Privacy

Your collection is private. You choose whether to share a collection template.

Who is responsible

Peaceful_William, Sweden, is the operator responsible for personal data in this app — an individual running it as a free hobby project, not a company. Contact: privacy@senseiset.com. Write to that address for the operator’s full identity where you need it to exercise a right.

What we use and why

When you sign in, we receive your provider’s account identifier and, where available, verified email address. We store those details, account creation and last sign-in times, and a hashed session token so you can securely use your account. We do not store your Google or GitHub password.

We store the collections, card inventory, conditions, quantities, preferences, selected prints, price overrides and history you save. We use these to provide the collection service you request (performance of our agreement with you). Account data is required for saved collections; browsing does not require an account.

If you make a share link, anyone who has that link can see the cards you chose for it (your wanted cards and/or cards you own), the title you gave it and the name you typed for it, if any. Never your email, prices, quantities or conditions. Share pages are kept out of search engines. Turn a link off on the share dialog at any time; deleting your account removes them all.

If you connect an AI assistant to your account, we store which app you connected (the name it gives itself and where it sends you back to), what you allowed it to do, when you connected it and when it was last used, and hashed access tokens. The assistant receives the collection details it asks for, and what it does with them is governed by that assistant’s own terms. Disconnect it on your Account page at any time; deleting your account removes every connection.

If you upload an image as a binder cover, we store that image. It is private to your account: only you can see it, it is never shown to other people or used for anything else, and it is not included in collection exports. Upload only images you have the right to use.

If you submit a template, vote or missing-card report, we store that submission and its review outcome. Approved templates publish their name, description, chosen display name and curation rules, but not your inventory or email. The reviewer can see the submitting account’s email. Security and moderation serve our legitimate interests in protecting the service and other users.

Who receives information

Cloudflare provides hosting, database storage and delivery. Google or GitHub handles sign-in when you choose that provider. External card-image hosts (including Pokémon TCG, TCGdex and TCGplayer) and any data services your browser requests receive network information such as your IP address. Fonts are served by this site itself, so loading a page sends nothing to a font provider. These providers have their own privacy terms. We do not sell your collection or use it for advertising.

Card pages, pull rate pages and the card view link to shops. eBay links are affiliate links through the eBay Partner Network: when you follow one, eBay records that the visit came from Senseiset (a campaign number and which kind of page you came from) so it can pay Senseiset a small commission if you buy. Senseiset sends eBay nothing about you or your collection, and sees only totals of clicks and sales. Cardmarket links are plain links. Once you are on eBay or Cardmarket, their own privacy terms apply.

Cloudflare acts as our processor under its data processing addendum; Google and GitHub act as separate controllers for the sign-in you choose, under their own notices. All three operate globally, so information may be processed outside Sweden and the EEA. Those transfers rely on the standard contractual clauses and supplementary measures in each provider’s terms; we do not make transfers of our own beyond using these services.

Cloudflare keeps operational logs of requests reaching the service — including IP address and request metadata — under its own retention periods, which are short and measured in days. We do not build profiles from them.

Counting page visits

We count page visits with Cloudflare Web Analytics, which is part of our hosting. It sets no cookies, stores nothing on your device, and does not identify you or follow you across other sites. It tells us totals only: which pages are viewed, which site a visit came from, and the broad type of browser, device and country. We never see individual visitors. We use these totals to learn which pages are useful and how people find Senseiset (our legitimate interest in improving the service).

