Legal · Privacy
Privacy Policy
CP.TCG recognizes cards on your device and an account is optional. This policy explains what changes when you use online features.
1. Scope and controller
This policy applies to the CP.TCG mobile application for iOS and Android and to cptcg.app. CP.TCG is developed and operated by AristiDevs (Aris Guimera), who acts as the data controller for the personal data described here.
CP.TCG is an independent companion for collectors and is not affiliated with CD PROJEKT RED, WeirdCo, or the Cyberpunk TCG.
2. Information we process
The information involved depends on the features you choose to use. Guest mode does not require you to provide identity information.
- Local app data: collection entries, quantities, card condition and language, wishlist, decks, settings, and app preferences.
- Optional account data: email address, internal user identifier, and session tokens. Sign-in is currently by email and password; the password is stored hashed and we never see it.
- Optional synchronized content: collection, wishlist, decks, price alerts and their notices, and live trades (participant identifiers and the name each participant chooses, cards, currency, status, and timestamps).
- Notifications: a device push identifier and platform when you enable notifications, linked to your internal user identifier.
- Subscriptions: an account-linked purchase identifier, product, Pro entitlement, renewal status, and transaction status. Apple, Google, and RevenueCat process the purchase; CP.TCG does not receive your full payment-card details.
- Technical data: app version, operating system, IP address, and operational data that our infrastructure providers may log while providing the service.
- Support data: your email address and any information you include when you contact us.
3. Camera and local storage
Camera access is optional and is used only when you open the scanner. Card names and printed numbers are recognized on your device. Camera frames and photos you pick from your gallery are not uploaded to CP.TCG or stored on our servers.
In guest mode, your collection and related content remain in your device's local storage and may be included in its backups depending on your settings. Deleting the app or clearing its storage may permanently remove local data unless you previously enabled synchronization.
4. Why we process data and our legal bases
We process data to provide authentication, optional backup and cross-device synchronization, card and price features, price alerts, live trades, notifications, subscriptions, customer support, security, fraud prevention, and service reliability.
Where the GDPR or similar law applies, we rely on performance of our agreement with you for requested app features; your consent for optional permissions where consent is required; our legitimate interests in securing, maintaining, and improving CP.TCG; and legal obligations. You can withdraw a permission or consent through your device or app settings without affecting earlier lawful processing.
5. Service providers and sharing
We do not sell personal data. We disclose only the information needed for the services you use to providers acting on our behalf or as independent controllers.
- Supabase (EU servers, Frankfurt) provides authentication, database hosting, synchronization, and server functions.
- RevenueCat, together with the App Store and Google Play, manages the subscription offering, the Pro entitlement, purchase status, and restoration.
- OneSignal delivers price-alert notifications through Apple Push Notification service and Google's Firebase Cloud Messaging.
- Apple and Google provide app-store and notification services.
- Vercel hosts cptcg.app and may process request metadata needed to deliver and secure the site.
- TCGplayer (via TCGCSV) is the price source. The app downloads a public price file; none of your data is sent.
- Authorities or professional advisers may receive data when required by law or reasonably necessary to protect rights, users, and service security.
6. International transfers
Some providers may process information outside your country or the European Economic Area. When required, we rely on adequacy decisions, contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. You may contact us for more information about safeguards relevant to your data.
7. Retention
Local data remains on your device until you delete it, clear app storage, or uninstall the app, subject to device backups. Account and synchronized content are kept while your account is active or as needed to provide the feature.
When you delete your account we delete the data linked to it. Limited information may remain temporarily in protected backups or be retained when required for security, fraud prevention, disputes, or law. Shared trade records may preserve the other participant's data; your identifying data will be removed or de-identified where applicable. Support correspondence is retained only as long as reasonably needed to resolve the request.
8. Security
We use safeguards appropriate to the data and service, including encrypted network connections, authentication, access controls, and database rules that separate user records. No method of storage or transmission is completely secure, so we cannot promise absolute security. Keep your device and credentials protected.
9. Delete your account and data
You can delete your account at any time in the app under Profile → Delete account: your account and its associated server data are removed. You can also request it by emailing aris.guimera@gmail.com from your account's address with the subject “CP.TCG account deletion”; we may ask you to verify ownership.
Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account to prevent future billing. Data stored only on your device can be removed from the app or by deleting the app and its backups.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of personal data, and to withdraw consent. You may also complain to your local data-protection authority; in Spain, this is the Agencia Española de Protección de Datos (AEPD).
Email aris.guimera@gmail.com to exercise a right. We will respond within the time required by law and may request reasonable verification. Some rights are subject to legal exceptions.
11. Children
CP.TCG is not directed to children under 14, or a higher minimum age where local law requires it, and we do not knowingly collect their personal data without the authorization required by law. If you believe a child provided personal data improperly, contact us so we can investigate and delete it.
12. Changes and contact
We may update this policy when CP.TCG, its providers, or legal requirements change. The current version and its date will remain available at this URL; material changes will be highlighted in the app or on the site when appropriate.
For privacy questions, requests, or complaints: AristiDevs (Aris Guimera), aris.guimera@gmail.com.