Privacy policy
Draft — not yet reviewed. This page is a working outline for legal review. Highlighted items still need to be filled in, wording marked Proposed is a draft awaiting review, and none of it is final.
Who we are
ScoutrTCG is operated by Purple Shock Studios LLC, a Maryland company; ScoutrTCG is its trade name. Questions about this policy or your data: privacy@scoutrtcg.com.
What we collect
- Account: your email address, display name, date of birth (to apply the age rules), and whether you use the collector or vendor side.
- Shops: for vendors, shop name, address and map location, which are shown publicly. Private sellers give a ZIP code only, and only the ZIP area is shown.
- Your activity: listings, reservations, pickup confirmations, meetup messages, ratings and comments, reports you file, feedback you send, your collection, want list and saved searches.
- Grading tools: grading submissions you log in the tracker (the grading company, fees, dates, the cards, what you paid, the grades and cert numbers they came back with) and slab values you save. Grades are combined with other members' into the share of each card that came back at each grade. That is shown to other members only for a card with enough results from enough different people (at least 10 cards from 3 people) that no one person's submissions can be picked out; nobody else sees your submissions. We also count how many calculations an account without Pro has run in the last day.
- Payments: handled by Stripe. We never see or store card numbers. We keep Stripe's customer and subscription IDs, and a card fingerprint (an ID for the card that is not the card number) to detect fraud.
- Device: a push notification token, if you allow notifications. We keep a copy of each notification we send you for 30 days, so you can find it again in the app. When you send feedback, the app adds its version number and your phone's operating system and version (for example “iOS 18.1”), so we can reproduce a bug; nothing that identifies the phone itself.
- Location: your location is used to search near you and is not stored.
- Safety records: which listings' hidden prices you revealed, and the fact (not the text) that something you wrote was refused by our automated screening.
- Error reports: when the app or website runs into an error, a report of the error with your account ID, your device and its operating system. Not your name, email, location or anything you typed.
How we use it
To run the service: showing listings near you, handling reservations and deposits, sending the notifications and emails you'd expect, and keeping the marketplace safe from fraud and abuse. We don't show ads, we don't sell your personal data or share it for advertising, and we don't track you across other companies' apps or websites.
Who we share it with
Only the service providers that run parts of ScoutrTCG for us:
- Supabase: database, sign-in and file storage
- Stripe: payments and subscriptions
- Google Cloud: checking event flyer images (Vision) and screening text people write for abuse (Natural Language)
- CardSight: identifying cards from photos, when a vendor uses camera scan
- Resend: sending email
- Google Workspace: our own email, including messages you send us
- Expo: delivering push notifications
- Fly.io: hosting our server and website
- Sentry: error reports from the app, the website and our servers
- OpenStreetMap: the map tiles in the app, which its servers send for the area of the map you're viewing
- Photon, run by komoot: suggesting places as you type a city, town or ZIP code to search near, and a shop address as a vendor types it
Other people see what the app shows them: your shop, your listings, your display name on reservations, and ratings (shown without the rater's name).
ProposedThe owner of Purple Shock Studios LLC also sells cards on ScoutrTCG as Purple Shock TCG, a separate business. Other shops' listings, stock and reservations are never shared with it or used for it.
Keeping and deleting your data
You can delete your account in the app, from the Account tab. We delete your login, profile, date of birth, shop details, listings that were never reserved, collection, want list, saved searches, push tokens, notification history, feedback, blocks, grading submissions and saved slab values (so your grades leave the combined figures too), and end any subscription. Past reservations and ratings are kept so the other person keeps their history, with your name and email removed. Fraud-prevention records (card fingerprints, device tokens, price reveals, refused text attempts) are kept, attached only to the anonymous record, so that deleting an account can't be used to erase evidence of fraud. They are deleted one year after the account is.
Your rights
ProposedWherever you live, you can ask us for a copy of the personal data we hold about you, to correct it, or to delete it (most of which you can do yourself in the app). Email privacy@scoutrtcg.com from the address you signed up with. We answer within 45 days, and if we turn a request down we say why and how to appeal. Because we don't sell personal data or use it for targeted advertising, there is nothing to opt out of. [REVIEW: which state privacy laws apply at launch size, including Maryland's]
Children
ScoutrTCG is for people 13 and older, and buying from or selling as a private seller is for people 18 and older. We ask for a date of birth at sign-up and don't let anyone under 13 create an account. ProposedIf we learn that an account belongs to someone under 13, we close it and delete its data, except records the law requires us to keep. If you believe a child under 13 has an account, email privacy@scoutrtcg.com.
Changes to this policy
We may update this policy. When we do, we change the date at the top, and for a change that matters to you we tell you in the app or by email before it takes effect.