LEGAL

Privacy policy.

In short: without an account, your collection stays in your browser. Only when you create an account, sell cards to us or trade with other collectors do we store the data needed for that – and only for that. No tracking, no ads, no selling of data.

This is a translation for convenience. The German version is the legally binding one.

1. Controller

2. What we store and when

3. Visiting the website and server logs

When you open a page, the server processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, status code and browser and operating system identifiers. This is necessary to deliver the page, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The logs are only kept for as long as these purposes require and are deleted afterwards.

4. Cookies and browser storage

We only set cookies that are technically necessary for the respective function (Section 25(2) no. 2 TDDDG). They don't need consent, and there are no third-party cookies.

• __Host-pokecards-preview – unlocks the private preview after entering the access code, 12 hours.
• pokecards_session – keeps you signed in; until you close the browser or, with "Stay signed in", up to 14 days.
• .AspNetCore.Antiforgery.* – protects forms from being submitted in your name by other sites; until you close the browser.
• .AspNetCore.Mvc.CookieTempDataProvider – carries a success message (e.g. "Request sent") to the next page; deleted afterwards.
• .AspNetCore.Culture – remembers the language when you switch it; 1 year.
• Identity.TwoFactorRememberMe – only if you choose "Remember this device" during two-factor sign-in.

The website also stores on your device what you create there yourself: your album (IndexedDB) and your sell stack (localStorage). Without an account this data never leaves your device; we can neither see nor restore it. You delete it by removing the website data in your browser. "Export collection" and "Import file" also work locally only.

5. User account

An account is optional; collecting and browsing work without one. For the account we store your email address, your password only as an irreversible hash, your language, the time of registration and last sign-in and – if you set it up – your two-factor sign-in data. When you register we record that you agreed to this privacy policy, with time, version and IP address, so that we can prove it. Optionally you choose a public collector name.

The legal basis is providing the account you want to use (Art. 6(1)(b) GDPR), and for the proof of consent our legitimate interest (Art. 6(1)(f) GDPR). The data is kept as long as the account exists. There is no delete function in the account yet; write to us and we'll delete it (see 12.).

6. Your collection in the account

When you're signed in, the website syncs your album with your account: cards, quantities, wishlist, language, edition, condition and your own photos of front and back. That way your album is backed up and available on every device. The photos are kept in non-public storage and only delivered to you. Others only see the cards from your album that you explicitly offer (see 8.). The legal basis is Art. 6(1)(b) GDPR.

7. Selling to us

When you send us your sell stack, we store first and last name, email address, optionally your phone number and preferred way of contact, your message, the cards with variant and quantity and the history of the request (review, quote, your decision). We need this data to assess the cards, make you an offer and complete the purchase (Art. 6(1)(b) GDPR). The estimate on the "Sell" page is calculated by our server from the price list without storing any personal data.

Only you and the staff who handle purchases can see the request; their accounts are protected by two-factor sign-in. If a purchase goes ahead, we keep the records as long as commercial and tax law require (usually up to ten years, Art. 6(1)(c) GDPR). Requests without a purchase are deleted at your request.

8. Marketplace between collectors

If you mark a card as available for trade or sale, it is visible to all visitors on the marketplace: card, language, edition, condition, quantity, your asking price and your note, plus your collector name or – without a name – a short code that can't be traced back to your account. Your email address isn't shown there. You can end the listing at any time in the card dialog of your collection.

If someone sends you a request, only the two of you see its content (price idea or trade wish, message, reply). Only when the card's owner accepts the request do we show you each other's email addresses, so you can sort out the rest directly. You trigger this disclosure yourselves; it serves the contact you want (Art. 6(1)(b) GDPR). You agree the trade or purchase between yourselves; we are not involved. What you send each other afterwards is your own responsibility.

9. Emails

We send you emails when they belong to a function you use: confirming your email address, resetting your password, account security notices, status updates on your sale and notifications about marketplace requests. We don't send newsletters or advertising. For delivery we use an email service provider that delivers the messages on our behalf (Art. 28 GDPR).

10. Card images from an external server

The catalogue images of the cards are loaded directly from the server images.pokemontcg.io, a third-party service for Pokémon card data. For technical reasons your browser transmits your IP address, the time of the request and your browser identifier to this server. We have no influence on the processing there; it may also take place outside the European Union. The images are only used to recognise the right card. The legal basis is our legitimate interest in an understandable card selection (Art. 6(1)(f) GDPR). Your own photos never go to this service.

11. No analytics, no advertising

We don't use analytics or tracking tools, advertising networks or social media plugins. Fonts, stylesheets and scripts are served from this server. We don't sell personal data or pass it on for advertising purposes.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). If you consented to something, you can withdraw that consent at any time for the future. You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the federal state where you live.

Requests, including deleting your account, to: admin@wirkaufendeinepokecards.de . Please write from your account's email address so we can identify you.

13. Changes

If new features are added that process further data, we update this policy beforehand.

As of: 15 October 2026