How long information stays

• Your account and current collection remain until you delete the account. Inactivity alone does not delete a collection.
• Saved price history keeps the most recent 400 days per account; older days are removed by daily maintenance.
• Session tokens expire after 30 days. Expired session rows are removed by daily maintenance or on a later sign-in.
• Recovery backups keep at most 30 automatic copies, 10 manual copies, 5 pre-empty copies and 1 initial-import copy per account. Daily maintenance removes backups older than 90 days.
• Resolved card reports and rejected or superseded templates are removed 90 days after review by daily maintenance. Pending reports/templates and approved templates remain until account deletion or moderation changes their status.
• Uploaded cover images stay until you remove them from a binder, delete the binder, or delete your account. Each account can hold at most 40.
• Deleting an account removes its live database records, including backups, templates, votes and ordinary card reports, deletes every cover image it uploaded, and invalidates all its sessions. Other users’ copies of a previously shared template or downloaded exports cannot be recalled.
• Cloudflare database recovery copies can retain deleted data for up to 30 days on the planned Paid plan. They are separate from the app’s recovery list. Restore procedures must honour prior deletion requests.

Browser caches may remain on other devices or in already open tabs. Account deletion clears this account’s saved app data in the browser handling the request where browser storage is available. You can also clear this site’s data in browser settings. Downloads remain under your control.

Children

You need an account only to save a collection, and sign-in is handled by Google or GitHub, whose own minimum age applies. The Terms set a minimum of 13. We do not knowingly keep an account for anyone younger; tell us at privacy@senseiset.com and it will be removed. We ask for nothing beyond what the sign-in provider returns, and names shown to other people are checked before they are published.

Trading

If you trade, other people see your trader name, country and region (never a city or address), how you trade, your open trade posts with the cards in them, the cards you mark for trade in your collection (signed-in traders only, and you can switch this off on My trades), approved photos, how many trades you have completed, the ratings you received and their comments, and the month your account was created. Never your email address.

Messages are stored so the two people in a conversation can read them. A reviewer reads a conversation only when one of you reports it. Photos on a trade post are shown to everyone; photos in a message are seen only by the two of you (and a reviewer, if the conversation is reported). The app redraws each photo before upload, which removes the location and camera details a phone writes into it. Each photo is checked automatically by an AI model run by Cloudflare (our host) when it is uploaded, to refuse unsafe images and hold back post photos that do not show cards; the photo is not kept by that check. Trader names are normalized to prevent invisible-character duplicates; official role names and domains are not allowed. Reports and upload attempts have daily limits. A post photo is hidden automatically after three different active accounts report it, or one reporter whose account is at least seven days old or has a completed trade. Other reports wait for review.

If you leave it switched on, we e-mail you when another trader writes to you: the trader's name, the post and a link, never the message. Turn it off on My trades or from the link in any such e-mail. Closed and expired posts are deleted after 60 days, unused photos after a day. Blocks and reports are kept for moderation. Deleting your account deletes your trader profile and live posts, photos, conversations, messages and ratings, including messages the other trader can see. To investigate abuse and trading disputes, reports involving the deleted account and the reported content are retained privately for 90 days after deletion, then erased by daily maintenance. When a participant reports a conversation or one of its private photos, this includes that conversation’s messages, offers, photos and ratings. A report about a public post or rating does not give access to unreported private conversations. Only the reviewer can access this evidence; it is not visible to other traders or AI assistants. Unreported conversations are deleted immediately. The archive copies trader names, not account email fields or sign-in credentials; messages and photos can still contain personal details the traders shared.

Limits and suspension

Each account has a daily limit on saved changes, and on how many templates may await review and how many card reports may be filed per day. These protect the service for everyone; reaching one never deletes anything you have saved.

An account may be suspended for abuse or for content that breaches the Terms. A suspended account keeps read access to its own collection and can still export it, but cannot save changes, publish, vote or report, and its published templates stop being shown. Contact privacy@senseiset.com to query a suspension.

Your choices and rights

You can edit collection data, export it from Cloud backups, or delete your account from Account. Signing in again after deletion creates a new, empty account. Google and GitHub accounts are separate even when they use the same email address.

Contact privacy@senseiset.com to request access, correction, erasure, restriction or portability of personal data, or to object to processing based on legitimate interests. These rights depend on the circumstances. We may need to verify your identity. You can complain to Sweden’s privacy authority, IMY. Collection exports do not include every account or moderation record; contact us for a full personal-data request.

Last updated 5 November 2026.