Privacy policy

Last updated 3 October 2026 · Effective 3 October 2026

This policy explains what the TCG Tracker AU app collects, why, who sees it, and how to get it deleted. It is written in plain English on purpose. If anything here is unclear, email [email protected] and a person will answer.

1. Who we are

TCG Tracker AU is built and run by Cameron Koorengevel, a sole trader in Australia, ABN 92 861 674 264. We are the data controller for the app.

We are not affiliated with, endorsed by, or connected to Nintendo, Creatures Inc., Game Freak, The Pokémon Company, Bandai, Wizards of the Coast, or any retailer named in the app. Product names and images belong to their owners and appear only to tell you what is in stock.

The app is available on Android through Google Play and on iPhone through the App Store.

2. What we collect

2.1 Things you give us

• Email address, when you create an account. Used to sign you in and to reset your password. Nothing else.
• Name and contact number, only if you enter a competition. Used to run the draw and contact the winner. If you turn on automatic entry, these are kept on your account so you are entered into future competitions until you turn it off.
• Promo codes you redeem, so we know your Pro access came from a code and when it ends.
• Email address for the price stand waitlist, only if you join it on our website. Used only to tell you when the stand is available. It isn't linked to an app account.

2.2 Things collected automatically

• Push notification token. A random identifier issued by Expo, Google (Android) or Apple (iPhone) when you allow notifications. It is how a restock alert reaches your phone. It is deleted if you turn notifications off.
• When you open the app. The app refreshes your notification token each time it comes to the front. We use that to count how many members use the app each day. We do not record what you look at.
• Which alerts you tap. When you tap a push notification we log which alert it was and when. This tells us which alerts are useful.
• Potion ads you finish watching. Watching a rewarded ad for a daily pass is recorded so the pass can be granted and so we can check the count against the ad network's report.
• Your alert preferences. The card games and stores you follow are stored on our servers so your alerts follow you between devices.
• Subscription status. If you subscribe to Pro or send a tip, Google Play or the App Store tells us that a purchase happened and when it ends. We never see your card number or payment details. Google or Apple handle the payment entirely.
• Session and IP address. Our authentication provider records the IP address and device type of each sign in, as almost every online service does. We use this only for security and to enforce bans (see section 8).
• Crash reports. If the app crashes, it records the error message, where in the app it happened, your app version and your account ID, so we can find and fix the cause. Nothing else from your phone is included.

2.3 Things that stay on your phone

These are stored on your device and never sent to us: your wishlist, which alerts you have already seen, the four hour passes for store checkers, and your display settings. You can clear them from Settings.

2.4 Advertising

The free version of the app shows ads through Google AdMob. Pro members see no ads.

On Android, AdMob uses the advertising ID Google provides on your device. You can reset or limit it in your device settings.

On iPhone, the advertising identifier is only used if you allow tracking when the app asks. If you decline, you still get ads, just not personalised ones.

Before ads are shown you are asked for consent through Google's consent tool. You can change your choice from Settings in the app.

When you finish a rewarded ad for a daily pass, Google sends our server a verification message that includes your account ID, so we know which account earned the pass.

Google's privacy policy covers how they use advertising data: policies.google.com/privacy

2.5 Affiliate links

Some links to retailers may be affiliate links. If you buy after tapping one, the retailer may pay us a small commission. It costs you nothing and the price is the same as going to the retailer yourself.

Affiliate links have no effect on which products we alert you about, which retailer an alert points at, or how fast the alert reaches you. Those come from what is actually in stock and nothing else. Most of the retailers we watch pay us nothing at all, and they are alerted on exactly the same as the ones that do.

Section 4 explains what an affiliate link means for your data.

2.6 Things we do not collect

• Your location. Store selection is a list you pick from.
• Contacts, photos, files, or anything else on your phone.
• Payment card details.
• What you do outside the app.

