Privacy Policy

Last updated October 14, 2026

This policy explains what xtcgx.com collects, why, and your choices. We keep it minimal: no ads, no tracking cookies, and we never sell your information.

What we collect when you visit

Basic visit statistics: the page viewed, the date and time, your approximate location (country and city, provided by our host Cloudflare), device type, browser and operating system, the website that linked you here, and how long the page took to load.

Visitors are counted with a code that changes every day and cannot be turned back into your IP address. We do not store IP addresses for visit statistics.

If you have an account

Your username, your PIN in hashed form (never the PIN itself), anything you choose to add to your profile (first and last name, email, location, about me), and your collection (card quantities and set choices).

Login records

To protect accounts, each login attempt records the time, the username entered, whether it worked, your IP address, approximate location, browser and operating system. Failed attempts are counted to block password guessing.

Cookies and local storage

We set one strictly necessary cookie only when you log in, to keep you signed in for up to 30 days or until you log out. It cannot track you on other sites.

Your browser's local storage keeps display settings (filters, saved filters, folded series), unsaved changes and an error log. These stay on your device.

How we use information

To run and secure the site, keep you signed in, show the collection, understand overall use (visitor numbers, popular pages) and fix problems. Only the site administrator can see visit and login statistics.

Sharing and other services

We do not sell or rent personal information and use no advertising networks. Cloudflare provides our hosting, security and database and processes requests to the site. Card images load directly from TCGdex's image server (assets.tcgdex.net) and set symbols from the Pokémon TCG API's image server (images.pokemontcg.io); both receive your IP address like any site you load images from. We may disclose information if the law requires it.

How long we keep it

Visit statistics and login records are deleted after about 90 days, and failed-login counters after 1 day. Account and collection data are kept until the account is deleted.

Security

All traffic uses HTTPS, PINs are hashed, sessions use secure cookies, and statistics are visible only to the administrator. No system is 100% secure.

Your choices and rights

You can browse without an account. Account holders can edit their profile at any time. To get a copy of your data or have it deleted, ask the site owner. Depending on where you live (for example under the GDPR or CCPA), you may have more rights, and we will honor them.

Children

xTCGx is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes

We may update this policy. The date above shows the current version.