Privacy Policy

Last updated: October 2026

What data we collect

• Wishlist data: Product URLs, names, images, and prices you save to your wishlist. This is stored locally in your browser and optionally synced to our secure cloud database when you create an account.
• Account information: If you create an account, we store your email address and an encrypted password hash.
• IP address: When you create an account, we record the IP address used at signup for security and abuse prevention, and for ad conversion measurement as described below.
• Browser user agent: When you create an account, we record the browser user-agent string used at signup, for abuse prevention and for ad conversion measurement as described below.
• Alert preferences: Your price alert thresholds, stock alert settings, and notification preferences (email, web push).
• Push subscriptions: Push notification subscription identifiers, browser/device platform, and browser user-agent for devices where you enable push.

How we use your data

• To provide wishlist functionality and display your saved items.
• To monitor prices and stock availability for items you've set alerts on.
• To send you email and/or push notifications when your alert conditions are met, based on your preferences.

Data sharing

• We do not sell your personal information. Reporting a signup or first-card event to an advertising platform (described below) may count as "sharing" for cross-context behavioral advertising under California law; you can opt out at any time (see Your California privacy rights).
• We use Supabase for secure database hosting and authentication.
• We use Resend for email delivery (only for alert notifications you've opted into).
• If you enable push notifications, delivery is routed through your browser's push service (e.g. Google, Mozilla, Microsoft, or Apple, depending on your browser).

Conversion measurement. When you sign up or add your first card, we may report that event to the advertising platform whose ad brought you here so it can measure whether its ads lead to real use of TCG Sherpa. To Google Ads we send a SHA-256 hash of your email address, your account identifier, and any Google click identifier (gclid, gbraid or wbraid) that was on the link you arrived from. To Meta we send a SHA-256 hash of your email address, your account identifier (both in plain and hashed form), the IP address and browser user-agent recorded at signup, and any Meta click identifier (fbclid) that was on the link you arrived from. Your email address is never sent unhashed. These reports are used only for ad measurement and optimization.

Cookies and tracking technologies

• Sign-in: our website and extension store an authentication session so you stay signed in.
• Attribution: when you arrive from a link that carries campaign parameters (such as utm_source) or an advertising click identifier, we store them in a first-party cookie and in your browser's local storage for up to 90 days so we can attribute a later signup to that campaign. If your browser sends the Global Privacy Control signal, advertising click identifiers are not stored (campaign parameters still are). Influencer referral codes are stored for 7 days.
• Advertising pixels: our website (not the extension) loads measurement tags from Google Ads, Meta, X, TikTok and Reddit. These tags may set their own cookies and tell those platforms that you visited our site or signed up. Each platform's use of that data is governed by its own privacy policy. These tags are not loaded when your browser sends the Global Privacy Control signal (see Your California privacy rights).
• You can block or clear cookies in your browser settings. Blocking cookies does not affect the extension's core features.

Data storage and security

• Local wishlist data is stored in your browser's extension storage.
• Cloud data is stored in Supabase's secure, encrypted PostgreSQL database.
• All communication uses HTTPS encryption.
• Row-level security ensures users can only access their own data.

Your rights

• You can delete your wishlist data at any time through the extension.
• You can delete your account and all data at any time from your account settings.
• You can disable all alerts at any time.
• You can opt out of our server-side ad conversion reporting by emailing info@tcgsherpa.com with the subject "Do Not Sell or Share". We will stop reporting your account's events to advertising platforms within 15 business days. The advertising tags on our website are withheld when your browser sends the Global Privacy Control signal, and are otherwise controlled by your browser's cookie settings and by each platform's own ad preferences.

Data retention

• Account, wishlist, alert and signup data (including the signup IP address, user agent and attribution record) are kept for as long as your account exists and are deleted when you delete your account.
• Email delivery and engagement logs (which messages were sent, delivered, opened or bounced) are kept for deliverability and abuse monitoring and are deleted on request.
• Advertising platforms retain the conversion reports we send them according to their own policies; we cannot delete those on your behalf, but you can opt out of future reports as described above.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the rights below. We honor these requests from all users regardless of residence.

• Categories of personal information we have collected in the past 12 months: identifiers (email address, account identifier, IP address, browser user agent); internet activity (products you save, alerts you set, pages you visit on our site, and the campaign or click identifiers on links you arrived from); and commercial information (the products you track). We collect this directly from you and from your browser. We do not collect sensitive personal information and do not sell personal information.
• Purposes: providing the service, sending alerts you opted into, security and abuse prevention, and measuring whether our advertising leads to real use of the product.
• Right to know what personal information we collect, use, share and disclose about you, and to receive a copy of it.
• Right to delete your personal information, subject to legal exceptions. Deleting your account from account settings is the fastest way.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information. To opt out of our server-side conversion reports to advertising platforms, email info@tcgsherpa.com with the subject "Do Not Sell or Share". To stop the advertising tags on our website, turn on Global Privacy Control in your browser (see below), block third-party cookies, or use each platform's ad-preference controls (Google, Meta, X, TikTok, Reddit).
• Right to non-discrimination. We will not deny you the service, charge a different price or provide a different level of service for exercising any of these rights.
• How to submit a request: email info@tcgsherpa.com from the email address on your account, or describe the account so we can verify you. We confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days with notice). An authorized agent may submit a request on your behalf with your written permission.
• Global Privacy Control: we honor the Global Privacy Control (GPC) browser signal as a request to opt out of the sale or sharing of personal information for that browser. When your browser sends the signal, our website does not load the advertising tags from Google Ads, Meta, X, TikTok or Reddit and does not store advertising click identifiers from the links you arrive on. No account or further action is needed. The signal applies only to the browser that sends it; to opt your account out of our server-side conversion reports on every device, email us as described above.

Children

TCG Sherpa is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the "Last updated" date above. Material changes that affect how we share your data will also be announced by email to account holders.

Contact

For privacy questions, contact us at info@tcgsherpa.com.