Privacy Policy

1. Introduction

This policy describes how Vendor (owned by Pamela Ferguson, operated at vendortcg.com) collects, uses, and protects your information. We take your privacy seriously and are committed to transparency about our data practices.

2. Information We Collect

Email Address

Collected via Paddle when you subscribe, and via our beta signup form on the website.

Device Fingerprint

A randomly generated identifier (UUID) created when the app is first installed. Used solely to enforce the 2-device-per-subscription limit. This is NOT a tracking fingerprint. It does not identify you personally or track your activity across other services.

API Key

Stored on your device. Used to authenticate your pricing requests to our servers.

Card Identification Queries

When you scan a card, the identification data (card name, set, collector number) is sent to our server to retrieve pricing information. No images of cards are transmitted to our servers.

Server Logs

Our server logs health checks and error events for operational monitoring and system diagnostics. These logs do not contain personally identifiable information.

3. Information We Do NOT Collect

Deal Data

All transaction data (customer names, card values, deal totals, receipt content) is stored exclusively on your device and is never transmitted to our servers.

Payment Information

All payment processing is handled by Paddle. We never see, store, or have access to your credit card number, bank details, or payment credentials.

Location Data

The app does not request or use location services.

Usage Analytics

We do not use third-party analytics tools or tracking services in the app.

4. How We Use Your Information

Email: Subscription management, beta key delivery, and critical service announcements. We do not send marketing emails unless you explicitly opt in.

Device Fingerprint: Enforcing the 2-device-per-subscription limit and automatically freeing inactive devices after 30 days.

Card Identification Queries: Retrieving current market pricing data from our pricing data providers.

Server Logs: Monitoring system health, diagnosing errors, and improving service reliability.

5. Third-Party Services

Paddle (paddle.com)

Our Merchant of Record. Handles all payment processing, tax collection, and subscription management. Subject to Paddle's privacy policy and terms.

TCGPlayer / Market Data Providers

Card identification queries are sent to retrieve pricing data. No personal information is shared with these providers beyond what is necessary to retrieve card pricing.

6. Data Storage and Security

On Your Device

Deal data is stored in a local SQLite database. Your API key is stored in secure device storage using platform-native encryption.

On Our Servers

Redis database for API key validation and rate limiting, hosted on a dedicated server in Europe (Hetzner). All communication between your device and our servers is encrypted via HTTPS/TLS.

7. Data Retention

Email Addresses: Retained for the duration of your subscription plus 30 days after cancellation.

Beta Signup Emails: Retained until the beta period ends.

Device Fingerprints: Retained for the duration of your subscription. Inactive devices are automatically expired and removed after 30 consecutive days.

Server Logs: Retained for 30 days, then deleted.

Deal Data: Stored only on your device. You have full control and may delete it at any time through the app.

8. Your Rights

Request Deletion: Request deletion of your email address and account data by emailing [email protected]. We will process deletion requests within 30 days.

Unsubscribe: Unsubscribe from non-critical emails at any time. Critical service announcements may continue.

Data Portability: All deal data is already under your control on your device and can be exported or deleted as you choose.

9. Children's Privacy

Vendor is intended for professional business use and is not directed at children under 13. We do not knowingly collect information from children under 13. If we become aware that we have collected information from a child under 13, we will take steps to delete such information.

10. Data Sales

We do not sell, rent, lease, or share your personal information with third parties for marketing purposes. Period. Your data is yours alone.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be communicated to active subscribers via email. Continued use of the App after such changes constitutes your acceptance of the revised Privacy Policy.

12. Contact

For questions or concerns about this Privacy Policy, please contact us at [email protected].