Privacy, and what we hold.
Effective Sep 03, 2026 · this page is open to everyone, no account needed
Short version: the desk keeps the four things it needs to let you in and tell you when prices move, and nothing else. There is no analytics script on this site — no Google Analytics, no tag manager, no advertising pixel, no session recorder, no third-party cookie. Nobody is building a profile of what you read here, because nothing is measuring it.
What we storeIf you make an account
An account exists so the coverage notes open for you and stay open, and so the nightly move list can reach you. That takes exactly this:
| What | Why it exists |
|---|---|
| Your name | To greet you, and to sign the emails to a person rather than an address. |
| Your email | It is how you sign in, how a password reset reaches you, and where the move list goes. |
| A hash of your password | Not the password. A bcrypt hash, computed inside the database, which cannot be turned back into what you typed. We never see your password and it is never stored. |
| When you joined, when you last signed in, how many times | So a strange sign-in is visible, and so an account that never gets used can eventually be cleaned up. |
| Whether you unsubscribed, and when we last emailed you | So unsubscribing sticks and so you are not sent the same night twice. |
| The product IDs you star | Your watchlist. A list of numbers like 644298, nothing more. |
What we do not storeThings you might reasonably expect and will not find
- No analytics of any kind. No page-view counts, no scroll tracking, no heatmaps, no A/B tooling.
- No record of what you read. The desk does not log which coverage notes or products you opened.
- No advertising, no ad networks, no data sold or shared for marketing. There is nothing to sell and no arrangement to sell it under.
- No payment details. The desk is free and takes no money, so it never asks for a card.
- No address, no phone number, no date of birth. They are never requested.
Cookies and browser storageTwo cookies, and a few preferences
- tcgs_s — your session. Signed, HttpOnly, so page scripts cannot read it, and it lasts a year so you are not asked to sign in on every visit.
- tcgs_u — a flag saying somebody is signed in, plus the display name. It carries no secret. It exists so the lock can open before the page paints instead of flashing shut and then open.
- Your browser also keeps a small amount of local storage: that you are unlocked, your display name, and whether you dismissed the offer to install the app. It stays on your device and is never sent anywhere.
No cookie here is used for advertising or for tracking you across other sites, and none is set by a third party.
Who else sees anythingThe services behind the desk
| Service | What it handles |
|---|---|
| Netlify | Hosting. Like any web host, its servers log the requests they serve, which includes IP addresses. |
| Supabase | The database holding the account fields listed above. |
| Resend | Email delivery. It handles your address in order to deliver the welcome note, a password reset, and the move list. |
| Google Fonts | The typefaces. Your browser fetches them from Google's servers, so Google sees the request and your IP. |
| Cloudinary | A few images and textures, fetched the same way and with the same consequence. |
Each of these is used for the job named and nothing else. They are processors, not partners: none of them is given your data to use for their own purposes.
EmailWhat we send, and how to stop it
Three kinds of mail, all from desk@tcgstudy.com: a note when you join, a reset link when you ask for one, and the nightly move list when the market actually moved. There is no marketing sequence and nothing is sent on a schedule for its own sake.
Every move list carries a one-click unsubscribe, and the header your mail app reads to offer its own unsubscribe button. Unsubscribing stops the email and keeps your account — the desk stays open to you.
That address sends but does not receive. Replying to it will not reach anybody. Use the form at the bottom of this page instead, which does.
Deleting your accountImmediately, by you, without asking us
Sign in and open your account page. At the bottom is Delete your account. It asks for your password, and then the account row and every star attached to it are deleted from the database. Not flagged, not hidden, not archived — deleted, in that moment.
What survives, and why: the mail already delivered is in your inbox and ours to recall is not; Resend keeps its own delivery logs on its own retention schedule; and the host's server logs age out on the host's schedule. Nothing about you remains in the desk's own database.
If you cannot sign in — you have lost the password and the reset mail is not reaching you — use the form below and say so, and the account will be deleted for you.
Children
The desk is market research for people buying and holding sealed product. It is not directed at children and it does not knowingly hold data from anyone under 13. If you believe a child has made an account here, use the form below and it will be removed.
PricesWhere the numbers come from, since they are not from you
Every figure on this site comes from public market records — the TCGplayer daily market-price feed, dated eBay sold listings, and archived price snapshots. None of it is derived from members. Your account has no effect on any number the desk prints.
Changes
If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and the change is described here rather than quietly rewritten.
ContactA form, because it actually works
Ask what is held about you, ask for it to be deleted, or raise anything else here. It goes straight to the desk's owner.