Privacy Policy

Toplodr is the Pokémon TCG tracker at toplodr.com. This policy covers that site. It does not cover Google, Discord, TCGdex, TCGPlayer, Cardmarket, or other sites you may visit from here.

What we store depends on how you use the site:

• Browsing and search. Queries and catalog pages are processed on our servers so we can return results. Recent searches can stay in this browser so the sidebar can show them.
• Guest collection and watchlist. Quantities and watched card ids stay in this browser until you sign in, then they can merge into your account.
• Account profile. Username, email, password hash (we do not store the password itself), and optional Google or Discord account ids if you use those sign-in buttons.
• Email verification and email-change tokens, so we can confirm an inbox.
• Sessions. A random session token in an httpOnly cookie, plus IP address and browser user-agent so you can review devices and so we can rate-limit sign-in attempts.
• Collection and watchlist on an account, stored in our Postgres database (Neon).
• Support tickets you submit (wrong id, missing art, and similar reports), if you use those tools.

• Provide search, catalog, prices, binders, and watchlist.
• Keep you signed in and let you manage or delete the account.
• Send verification and email-change messages through Resend when that service is configured.
• Prevent abuse (login rate limits, session review).
• Operate and improve the catalog (including language catalogs and artwork checks).

We do not sell your personal information. We do not run advertising networks or third-party analytics on Toplodr today.

• Neon hosts the database (accounts, sessions, collection, watchlist, catalog cache, tickets).
• Resend sends transactional email when API keys are configured.
• Google or Discord receive you only if you choose those sign-in buttons. They authenticate you and return a profile (typically id, email, and a name hint). Their own policies apply on their sites.
• TCGdex supplies card data and marketplace price snapshots. We request catalog and price data; we do not send your Toplodr password or collection to TCGPlayer or Cardmarket.
• Card images may be served from our object storage (R2) at api.toplodr.com or from TCGdex asset URLs.
• The public site may sit behind a CDN or host firewall (for example Cloudflare). Those providers can see IP addresses as part of delivering the site.

Toplodr uses first-party cookies that are needed to run the product: the sign-in session, a short-lived OAuth state cookie during Google or Discord sign-in, and a catalog-language preference. Browser storage also holds guest collection, watchlist, search history, and list-display preferences. Details are in the Cookie Policy.

Sessions last about 30 days of use, then expire. Login-attempt rows are kept long enough to enforce rate limits. Account data stays until you delete the account. Guest browser data stays until you clear it or it is merged and replaced by the account copy. Email tokens expire after they are used or they time out.

• Update username, email, and password, or review and sign out devices, from Account.
• Delete your account there. That permanently removes the account, synced collection, watchlist, and sessions.
• Clear this site’s cookies and storage in your browser to remove guest data and language preference.
• Disconnect Google or Discord from their own account settings as well as from Toplodr if you no longer want those providers linked.

Accounts are for people 13 or older. If you believe we have an account for a child under that age, delete it from Account if you can, or stop using the account and clear browser data. We will remove such accounts when we learn of them.

Toplodr may be hosted and accessed from more than one country. If you use the site from the EU, UK, or similar jurisdictions, we process account and session data to provide the service you request (search, an account, email verification) and to keep that service secure. You can delete your account at any time.

We will update this page when our practices change — especially if we add analytics, advertising, or new processors. The date at the top will change when we do.