Privacy policy
How the TCG On Wheels app handles your data.
Effective October 1, 2026 · Applies to the TCG On Wheels app (scan.tcgonwheels.com, the Android and iOS apps) and tcgonwheels.com.
TCG On Wheels ("we", "us") is a trading-card pricing and buy-offer tool built by the team behind OKC Rips Cards & Collectibles in Oklahoma City. This policy explains what we collect, why, and the choices you have. The short version: we collect what we need to run your account and your lots, we never sell your data, and you can delete your account at any time.
What we collect
| Data | Why | Where it comes from |
|---|---|---|
| Account identity: email address, display name, and a hashed password (or a Google / Apple sign-in token) | To create and secure your account and sign you in | You, or Google / Apple when you use their sign-in |
| Your settings: offer percentages, shop name, logo for the offer sheet | So your offers use your rates on every device | You |
| Lots, buy history, portfolio and deal records: card names, quantities, conditions, prices, your notes | The product itself. Syncs across your devices and your team | You |
| Camera images, when you choose Photo ID or scan a barcode | To identify the card. The image is sent to our server and a card-recognition provider, then discarded. We do not store your photos | You, only when you tap the camera |
| Usage events: which screens you open, searches you run, lookups counted against your plan, plus device type and browser | To meter your plan, fix bugs and see which features matter | Automatically |
| Billing: plan, subscription status and a Stripe customer id | To run paid plans | Stripe. We never see or store your card number |
| Feedback and bug reports you send | To respond and fix things | You |
| Referral code use | To credit the friend who referred you and you when you refer others | You |
What we do not collect
- No precise location. No contacts. No advertising identifiers.
- No payment card numbers. Stripe handles checkout on its own pages.
- No photos stored. Card images sent for identification are processed and discarded.
Who else sees it
We use a small set of service providers, each limited to the job described:
- Cloudflare hosts the app and database.
- Stripe processes subscriptions and stores your payment method.
- Card-data providers (price and sales-history APIs, card image recognition) receive your search text or card image, never your identity.
- Google and Apple, only if you sign in with them.
We do not sell personal data and we do not share it with advertisers. The free plan shows promotional cards for our own shop (OKC Rips) and our own products. Those are not third-party ads and no data is shared to show them.
If you join a team on the Shop plan, the team owner can see the lots, buy history and portfolio that belong to that team. Your personal settings and password stay yours.
How long we keep it
- Account, settings, lots and history: until you delete them or your account.
- Usage events: 90 days, then deleted.
- Billing records: as long as required for tax and accounting.
Your choices
- Delete your account. In the app, open the menu (More on a phone) → Settings & rates → delete account, or email tcgonwheels@gmail.com from your account email. We remove your account, settings, lots, history and portfolio within 30 days. Billing records required by law are kept.
- Export your data. Pro and Shop plans can export buy history as CSV in the app. Email us for a full export.
- Camera. The app only asks for the camera when you tap Scan or Photo ID. You can revoke the permission in your device settings at any time and keep using typed search.
- Email. We send account and billing emails only. There is no marketing list.
Children
The app is for people 13 and older running a card business or collection. We do not knowingly collect data from children under 13. If you believe a child has created an account, email us and we will delete it.
Security
Passwords are stored as salted PBKDF2 hashes. All traffic is encrypted in transit. Sessions expire after 30 days of inactivity. Staff access to production data is limited to the owners and is logged.
Changes
If this policy changes in a way that matters, we will note the new effective date here and tell you in the app before it takes effect.