Privacy Policy

Last Updated: October 2026

This Privacy Policy explains how CardTracker.au ("we", "our", "the Site") collects, uses, discloses, and protects personal information when you visit the Site, create a CardTracker account, use the CardTracker Marketplace, or interact with our associated community channels. We operate from Australia and handle personal information in line with the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth).

Most of the Site can be browsed anonymously, with no account and no sign-in. You only need an account to list a card, to message another member, or to report a listing.

1. Browsing the Site (No Account)

• Usage data: we use Google Analytics (via Google's gtag.js) and a Reddit conversion pixel to understand aggregate traffic patterns, such as which pages are visited and how the Site is discovered, so we can improve the service. This data is not used to identify you personally.
• Technical and network data: our infrastructure provider, Cloudflare, processes standard request data such as IP address and browser type as part of serving, caching, and protecting the Site, consistent with Cloudflare's own privacy policy.
• Newsletter email address: if you voluntarily sign up to our "Monthly TCG Updates" mailing list, your email is collected and stored by our newsletter provider (Kit) to send you market recaps and deal updates. You can unsubscribe at any time via the link in any email we send.

2. Google User Data: How We Access, Use, Store, and Share It

CardTracker accounts are created by signing in with Google ("Google Sign-In"). We use Supabase Auth as our identity provider, which performs the OAuth exchange with Google on our behalf. This section describes, comprehensively, our handling of Google user data.

What Google user data we access. We request exactly two OAuth scopes, both of which Google classifies as non-sensitive:

• email — your Google account email address, and whether Google has verified it.
• profile — your basic public profile, which is your name and, if you have one, your profile picture URL.

We request no other scopes. We do not access your Gmail messages, contacts, Drive files, Calendar, Photos, YouTube data, or any other Google service, and we are technically unable to do so because we never request the permissions that would allow it.

How we use Google user data. Solely to create and operate your CardTracker account:

• Your email address identifies your account, lets you sign back in, and is the address we send service notifications to (such as that a member has messaged you about a listing).
• Your basic profile is received as part of the standard sign-in response. We do not publish it. In particular, we deliberately do not use your Google name as your public display name, and we do not use your Google profile picture anywhere. You choose your own display name on first sign-in, so your real name is never published unless you choose to use it.

We do not use Google user data for advertising, for profiling, for building marketing lists, or to train machine learning or AI models.

How we store Google user data. We store your email address, and a Google-account reference identifier, in our own database (Cloudflare D1) so that we can recognise you on your next sign-in and link you to your listings, messages, and reviews. We do not store your Google password, which we never receive at any point. We do not store Google OAuth access tokens or refresh tokens. The authentication token returned by the sign-in exchange is used only to confirm your identity at that instant, is never written to storage, and is never exposed to your browser; we then issue our own session cookie, of which only a one-way hash is retained.

How we share Google user data. We do not sell it, and we do not share it with advertisers, data brokers, or any third party for their own purposes. It is disclosed only to the service providers that operate the sign-in and notification functions on our behalf, namely Supabase (authentication) and Cloudflare (database hosting and delivery of notification emails), and only for those purposes. Your email address is never displayed publicly on CardTracker and is never visible to other members. We may disclose data where required by law, or where reasonably necessary to investigate fraud or protect members' safety.

Retention and revocation. We retain this data for as long as your account exists. You can delete your CardTracker account at any time (see section 10), and you can independently revoke CardTracker's access to your Google account at any time via your Google Account's security settings at myaccount.google.com/permissions. Revoking access prevents future sign-ins; to also remove the data we already hold, request account deletion.

Limited use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. If we ever change how we use Google user data, we will update this policy and notify account holders before the change takes effect.

3. Account Information We Store

• Email address, used to identify your account and to send you service notifications (for example, that someone has messaged you about a listing).
• Display name that you choose. This is public.
• Postcode, if you provide one. This is used to show buyers your general area and to support local filtering. Your postcode is never displayed publicly; only the derived state (for example "VIC") is shown.
• An internal account identifier and a reference to your identity record held by our authentication provider.
• Session records, consisting of a hashed session token, the browser user-agent string, and timestamps. We store only a one-way hash of the session token, never the token itself.
• An activity log of security-relevant account events, such as sign-ins, settings changes, and moderation actions, kept as a support and dispute trail.

4. Marketplace Information We Store

• Listings you create: the card, its condition, language, edition and other attributes you select, your asking price, your description, whether you accept trades and what you would accept, and the market price we recorded at the time.
• Photographs you upload for a listing. These are stored in Cloudflare R2 and are publicly viewable as part of your listing. Please do not include anything in a photo that you do not want public. Where our guidance asks you to include a handwritten note showing your display name and the date, use your CardTracker display name, not your legal name or any other personal detail.
• Messages you exchange with other members about a listing. These are private between you, the other party, and our moderators where a report is made. They are retained so that both parties have a record and so we can investigate disputes and scam reports.
• Reviews you leave or receive after a completed trade, including the rating and any comment. These are public.
• Reports you submit about a listing or a member, including the reason you provide. Reports are visible to our moderators, not to the person you reported. We do not tell the reported person who reported them.
• Blocks you set against another member, used to prevent further contact.
• Notification records, noting that a particular type of email was sent to you and when, so we can rate-limit how often we email you.

