Privacy notice — DiscoverTCG

1. Who we are

DiscoverTCG is operated by Stockulate Ltd, a private limited company registered in England and Wales (company number 15893175, registered office 12 Lansbury Road, Sutton in Ashfield, Nottinghamshire, NG17 5DL). In this notice, “DiscoverTCG”, “we”, “us” and “our” refer to Stockulate when it decides how and why personal information is used for DiscoverTCG.

For privacy questions or rights requests, email support@discovertcg.com.

2. Information we may use

The information involved depends on how you use the website or app.

Account and contact information: email address, authentication records, display name and communications with us.
Profile and role information: whether you join as a collector or store, profile preferences and onboarding choices.
Store information: business name, public address, contact details, opening information, verification materials, product listings, prices and quantities.
Community content: stock findings, store references, photos, comments, validations, reports and moderation history.
Messages between you and a shop: if you message a shop through DiscoverTCG, we hold the conversation and everything in it, together with who sent each message and when. The shop can read the whole conversation and can give it a private label of its own for its records; that label is visible only to the shop. We can read conversations only where it is necessary to investigate a report, keep someone safe, or meet a legal obligation.
Subscription and billing information: if a shop takes a paid Store Profile, we hold the fact of the subscription, its status and renewal dates, and the identifier Stripe gives the customer record. We never see or hold card details — the payment is taken on Stripe’s own pages. Stripe acts as merchant of record and holds the billing name, address and any VAT number the shop supplies.
Listing corrections: if you use the form on a shop’s page to tell us its details are wrong, the name and email address you give us, how you know the shop, the changes you propose and any notes, plus a keyed hash of your network address used only to limit abuse of the form. Corrections are reviewed by a person and are never published as sent.
Location and map information: an approximate or precise location if you choose to provide device permission, locations attached to findings, and destinations requested for directions.
Technical and usage information: device and browser type, IP address, app version, diagnostic events, security logs and interactions needed to operate and protect the service. On the website this includes cookieless, aggregate page-view measurement that does not identify you or follow you to other sites.
Shop activity measurement: so that a shop can see how it is doing on DiscoverTCG, we count the things collectors do around it — opening a shop’s page or shelf in the app or on this website, following it, tapping its phone number, website or directions, opening a card and asking which shops nearby stock it, and the search terms typed into the app or into the card lookup on this website. Each record carries a pseudonymous key (your account identifier if you are signed in, otherwise a salted hash of your network address and browser) so that people can be counted once, and any location is rounded to roughly one kilometre before it is stored. Shops only ever see counts — how many collectors, never who — and we show nothing at all below a minimum number of people, so that a small number cannot point at an individual. A shop’s own staff are never counted against their own shop. On this website, a Global Privacy Control or Do Not Track signal from your browser switches this measurement off.
Setting-up measurement in the app: so that we can see which steps of getting started work and which lose people, the app records that each step happened — the app being opened, the age question being answered, the first-run screen being shown and which button was chosen, a sign-in prompt appearing and being completed, the scanner being opened, the camera permission being granted or refused, the scanner recognising a card, and a first card being added to a collection. Each record carries a random key created when the app opens, kept only in memory and gone when the app closes, so the steps of one session can be joined up without following you between them. No card image or camera frame is ever involved, and no search term, product or location is recorded here. Nothing is shared with anyone outside DiscoverTCG. You can switch it off at any time under Settings → Privacy in the app, where it is called “Help us improve the app”; for anyone under 18 it is off unless they turn it on, and once someone tells us they are under 13 the app records nothing further for that session.
The card scanner and your collection: the scanner matches what the camera sees against a list of cards stored inside the app itself. Card images never leave your device and we never receive or store a camera frame. The cards you keep in your collection, and the binders and boxes you sort them into, are stored against your account so they follow you to another phone.

Please do not include other people’s personal information in a photo, comment or report unless you have a lawful reason and their permission where required.

3. Why we use information

UK data protection law requires us to have a lawful basis for each purpose. The bases that are expected to apply are set out below and must be reviewed as features are launched.

Purpose	Typical information	Lawful basis
Create and secure your account	Email, authentication and security records	Contract; legitimate interests in preventing misuse
Provide role-aware app features	Profile, role, store and community content	Steps before or performance of our contract with you
Show nearby stores, findings and routes	Location, map requests and public store data	Consent for device location where required; contract for requested features
Moderate content and protect members	Reports, content, account and technical records	Legitimate interests in operating a safe and trustworthy service
Reply to enquiries and rights requests	Contact details and correspondence	Legitimate interests; legal obligation where applicable
Improve reliability and understand performance	Diagnostics and limited usage information	Legitimate interests; consent where non-essential device storage requires it
See which steps of setting up the app work, and which lose people	That each setting-up step happened, joined by a key lasting only as long as the app is open	Legitimate interests — making the app work for the people who install it. Off by default under 18, and switchable off by anyone in Settings → Privacy
Show shops how many collectors looked for them and what collectors near them are looking for	Shop activity measurement (pseudonymous, location rounded, counts only)	Legitimate interests in running a useful directory for shops and collectors, with the safeguards described in section 2
Deliver alerts you have asked for, including a shop’s promotions	Your follows and watches, alert preferences, device tokens	Contract (you chose to follow or watch); you can mute, unfollow or switch off pushes at any time
Send optional product news	Email and marketing preferences	Consent, or another lawful route where specifically permitted

Where we rely on legitimate interests, those interests include maintaining service security, responding to members, improving reliability and protecting the quality of community information. We consider the impact on you before relying on this basis.

