Privacy Policy

1. Data controller

The controller of your personal data is Archive by X Mateusz Marmurowicz, ul. Nakielska 144B, 85-391 Bydgoszcz, Polska, NIP (Polish tax ID) 9671475769, REGON 528385250. Contact for anything about your data: hello@tcgpush.com.

2. What data we process

We only offer sign-in with Google (OAuth). From Google we receive: your name, e-mail address, profile picture URL and Google account identifier. The profile picture is not shown publicly (only initials are), and your e-mail is never public.

In the service we also store:

• your nickname (public);
• country and flag, an Instagram handle and one other link (optional, can be hidden);
• collection and wantlist entries: product, colour, size, condition and a flaw note (the note is private; only a "has flaws" marker is public);
• votes on products;
• settings: privacy flags, profile visibility (public, members only, hidden), preferred currency and language;
• a consent record: time and terms version;
• technical server logs (IP address, user agent, time), kept for security for a limited period.

3. Photos and other content you add

When the feature is available, you can upload product photos and outfit photos. Photos may contain personal data, for example a person image. Please upload only photos you have the rights to, and the consent of anyone visible.

• Technical metadata of photos (EXIF, including location) is removed on upload.
• Photos awaiting moderation are stored non-publicly and are visible only to you and the moderator.
• Photos rejected by the moderator are deleted within a limited time.
• Photos and other content are deleted when you remove them and when you delete your account.

4. What is public

Public by default: your nickname and member-since date. Country, links and lists (collection, wantlist) are visible according to your privacy settings, and you can set the whole profile to public, members only or hidden. Published photos are visible to visitors of the service.

5. Purposes and legal bases (GDPR Art. 6(1))

• Art. 6(1)(b): providing the account and the service (sign-in, profile, collection, wantlist, votes);
• Art. 6(1)(c): meeting legal obligations;
• Art. 6(1)(f): our legitimate interests, namely security, preventing abuse, moderation, and defending or pursuing legal claims;
• Art. 6(1)(a): consent where required, for example for cookies that are not strictly necessary (we use none today).

We do not make decisions based solely on automated processing and do not profile users.

6. Recipients and transfers outside the EEA

We use a hosting provider (a VPS in the European Union) and Google for sign-in. Google may transfer data to the USA under the mechanisms provided by law. We do not sell data or share it with advertisers. We may disclose data to public authorities where the law requires it.

We use no analytics tools, advertising or third-party trackers. Fonts are self-hosted.

7. Cookies

We only use first-party cookies. We do not use analytics or advertising cookies. The cookies below are either necessary or remember your choices:

• authjs.session-token: login session (necessary);
• authjs.csrf-token and authjs.callback-url: protection and handling of the sign-in flow (necessary);
• terms_consent: proves your consent during registration (necessary, 15 minutes);
• NEXT_LOCALE: language choice (up to 1 year);
• currency: display currency choice (1 year);
• cookie_consent: stores your cookie choice (12 months).

You can revisit your choice at any time with the "Cookie settings" link in the footer, and you can delete cookies in your browser settings. Deleting necessary cookies signs you out.

8. How long we keep data

• Account, profile, collection, wantlist and vote data: until you delete your account.
• Technical logs: for a limited period needed for security.
• Backups: according to the regular backup rotation, after which deleted data disappears.

You can delete your account yourself in Settings. We then remove your profile, collection, wantlist, votes, sessions and the content you added.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on our legitimate interests. Where we process data on the basis of consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To use these rights, write to hello@tcgpush.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office, Prezes UODO (ul. Stawki 2, 00-193 Warszawa, Poland).

Providing data is voluntary, but signing in with Google is required to create an account.

10. Age

The service is for people aged 16 or over.

11. Changes to this policy

We may update this policy. Every version has a number and a date. After a change we will ask you to accept it again the next time you sign in.