Privacy Policy

• Account: your e-mail, and a password (stored only as a secure hash by our sign-in provider).
• Profile: display name, handle, picture, bio, city and province, and the links you add.
• Seller verification: for individuals a government ID, phone and shipping address; for stores the BIR Certificate of Registration and business permit.
• Orders: name, mobile number, e-mail and delivery address, the cards bought, and payment status.
• Payments: made on Maya's pages. We receive the result and the payment type (QR Ph or card), never your full card number.
• Your activity: collection, albums, wishlist, listings and photos, offers, trades, messages, reviews and event sign-ups (name, mobile, optional e-mail and payment receipt).
• Contact messages you send us.
• Technical: a sign-in cookie, your theme choice and (as a guest) your collection, kept in your browser; and standard server logs.

• To create and secure your account, and to verify sellers
• To process orders and payments, hold and release payouts, and handle disputes and refunds
• To show your public profile, listings, galleries and events to others, as you choose
• To send the e-mails you need (orders, payments, shipping) and the ones you've switched on (new orders, offers, trade offers, event sign-ups)
• To prevent fraud, enforce our Terms and meet legal duties

• Sellers you buy from see your name, mobile number and delivery address, so they can ship.
• Stores running an event you join see your sign-up details and receipt.
• Other users see only what you make public: your profile, public albums, listings and reviews. Contact details stay private; people talk through TCGFlea messages.
• Service providers that run TCGFlea for us: Supabase (database, sign-in, file storage), Vercel (hosting), Resend (e-mail) and Maya (payments). A store that connects its own inventory system receives the orders for its cards through that connection.
• Authorities, when the law requires it.

Website link icons on profiles are loaded from Google's icon service, which sees that your browser asked for them.

As long as your account is open. Order and payment records are kept for as long as Philippine tax and accounting rules require, even after an account is closed. Seller documents are kept while the seller account is active and as the law requires afterwards. Event sign-ups are kept by the store running the event.

Edit your profile and links in Account; make albums private; switch e-mail notifications off in Settings; and ask us to see, correct or delete your data through Contact Us. Your rights under the Data Privacy Act are in our Data Privacy notice.

Data is sent over HTTPS, access to it is limited by account and role, seller documents and receipts are stored privately and opened only through short-lived links, and payments are handled by Maya. No system is perfect; tell us right away if you think your account was misused.

We'll update this page when our practices change and show the date at the top. Significant changes are announced on the site or by e-mail.