5. What Is Public and What Is Not

This distinction matters, so to be explicit:

• Public, visible to anyone including people who are not signed in: your display name, your listings and their photos and descriptions, the state derived from your postcode, whether you accept trades, and reviews you have received.
• Visible only to the other party: the content of your messages.
• Never shown publicly: your email address, your postcode itself, your Google profile information, your session and activity records, and the identity of anyone who submits a report.

6. How We Use Your Information

• To operate your account and keep you signed in.
• To publish the listings you choose to publish, and to let members contact each other about them.
• To send service notifications, such as a new message about your listing, or a reminder asking whether a listing is still available. We cap these notification emails so you are not emailed repeatedly.
• To benchmark a listing against our market data.
• To moderate the Marketplace: investigating reports, hiding or removing listings, and suspending accounts that breach our terms.
• To protect the Site against fraud, abuse, and security threats.
• To comply with our legal obligations.

We do not use your Marketplace activity, your messages, or your Google sign-in data for advertising, and we do not use them to train machine learning models.

7. Who We Share It With

We do not sell your personal information. We share it only with the service providers needed to run the Site:

• Supabase, which provides authentication and holds the identity record created when you sign in with Google.
• Google, as your sign-in provider, and separately Google Analytics for aggregate usage statistics.
• Cloudflare, which hosts the Site, stores our databases and your uploaded listing photos, and delivers our notification emails.
• Kit, which stores newsletter subscriber emails, if you subscribed.

We may also disclose information where required by law, or where reasonably necessary to investigate suspected fraud or to protect the safety of our members.

Other members will see the information described as public in section 5, and will see the content of messages you send them. Treat anything you put in a listing or a message as information you have chosen to share with that person.

8. Overseas Disclosure

Our service providers operate global infrastructure, so your personal information may be stored or processed outside Australia, including in the United States and other countries where those providers operate. We take reasonable steps to ensure providers handle personal information consistently with the APPs, but by using the Site you acknowledge that this overseas handling occurs and that overseas recipients may be subject to different privacy laws.

9. Security

We take reasonable technical measures to protect your information: we never store your Google password, we store only a one-way hash of your session token, session cookies are set as HttpOnly and Secure so they cannot be read by scripts or sent over an unencrypted connection, and access to our databases is restricted. No system is completely secure, however, and we cannot guarantee absolute security of information transmitted over the internet.

10. Retention and Deletion

We keep account information for as long as your account exists. Listings, messages, reviews, reports, and moderation records are retained while they remain relevant to the integrity of the Marketplace, including as evidence in a dispute or scam investigation.

The account activity log described in section 3 is kept for 180 days and then deleted automatically.

You can ask us to delete your account at any time, by emailing info@cardtracker.au from the address your account uses. When we do, we remove your account record, your listings, and your uploaded photos. Please note two limits on deletion: messages may be retained in the other party's conversation history, because they are that person's record of a dealing as much as yours, and we may retain moderation records, reports, and reviews where removing them would conceal fraudulent or abusive conduct from other members or where we are required to keep them by law. Retained records are minimised and de-identified where it is practical to do so.

11. Affiliate Links and Cookies

Many links on CardTracker.au are affiliate links (including via the eBay Partner Network and other affiliate or referral programs). Clicking these links may set a tracking parameter or cookie on the destination site so that, if you make a purchase, we may earn a commission. We do not control or receive any of your payment or account information from these third-party transactions. See our Return Policy for more detail on our role as an affiliate publisher.

Separately, we set a session cookie when you sign in. That cookie exists only to keep you signed in and is not used for advertising or cross-site tracking.

12. Community Platforms

Our Discord, WhatsApp, Telegram, and Reddit communities are hosted on their respective third-party platforms. Any information you provide when joining or participating in those communities, such as your username, is governed by that platform's own privacy policy, not this one. Your CardTracker account is separate from those platforms and is not linked to them.

13. Children

The Marketplace is not intended for children. You must be at least 16 years old to create a CardTracker account, and if you are under 18 you should only deal with other members with the involvement of a parent or guardian. We do not knowingly collect personal information from children, and if we become aware that we have, we will delete it.

14. Your Rights

You can request access to, or correction of, the personal information we hold about you, and you can request deletion of your account and its associated data, subject to the limits described in section 10. You can also change your display name and postcode yourself at any time in your account settings, and unsubscribe from the newsletter using the link in any newsletter email.

To make a request, or to raise a privacy complaint, contact us via our Contact Us page. We will respond within a reasonable period. If you are not satisfied with how we handle your complaint, you can escalate it to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above, and where the change materially affects how we handle your personal information we will take reasonable steps to notify account holders.