3. How we use it

Only to run the app: sign you in, send the alerts you asked for, remember your preferences, run competitions, grant passes and Pro access, show ads to free members, keep the service secure, fix crashes, and understand how many people use it so we can keep it running.

We do not sell your information. We do not use it for marketing outside the app. We do not build profiles of you.

4. Who we share it with

Each of these receives only what it needs to do its job.

• Supabase, our database and sign in provider. Holds everything in sections 2.1 and 2.2. supabase.com/privacy
• Railway, which runs the servers that check stores and send your alerts. It handles your push token and alert preferences to do that. railway.com/legal/privacy
• Expo, which delivers push notifications on both platforms. Receives your push token. expo.dev/privacy
• Zoho ZeptoMail, which sends our account emails: sign-up confirmation and password reset. Receives your email address. zoho.com/privacy.html
• Google: Firebase Cloud Messaging delivers Android notifications, AdMob serves ads to free members, Google Play handles subscriptions and tips, and Gmail is where we read and answer support email. policies.google.com/privacy
• Apple: the Apple Push Notification service delivers iPhone notifications, and the App Store handles purchases on iPhone. apple.com/legal/privacy
• Cloudflare, which hosts this website and forwards email sent to [email protected]. cloudflare.com/privacypolicy
• Discord, only if you set up a webhook. Your alerts are then sent to the channel you chose.
• Affiliate networks. If a retailer link is an affiliate link, it passes through that retailer's affiliate network on the way. The network sees what any website sees when you open it: your IP address, your device and browser type, and the fact that you arrived from our app. We do not send it your email address, your account ID, or anything that identifies you.
• Retailers. Tapping a product opens the retailer's own website or app. From there you are on their site, under their privacy policy.

We do not share your data with anyone else.

This website

tcgtrackerapp.com uses no cookies and no advertising. Cloudflare Web Analytics counts page views without cookies and without identifying you. If you join the price stand waitlist, the email address you type goes to our Supabase database and nowhere else. Cloudflare, which hosts the site, processes your IP address and browser details to deliver and protect it.

5. Where it is stored

On Supabase's servers, which may be outside Australia. By using the app you agree to that transfer. Data is encrypted in transit and at rest.

6. How long we keep it

• Account data (email, preferences, push token, subscription status): until you delete your account.
• Competition entries (name and contact number): deleted within 60 days of the competition closing. Automatic entry details stay on your account until you turn automatic entry off.
• Alert tap, potion and crash logs: kept while your account exists, used only in aggregate.
• Price stand waitlist (email address): until we've told you the stand is available, or sooner if you ask us to remove it.
• Ban records: see section 8.

7. Your rights and how to delete your account

You can delete your account yourself at any time from Menu, then Settings, then Delete My Account at the bottom. Enter your password to confirm and everything is removed straight away. Step by step: delete your account.

You can also ask us to show you what we hold, correct it, or delete it. Email [email protected] from the address on your account. We answer within 30 days, and account deletion is completed within 48 hours. Deleting your account removes your email, preferences, push token, competition entries, and logs.

Under the Australian Privacy Act 1988 you can also complain to the Office of the Australian Information Commissioner if you think we have got something wrong.

8. Bans

If an account is removed for abuse, threats, or breaking competition rules, we keep a small record so the same person cannot simply make a new account: the email address, phone number, account ID, or IP address involved. That record is used only to stop the banned person returning. It is never shared and is not used for anything else.

9. Children

The app is for people 13 and over. We do not knowingly collect information from anyone younger. If you think a child has made an account, email us and we will delete it.

10. Security

Supabase encrypts data in transit and at rest and enforces row level security, so an account can only ever read its own data. We never hold payment details. No system is perfectly secure; if we ever learn of a breach affecting your information we will tell you and the relevant authorities as Australian law requires.

11. Changes

When this policy changes, the date at the top changes with it. Significant changes are announced in the app.

12. Contact

Email: [email protected]
Cameron Koorengevel, TCG Tracker AU, ABN 92 861 674 264, Australia