Privacy Policy

This Privacy Policy explains how War Room (also referred to as "TCG War Room," "we," "us," or "our") collects, uses, shares, and protects information about visitors to tcgwarroom.com and users of our services (the "Services").

Plain-English summary: We collect the account, profile, collection, transaction, alert, device, usage, feedback, and photo information needed to run and improve War Room. We use service providers for hosting, email, notifications, card scanning, diagnostics, and backups. We don't sell your data, run targeted ads, or share your data with third-party marketers. You can delete your account in your web profile or the iOS app, or contact us at contact@tcgwarroom.com.

1. Information We Collect

1.1 Information you give us directly

• Account and sign-in information — your email address; a password hash if you set a password; and the login links, tokens, or 6-digit codes used to sign you in.
• Profile information — your username, display name, bio, and profile-visibility choice.
• Collection information — the cards you track and details you enter, such as purchase and sale prices, dates, notes, condition, and grading certificate data.
• Sales, orders, and shipment information — sales proceeds, fees, venue, and open-order or shipment details you enter.
• Alert and notification choices — tracked-card and restock preferences, push-notification device tokens and platform, optional Discord or Telegram destinations, and feedback about alert delivery, opens, cart taps, or purchases.
• Feedback and photos — feedback descriptions, the page URL, browser details, viewport, and a short tail of browser-console output submitted with a report; collection photos and card-scan images you upload.

1.2 Information collected automatically

• Signup and sign-in data — signup IP address, User-Agent string, UTM source, referrer, magic-link or code request IP address, and login-failure counts.
• Log, browser, and analytics data — including IP address, browser and device information, pages visited, request timestamps, and coarse location derived from IP address. Cloudflare also provides cookieless Web Analytics.
• App activity data — first-party activation and usage events, including an installation or device ID, app version, and event names.

1.3 Information we do not collect

We do not ask for phone numbers, mailing addresses, government IDs, biometric data, professional or employment history, or demographic characteristics such as gender, race, or religion. We do not use social-media login or buy personal data from third-party data brokers. Purchase and sale prices that you enter describe your card collection and transactions; War Room does not collect payment-card or bank-account details to process payments.

2. How We Use Information

We use the information we collect to:

• Provide and personalize the Services, including signing you in, displaying your profile and collection, tracking transactions, orders, and shipments, scanning cards, and delivering alerts.
• Respond to inquiries you send to contact@tcgwarroom.com.
• Send sign-in links or codes, tracked-card and restock alerts, administrative notices, and product or feature emails. Product emails include activation reminders to accounts that have not added items yet and feature reminders to active users, such as those who have not set a username or added a sealed product. Every such product email includes an unsubscribe link.
• Understand activation and usage trends, troubleshoot feedback, and improve the Services.
• Protect the Services from abuse, investigate failures, and enforce login and request limits.

We do not use your information for targeted advertising, marketing by third parties, profiling for automated decisions with legal effects, or any sale of personal information.

3. Legal Bases for Processing (EU/UK Users)

If you are in the European Economic Area, the United Kingdom, Iceland, Liechtenstein, Norway, or Switzerland, the General Data Protection Regulation (GDPR) and the UK GDPR require us to identify the legal basis for processing your personal data. We rely on:

• Performance of a contract — when we use account, collection, transaction, and notification information to provide the Services you request.
• Legitimate interests — for security, fraud prevention, service diagnostics, product communications, and identifying usage trends to improve the Services, balanced against your privacy rights.
• Legal obligation — when applicable law requires us to retain or disclose information (e.g., responding to a lawful subpoena).
• Consent — for any processing that doesn't fit the above bases; we will ask for your consent and you may withdraw it at any time.

4. How We Share Information

We do not sell or "share" personal information for advertising purposes as those terms are defined under the California Consumer Privacy Act (CCPA), Connecticut Data Privacy Act (CTDPA), Colorado Privacy Act (CPA), or any similar state law.

We do disclose certain information to the following categories of service providers who process data on our behalf and only as needed to provide the Services:

• Hosting, content delivery, security, and analytics — Oracle Cloud Infrastructure runs the application and stores the database. Cloudflare provides content delivery, security, and a cookieless Web Analytics beacon.
• Email — Resend delivers sign-in, alert, administrative, product, and feature emails.
• Push and optional notifications — Apple Push Notification service delivers iOS push notifications. The ntfy service delivers notifications to users who opt in and sends feedback reports to the operator. Discord and Telegram receive notifications only when a user configures one of those destinations.
• Card scanning — card-scan images are sent to the Google Gemini API to identify cards. If that does not succeed, the Anthropic API is used as a fallback.
• AI-assisted diagnostics — feedback descriptions, page URLs, user IDs, and log excerpts may be sent to Google Gemini to help diagnose issues. Do not include sensitive information in feedback reports. Information sent to Google Gemini is processed under Google's terms.
• Backups — database backups may be copied to a cloud storage provider and are processed under that provider's terms.

These providers receive only the information used for their part of the Services and process it under their applicable terms.

We may also disclose information when required by law (e.g., in response to a valid subpoena or court order) or in connection with a merger, acquisition, or sale of business assets. We will provide notice of the latter to the extent legally permitted.

5. International Data Transfers

War Room is based in the United States. Our service providers may process information in the United States and other countries where they operate. If you use the Services from elsewhere, your information may therefore be transferred across borders.

Where cross-border transfer laws apply, we use the transfer safeguards made available under our service providers' terms and take other steps required by applicable law.

6. Cookies and Similar Technologies

The Services use Cloudflare Web Analytics, which loads a small JavaScript "web beacon" from cloudflareinsights.com to record aggregate visitor statistics. Cloudflare Web Analytics is cookieless — it does not set tracking cookies on your device.

