloud Firestore; readable by the participants; administrators can view them to handle abuse and disputes |
| Feed and communities: posts, photos, likes, comments and who you follow | Sharing your collection and posts with other collectors | Cloud Firestore; visible to other users |
| Camera images | Recognising a card when that doesn't work on your device itself. The photo then goes to our own server and from there to Anthropic for image recognition | Not stored — see section 3 |
| Usage statistics | Seeing which screens are used and where the app crashes | Firebase Analytics, with a random app ID and not your email address |
| Device integrity | Preventing others from abusing our AI feature through a modified app | Google Play Integrity / Apple App Attest via Firebase App Check |
| Number of AI scans per hour | Preventing abuse and unexpectedly high costs | A counter in Firestore linked to your account ID |
| Push notification token of your device | Sending notifications, for example about price alerts, messages and orders | Firebase Cloud Messaging; the token is stored with your account |
| Emails about purchases and sales | Confirmations and instructions at every step of an order, in your account's language | Sent via Resend (email service) to your account's email address |
We do not ask for location, contacts, calendar, microphone or phone number. We have no access to your photo library: if you pick a photo, Android or iOS only hands us that single image.
3. What happens to your photos
Scan photos. When you scan a card, the app usually recognises it on your device itself. If that doesn't work, the photo is cropped to the card and downsized on your device, sent encrypted to our Cloud Function and forwarded to Anthropic, which recognises the card and returns text.
A scan photo is not stored: not on our servers, not in a database and not in a backup. Our server only records how many scans were made and how many tokens they cost — not the image itself. Anthropic processes the image to generate the answer and does not use business customers' data to train models.
Photos you post yourself are stored. A listing requires a photo of the front and one of the back; you can also post photos in the feed and in communities. They are downsized on your device, stored in Cloud Firestore and visible to everyone who can see the listing or post. We keep listing photos for as long as the listing exists, including after a sale, because they then serve as evidence in a possible dispute. If you delete the listing, we delete the photos too.
4. Third-party price data
For card data and market prices, the app and our server query card databases (TCGdex and the Pokémon TCG API), Cardmarket (via the Cardmarket API TCG on RapidAPI), TCGPlayer (via TCGCSV), eBay and ECB exchange rates (Frankfurter). We only send details about the card, such as its name, number or card ID. Your account, email address or collection is never passed on to those parties.
5. Marketplace, messages and notifications
On the marketplace the buyer pays TCG House; we hold the money until the buyer has received the card and then pay it out to the seller. Payments and payouts run through Stripe. Stripe processes your payment and bank details and, for sellers, the identity check required for payouts, under its own privacy policy.
Buyer and seller see each other's profile name, the order and the conversation about that order. For each order we keep who sold what, for how much and when. Platforms are legally required to report sellers above certain thresholds to the tax authorities (DAC7); we use those details for that.
At every step of an order you receive a push notification and an email. We send the emails via Resend to your account's email address. Push notifications run through Firebase Cloud Messaging; you can turn them off in your device settings.
What you post in the feed or in a community, and who you follow, is visible to other users. Direct messages are only visible to you and the recipient; administrators can view messages to handle abuse and disputes.
6. Legal basis
Performance of the contract — your account, your collection in the cloud, card scanning and buying and selling on the marketplace. The feature does not work without that data.
Legal obligation — the statutory retention period for order records and the reporting obligation for platform sellers (DAC7).
Legitimate interest — abuse prevention (App Check, scan limit) and anonymised usage statistics to improve the app.
7. How long we keep data
We keep your account data and collection for as long as your account exists. If you delete your account in the app, we delete your profile and collection. The scan counter expires automatically after one hour. Firebase Analytics statistics are deleted after 14 months.
We keep listings and their photos for as long as the listing exists. We keep order and payment records for seven years, because tax law requires it. If you want us to delete your messages, posts or listings, email dev@tcg-house.com.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can access and export yourself: the app exports your whole collection as a CSV file. Delete via Profile → Settings → Delete account, or email dev@tcg-house.com. We respond within 30 days.
If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Transfers outside the EU
Firebase runs on Google servers; the Firestore database is located in the EU. Anthropic processes scan requests in the United States. That transfer is based on the European Commission's standard contractual clauses. Stripe and Resend may process data in the United States; that transfer is also based on the standard contractual clauses.
10. Children
TCG House is not aimed at children under 13. We do not knowingly collect data from children. If we discover we have, we delete it.
11. Security
All traffic runs over HTTPS. Firestore rules ensure only your own account can access your data. Our AI server only accepts requests from a genuine, unmodified installation of the app.
12. Changes
For significant changes we update the date at the top and announce it in the app.
13. Not affiliated with Nintendo
TCG House is an independent app. The trading card game and its trademarks are property of Nintendo, Creatures Inc. and GAME FREAK Inc. This app is not made, sponsored or endorsed by them.