5. International transfers

Some service providers process information outside the United Kingdom. In particular, Google (push notification delivery) and Stripe (subscription payments) are United States companies, and our hosting and database providers may process data in the European Economic Area or the United States depending on the region a service runs in. Where personal information is transferred internationally we rely on a lawful transfer mechanism — a UK adequacy regulation where one applies, or approved contractual protections such as the UK International Data Transfer Addendum.

You can ask us for more information about the safeguards relevant to your information.

6. How long we keep information

We keep personal information only for as long as needed for the purposes described above, including legal, safety, fraud-prevention and dispute requirements. The exact period depends on the record and feature.

Account and profile information is generally kept while the account is active and for a limited period after closure where needed for security, disputes or legal obligations.
Community content may remain visible until removed, expired or moderated. Some limited records may be retained after deletion to prevent abuse or document moderation decisions.
Support and privacy correspondence is retained for an appropriate period to resolve the request and demonstrate the response.
Listing corrections are kept while they are under review and afterwards as a record of why a shop’s details changed; the network-address hash is removed as soon as a correction is reviewed.
Security and diagnostic logs are kept for shorter operational periods unless an incident requires longer investigation.
Shop activity measurement is kept as individual records for 90 days and then only as daily totals per shop, which are not personal information.
Setting-up measurement is kept the same way: individual records for 90 days, then only daily totals of how many people reached each step, which are not personal information. Deleting your account erases the individual records held against it.
App error reports — what went wrong, where in the app it happened, and which version of the app and of the phone’s system it ran on — are sent only while “Help us improve the app” is switched on in the app’s settings. They carry no account, device or network identifier, and are deleted after 30 days.
Messages between a collector and a shop are kept while the conversation exists, so that both sides keep their history. Closing your account removes your messages from the shop’s inbox.
Billing records are kept for as long as tax and company law require, which in the United Kingdom is generally six years from the end of the accounting period.

We will define and document feature-specific periods before the relevant processing goes live.

7. Your data protection rights

Depending on the circumstances and lawful basis, you may have rights to:

ask for access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase information;
ask us to restrict how information is used;
receive certain information in a portable format;
withdraw consent at any time, without affecting earlier lawful use; and
complain to the Information Commissioner’s Office.

Your right to object

You may object to processing based on our legitimate interests. You may also object at any time to personal information being used for direct marketing.

You can delete your account yourself, at any time, from Settings → Your account in the app. It takes effect immediately and removes your profile, uploaded photographs, saves, watches, messages, alerts, reports and verifications. Full details, including the little we keep, are on our account deletion page. To exercise any other right, email support@discovertcg.com. We may need to verify your identity. Rights can be subject to legal limits, and we will explain if an exception applies.

You can complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.

8. Children and young people

We know a service about trading cards will be used by under-18s, so we treat DiscoverTCG as covered by the Information Commissioner’s Age Appropriate Design Code rather than relying on a minimum age in our terms.

You must be 13 or over. We ask for your date of birth the first time the app opens — before the map loads and before we use your location at all, because the question has to come before the thing it governs. We ask once. If you tell us you are under 13, we cannot let you in.

If you are under 18, six protections apply automatically. They are not settings, they are how the account works, and you cannot be persuaded out of them:

You do not appear on the public leaderboard.
Your public profile shows your name and when you joined — not your avatar, your bio, or any record of what you have reported or where.
You cannot exchange private messages with a shop, and a shop cannot message you.
Shops cannot send you promotions. We do not market to children.
Your location is switched off. The map still works — it just starts on the whole UK rather than where you are. You can turn location on yourself in one tap when you want shops near you, and while it is on the map shows a clear “Location on” marker that turns it off again. It is also in Settings.
Setting-up measurement is off unless you turn it on yourself in Settings → Privacy. If you tell us you are under 13, the app records nothing at all.

You keep the rest of the service: the map, search, reporting a find, following shops, release alerts and free event tickets all work normally, and you can always see your own activity and progress. The protections lift by themselves on your eighteenth birthday.

Report locations are private to their author whatever your age — they are used only to check a report was made at the shop, and are never shown to anyone else.

Changing a declared date of birth is not something you can do yourself, because that is how a child would leave the protections. Email support@discovertcg.com if we have it wrong.

If you believe a child has provided personal information inappropriately, contact us so we can investigate. If you are a parent or guardian and want an account closed, tell us and we will do it.

9. Security

We use proportionate technical and organisational measures designed to protect personal information, including access controls, authenticated sessions, database row-level security and restricted administrative access. No online system is completely secure, so members should use a unique password and keep account credentials private.

10. Changes to this notice

We will update this notice as DiscoverTCG features, providers or legal requirements change. Material changes will be brought to members’ attention through an appropriate channel before new processing begins where required.

11. Contact us

For questions, complaints or rights requests:

DiscoverTCG / Stockulate
support@discovertcg.com
United Kingdom