Privacy Policy

Last updated: 14 July 2026

This Privacy Policy explains how TCG Hamster (“we”, “us”), operated by Joe Steele (a sole trader trading as TCG Hamster), collects, uses, and protects your personal data when you use our platform. We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

1. Data we collect

  • Account data: your display name, email address, and authentication details when you sign in with email and password, Discord, or Google, plus two-factor authentication settings if enabled.
  • Profile data: information you add to your profile, such as username, approximate location (postcode area), and preferences.
  • Listing and transaction data: the cards you list, want, trade, sell, and the offers and messages associated with them.
  • Delivery data: the postal address, recipient name, and contact details you provide to send or receive cards, used to create shipping labels and complete deals.
  • Payment data: transaction amounts and payout details. Card payments are handled by Stripe — we do not store your full card number.
  • Uploaded content: images of cards you upload, including any submitted to our AI condition scanner.
  • Technical data: IP address, browser type, and usage data collected automatically when you use the platform.
  • Fraud-prevention signals: to protect our rewards and referral programmes from abuse, we store a one-way hashed (irreversible) form of your IP address and a fingerprint of the payment card you use, and match these across accounts to detect one person operating several accounts. We do not store your IP address in plain text and do not use these signals for any other purpose.

2. How we use your data

  • To create and manage your account.
  • To operate the platform — matching trades, processing offers, and facilitating transactions.
  • To provide intermediary, purchase, and grading services you request.
  • To send you notifications about activity relevant to you.
  • To detect, prevent, and address fraud, abuse, and security issues — including detecting multiple accounts operated by one person to abuse rewards or referrals.
  • To comply with our legal obligations.

3. Lawful basis

We process your data on the basis of: contract (to provide the service you sign up for); legitimate interests (to operate, secure, and improve the platform); consent (where required, for example certain cookies); and legal obligation (for example, record-keeping).

4. Sharing your data

We share data only as needed to run the service:

  • Service providers who host and support the platform, including Supabase (database and authentication), Vercel (hosting), Stripe (payments and payouts), Resend (transactional email), and ShipEngine (shipping labels and tracking). These providers receive only the data needed to perform their function — for example, Stripe receives payment details, and our shipping provider receives the delivery address for a deal.
  • AI providers (Anthropic) where you use the AI condition scanner, limited to the images and data needed for that feature.
  • Partners(including Collector's Isle) where you request an intermediary, purchase, or grading service that they fulfil.
  • Other users, where necessary to complete a trade or sale — for example, your display name and the details needed to ship cards once a deal is agreed.

We do not sell your personal data.

5. Data retention

We keep your personal data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and fraud prevention requirements. You can request deletion of your account at any time (see your rights below).

6. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request erasure of your data.
  • Object to or restrict certain processing.
  • Request a copy of your data in a portable format.
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at hello@tcghamster.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on our database. No system is completely secure, but we work to protect your information and to notify you and the relevant authorities of any breach where required.

8. International transfers

Some of our service providers may process data outside the UK. Where that happens, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised “last updated” date and notify you of material changes.

10. Contact

For any privacy questions or requests, contact us at hello@tcghamster.com.