We use the first-party cookies warroom_user, dashboard_token, wr_app, and wr_native for sign-in, session, and app-mode behavior. The sign-in session lasts up to 30 days. Your browser also uses localStorage to remember preferences.

We do not use targeting cookies, social-media cookies, retargeting pixels, advertising tags, or any third-party tracking beacons other than the cookieless Cloudflare Web Analytics beacon described above. Links in restock alerts pass through our own first-party /d/... path, which records that the alert was opened or tapped before sending you to the retailer.

7. Data Retention

We retain account information while your account is active. You can request deletion yourself from your web profile or in the iOS app, or email contact@tcgwarroom.com. Your account is deactivated immediately. All associated records — including your collection, sales, price targets, profile, username holds, activity events, alert feedback, trade matches, and uploaded photos — are permanently deleted within 45 days of the request. If you sign in again with the same email before that purge, your account is restored and the deletion request is canceled.

After the permanent deletion, backup copies containing the deleted information are retained for up to 30 additional days before they roll off.

8. Your Privacy Rights

To the extent required by applicable law, you may have specific rights regarding your personal information. The availability of each right depends on the privacy law in your jurisdiction.

Subject to applicable law, you may request to:

• Access — Receive a copy of the personal information we hold about you.
• Correct — Update inaccurate or incomplete information.
• Delete — Have your personal information erased, subject to legal retention requirements.
• Port — Receive your personal information in a structured, machine-readable format.
• Restrict — Limit how we process your information.
• Object — Opt out of processing based on legitimate interests.
• Withdraw consent — Where processing is based on your consent.
• Appeal — If we deny a request, you may appeal by replying to our response email.

Account deletion is self-serve in your web profile and in the iOS app. To exercise any other right, email contact@tcgwarroom.com from the email address associated with your account. We will respond within the time required by applicable law (typically 30–45 days). We do not charge a fee for these requests.

Where required by law, you may also lodge a complaint with your local data protection authority — for example, your state Attorney General in the United States, the Information Commissioner's Office in the United Kingdom, or your national Data Protection Authority in the European Union.

9. State-Specific Privacy Disclosures (United States)

This Privacy Policy describes our practices under US state privacy laws to the extent they apply to us. Those laws have different coverage thresholds and requirements. Regardless of whether a particular law applies, we offer the privacy choices described in Section 8.

California residents may make the access, correction, deletion, and portability requests described in Section 8. The disclosures below use the categories in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

9.1 Categories of personal information collected (CCPA terms)

• Identifiers — email address, IP address, username, display name, login tokens and codes, installation or device ID, and push device token.
• Customer-record information — account and profile information and the purchase prices, sale proceeds, and fees you enter.
• Internet or other electronic activity — pages visited, referrer and UTM source, browser and device information, app version, activity-event names, alert interactions, and feedback diagnostics.
• Geolocation data (coarse) — country-level location derived from IP address.
• Commercial information — collection items, prices, dates, notes, condition, grading certificate data, sales, fees, venues, orders, shipments, price targets, and restock preferences.
• Visual information — collection photos and card-scan images you upload.

We do not use these categories of information for targeted advertising or sell or share them for cross-context behavioral advertising.

9.2 Sale / sharing of personal information

We do not sell personal information. We do disclose certain information to service providers as described in Section 4 above ("Disclose only," not "Sale" or "Share" under CCPA terms).

Our disclosures to service providers are described in Section 4. The Cloudflare Web Analytics beacon is cookieless, and we do not use advertising or retargeting pixels.

9.3 Global Privacy Control (GPC)

We do not "sell" or "share" personal information for cross-context behavioral advertising, so a Global Privacy Control signal from your browser has no operational effect on our processing — there is no sale or share for us to opt you out of.

9.4 California "Shine the Light" (Cal. Civ. Code § 1798.83)

We do not share personal information with third parties for those parties' direct marketing purposes.

9.5 Non-discrimination

We will not deny, charge different prices for, or provide a different level of service to users who exercise their privacy rights.

10. EU/UK/Swiss Users

Users in the EU, UK, and Switzerland have the rights described in Section 8 where provided by the General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection (FADP).

Data controller: War Room (TCG War Room), an operation based in the United States.

Contact: EU, UK, and Swiss users may contact us at contact@tcgwarroom.com about privacy requests or questions.

International transfers: Information may be processed outside your country as described in Section 5.

11. Canadian Users

Users in Canada may exercise the rights available under applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec Law 25, by contacting us as described in Section 16.

12. Australia and New Zealand Users

Users in Australia or New Zealand may contact us as described in Section 16 to exercise rights available under the Australian Privacy Act 1988 or the New Zealand Privacy Act 2020.

13. Children's Privacy

The Services are intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact contact@tcgwarroom.com and we will delete that information promptly.

14. Security

We use appropriate technical and organizational measures to protect personal information, including:

• HTTPS / TLS encryption on all connections to the Services.
• Cloudflare hosting, security, and DDoS protection.
• Per-IP and per-account request limits and login-failure tracking.
• Hashed storage for passwords when a password is set.
• Access controls for account data and operator systems.

No security system is perfect. If we ever experience a personal-data breach that triggers a legal notification requirement (e.g., GDPR Art. 33, state breach-notification laws), we will notify affected users and applicable regulators within the required timeframe.

15. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" at the top of this Policy. If a change materially affects how we handle personal information, we may also provide notice through the Services or by email.

16. Contact

Questions about this Privacy Policy, or requests to exercise your privacy rights: email us at contact@tcgwarroom.com.