Privacy Policy

Who we are

TCGPriceAPI is run by TCG Price API. This policy explains what personal information we collect when you use our website, API and MCP server, why, and the choices you have. Contact: [email protected].

What we collect

• Your email address, to create your account and send sign-in links and account emails. If you sign in with Google or GitHub, we receive only your verified email address from them.
• Name and company, only if you add them in your settings.
• Your API key, which we store only in a scrambled (hashed) form, so even we can't read it back.
• Usage: how many requests and cards your key used each day and which endpoints, to enforce limits, spot unusual use and show your dashboard.
• Billing: your plan, subscription status and a Stripe customer reference. Stripe holds your payment details.
• Technical data: your IP address and request details, used briefly in memory to slow down abuse and kept in our hosting providers' logs for security and troubleshooting.

We don't use advertising or analytics trackers, and we don't sell or rent your personal information.

How we use it

To run your account and the Service, enforce plan limits, take payments, keep the Service secure, answer support requests, and email you about your account, billing and important changes. We don't send marketing email without your consent.

Cookies

We only set cookies needed to sign you in. There are no advertising or tracking cookies.

The docs also remember your preferred code language in your browser's local storage. Stripe's checkout page, which is on Stripe's own site, sets its own cookies.

Services we use

We share data only with the providers that run parts of the Service for us, and only what they need:

We may also share information if the law requires it, or to protect the Service and its users from fraud or abuse. These providers may process data in the United States and other countries.

How long we keep it

We keep your account data while your account exists. Sign-in links expire after 15 minutes and are deleted within a day. When you delete your account from the dashboard, we delete your email, profile, API key, usage history and sessions straight away. Stripe keeps its own billing records, as payment law requires.

Your choices and rights

You can see and change your details in your dashboard, and delete your account there at any time. You can also ask us for a copy of your data, to correct it, or to delete it by emailing [email protected]. Depending on where you live (for example the EU, UK or California) you may have further rights; we'll honor them as the law requires.

Security

The site only works over HTTPS. API keys, sign-in links and sessions are stored hashed, every form is protected against forgery, and access is rate limited. No system is perfectly secure; if we ever learn of a breach that affects you, we'll tell you as the law requires.

Children

The Service is not meant for children under 13, and we don't knowingly collect their information. If you think a child has signed up, contact us and we'll delete the account.

Changes to this policy

We'll update this page when what we collect or how we use it changes. The date at the top shows the latest version, and we'll email account holders about significant changes.