Privacy Policy
Last updated: November 6, 2026
TCG Besties ("we", "us") runs the online card shop at tcgbesties.com. This page explains what information we collect, why we collect it, who it goes to, and how to reach us about it. Short version: we collect only what we need to fill your order or run a giveaway. We don't sell your information, and we don't use advertising or tracking tools.
What we collect
When you place an order. Checkout runs on Stripe. You enter your payment details on Stripe's page, and they never reach our servers. After you pay, Stripe sends us your name, email address and shipping address, and we save them with your order: what you bought, prices, shipping choice, tax and the order total.
When you enter a giveaway. Your name, your email address, and your confirmation that you're 18 or older and live in the United States. To stop people from entering many times, we also keep a scrambled code made from your internet (IP) address. It changes every day, can't be turned back into your address, and is deleted after a day or two.
When you ask to hear about a restock. Your email address and the item you're waiting for.
When you sell cards to us (when our buylist is open). Your name, email address, any note you add, and the list of cards. If we accept your cards, we record the store credit you earn, keyed to your email address.
What you search for. The words you type in the search box are sent to our servers to suggest matching cards. They aren't linked to you.
We don't collect phone numbers, birthdays, or payment card numbers.
How we use it
- To fill, ship and support your order, including returns and refunds
- To run giveaways: picking a winner, contacting them and following the official rules
- To tell you when an item you asked about is back in stock
- To handle cards you sell to us and track your store credit
- To keep the shop secure and stop fraud or abuse
- To keep the records we need for taxes and accounting
We don't send marketing emails, and we don't add you to a mailing list. Giveaway details are used only to run that giveaway.
Who we share it with
We share information only with the services that run the shop, and only what each one needs:
- Stripe processes payments and sends payment receipts. Stripe's privacy policy applies to what you enter at checkout: https://stripe.com/privacy
- Cloudflare hosts our website and stores our data and images: https://www.cloudflare.com/privacypolicy/
- Shipping carriers (such as USPS) receive your name and address on the shipping label.
- Card image hosts. Some card pictures load straight from the card databases that publish them, such as Scryfall, Lorcast, TCGdex and the Pokémon TCG API. Like any website, those hosts can see your IP address and browser type when your browser loads the image. They get nothing else about you.
We may also share information if the law requires it, or to protect our customers or the shop from fraud. We don't sell or rent your personal information, and we don't share it for advertising.
Cookies and browser storage
The shop doesn't set any cookies. Your browser stores your cart, your cart layout choice, and (when the buylist is open) your sell list, so they're still there when you come back. These stay on your device, and you can clear them anytime in your browser settings. We don't use analytics, advertising pixels, or anything that follows you to other sites.
Because we don't track you across websites, your browser's "Do Not Track" setting doesn't change anything here.
Google sign-in (staff only)
Our staff can sign in to the shop's admin area with Google. When they do, we receive the staff member's name, email address and profile picture from Google. We use them only to confirm the person is allowed into the admin area. We don't share Google account data with anyone, don't use it for advertising, and delete it when a staff account is removed. Shoppers never sign in with Google.
How long we keep it
- Orders and store credit records are kept as long as we need them for taxes, accounting and returns.
- Giveaway entries, restock requests and buylist submissions are kept until you ask us to delete them, unless they're tied to an order or store credit we have to keep.
- The daily scrambled IP codes are deleted after a day or two.
Your choices
You can ask us to:
- tell you what information we have about you,
- correct anything that's wrong, or
- delete your information (except records we must keep for taxes or an open order).
Email support@tcgbesties.com from the address you used with us. We answer within 30 days, usually much sooner. We may ask a question to confirm it's really you.
Security
Every page uses an encrypted (HTTPS) connection. Payment details are handled by Stripe and never touch our servers. Only our staff can see order details, and they sign in with Google, a passkey, or a one-time email link.
Children
The shop is for adults and isn't directed at children under 13, and we don't knowingly collect their information. Giveaways are for people 18 or older. If you think a child has given us information, email us and we'll delete it.
Where we operate
We're based in the United States and ship only within the United States. Your information is stored with our US-based service providers.
Changes to this policy
If we change this policy, we'll update it here and change the date at the top. If the change is significant, we'll also post a notice on the site.
Contact us
Email support@tcgbesties.com with any question about your privacy or this policy.