Privacy policy
Version of October 16, 2026. This translation is provided for convenience: in case of any difference, the French version prevails.
1. Data controller
Hachem Sefrioui, sole proprietor (trade name HM), SIREN 851 529 107, SIRET 851 529 107 00019, 91 rue des Martyrs de la Résistance, 69200 Vénissieux, France. Contact: contact@tcgbro.app
2. Data collected
| Data | Why |
|---|---|
| Signing you in (link or code sent by email) | |
| Username, city, games played | Your player profile |
| Date of birth | Checking that you are 16 or over. It is never shown to other players |
| Location rounded to about 1 km | Finding trades near you. Your exact location is never stored or shown: others only see an approximate distance |
| Precise location, at the time of a trade | Checking that both players are in the same place when they scan the QR code. It is compared with your partner's and then deleted: only the distance between you (in meters) is kept with the trade |
| Cards in your binder and wishlist | Making matching work |
| Trades, messages, suggested places | Organizing trades |
| Photo of the card offered in a trade (taken with the camera, never from the gallery) | Showing its real condition to your trade partner. Only the two of you can see it |
| Ratings and reviews | Trust between players |
| Reports and blocks | Community safety |
| Interest preferences (wanted games, "notify me" offers) | Deciding which games and features to open |
| Usage statistics (screens viewed, actions such as "card added" or "trade proposed", app version) | Understanding what people like and where the app is hard to use, to improve it |
| Email left on the iPhone waitlist of the tcgbro.app website | Telling you once, on App Store launch day |
The card scanner runs on your phone: the photo is analyzed locally and is not sent to our servers.
3. Legal bases
- Performance of the service: account, matching, trades, messages.
- Legitimate interest: safety (reports, moderation, abuse prevention); internal audience measurement to improve the app (you can refuse it, see below).
- Consent: location (requested by your phone, can be withdrawn at any time in settings); iPhone waitlist on the website (one-click unsubscribe in every email).
- Legal obligation: possible retention in case of a request from the authorities.
4. Who sees what
- Other players see your username, rating, number of trades, city, reviews received, the cards in your binder and wishlist, and an approximate distance. Never your email, date of birth or exact location.
- Visitors without an account only see the number of cards available around them, without any username.
- Our service providers (processors):
- Supabase: database, authentication, sending emails. Data hosted in the European Union (Ireland), under Supabase's data processing agreement.
- Apple (Apple Push Notification service): sending notifications to iPhones. Only a technical identifier of your device and the notification text pass through Apple; you choose which ones to receive in your profile.
- Google (Firebase Cloud Messaging): sending notifications to Android devices, under the same conditions (technical device identifier and notification text). No Google analytics service is used.
- Didit (identity verification, optional): if you ask for the "Verified" badge, Didit processes a photo of your ID and a selfie to confirm it's really you. TCG Bro receives neither the photo nor the document: only the result, the verification date and the date of birth on the ID (it replaces the one you declared).
- RevenueCat (in-app purchases): manages your Supporter and boost purchases with Apple and Google. RevenueCat receives the technical identifier of your TCG Bro account, your username, your trial status and your purchases (product, date, amount, country). Never your email or location. The payment itself is processed by Apple or Google: TCG Bro and RevenueCat never see your bank card. RevenueCat is based in the United States: these transfers are covered by its data processing agreement (European Commission standard contractual clauses).
- CARTO and OpenStreetMap (travel mode map): to display the map and find a city, your device contacts their servers (IP address, map area displayed, search text, chosen point). Nothing is linked to your account.
- Resend: sending sign-in emails (your email address and the code) and iPhone waitlist emails, under its data processing agreement.
We do not sell any data.
5. Retention period
- Account and content: as long as your account exists.
- Account deletion: immediate erasure of your profile, cards, trades, messages and reviews.
- Usage statistics: 13 months maximum, then automatic deletion.
- iPhone waitlist: your address is erased after the launch announcement email, or as soon as you unsubscribe.
- Reports: 1 year after they are handled, for the safety of trades.
6. Your rights
You can at any time access your data, correct it (profile), delete it (Profile > Settings > Delete my account, or at www.tcgbro.app/suppression-compte), object to processing or request portability by writing to contact@tcgbro.app. You can also contact the French data protection authority, the CNIL (cnil.fr), or the authority of your country.
7. Storage on your phone
The app locally keeps your sign-in session, your preferences (theme, sorting, language) and a random identifier specific to the app, used only for usage statistics. It is shared with no one and does not track you outside TCG Bro. No advertising trackers.
Usage statistics: they stay with us (no external analytics service), are only used to improve the app and are never sold. You can refuse them at any time in Profile > Usage statistics.
8. Minors
TCG Bro is for people aged 16 and over. If you think someone under 16 is using the app, please report them.