Datenschutzerklärung

TODO: name, postal address, email and telephone of the controller — must match the Impressum

TODO: data protection officer’s contact details, or a recorded decision that none is required under § 38 BDSG

When you register, the following is stored: your email address, a normalised copy of it used to prevent duplicate accounts, your display name, your preferred currency and card language, the times the account was created, last updated and last signed in to, and whether it has been disabled.

Your password is never stored. Only an argon2 hash of it is kept, from which the password cannot be recovered.

Legal basis: TODO: expected Art. 6 Abs. 1 lit. b — contract performance; to be confirmed

Signing in sets one cookie, ptc_session. It holds a random token, is marked httpOnly and sameSite=lax, is transmitted only over HTTPS outside development, and expires after 30 days. It is used solely to keep you signed in. It is not used for analytics, advertising or tracking across sites.

The token itself is not stored on the server. Only a SHA-256 hash of it is kept, so a copy of the database does not yield working session tokens.

Alongside each session the service stores its expiry, when it was last used, whether it was revoked, and — relevant to you — the IP address and browser user-agent the session was created from. These are kept so that sessions can be reviewed and revoked if an account is misused.

Because this cookie is strictly necessary to provide a service you have asked for, no consent banner is shown. TODO: confirm § 25 Abs. 2 Nr. 2 TDDDG applies, and re-confirm if any non-essential cookie is ever added

Legal basis for the IP and user-agent: TODO: expected Art. 6 Abs. 1 lit. f with a documented balancing test

Sign-in and registration attempts are rate limited using your IP address as a key. This happens in the server’s memory only, is never written to the database, and is discarded whenever the service restarts.

Legal basis: TODO: expected Art. 6 Abs. 1 lit. f — security; balancing test required

Everything you record in your Portfolio is stored against your account and is visible only to you: which catalogue card, whether it is raw or graded, quantity, condition, grading company, grade, certification number, purchase price and currency, shipping, grading, marketplace and other costs, any manual value estimate, the acquisition date, where you bought it, and your free-text notes.

For sales: quantity, sale date, sale price and currency, marketplace, order reference, marketplace, payment-processing, shipping and other selling costs, your notes, and the calculated cost basis, proceeds and realised profit.

Note that the notes fields are free text. Anything you type there is stored as you entered it, so avoid recording other people’s personal details in them.

Legal basis: TODO: expected Art. 6 Abs. 1 lit. b — contract performance

Your browser does not contact any third party while using this service. Card images are fetched by this server and served from this domain rather than loaded from an external host, and fonts are served from this domain too. No analytics service, advertising network, tag manager, embedded video or social plugin is used.

The card catalogue is imported from TCGdex (api.tcgdex.net). Those requests are made by this server on a schedule, are not triggered by your visit, and contain no information about you.

Hosting: TODO: hosting provider, company address, server location, and a signed Auftragsverarbeitungsvertrag

Server access logs: TODO: what the reverse proxy logs, where, and for how long — not yet audited

Sessions expire 30 days after they are created and are removed from the database on the next sign-in attempt after that.

Account, Portfolio and sales records are kept until they are deleted. TODO: define retention periods, and note that no self-service account deletion exists yet — see the rights section

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. You may also complain to a supervisory authority.

Honest statement of current capability: this service does not yet offer self-service data export or account deletion. Until it does, such requests are handled manually.

Contact for rights requests: TODO: email address for data-subject requests

Competent supervisory authority: TODO: the Landesdatenschutzbehörde for the operator’s state — name, address, website

This service does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. Prices and market movements shown in the product are illustrative demonstration values and are not derived from your data.

An account cannot be created without an email address and a password. Everything you record in your Portfolio is optional; without it the product simply has nothing to show you. You can use the public catalogue without an account.