Privacy Policy

Last updated: 27 October 2026.
Note: This privacy policy was prepared carefully but does not replace individual legal advice.

1. Data Controller

The party responsible for data processing on this website under the General Data Protection Regulation (GDPR) is the person named in the Imprint. Contact: cardpuls.site@gmail.com.

2. No Cookies Without Consent

This website only stores technically necessary settings in LocalStorage (e.g. language, currency, region) unless you explicitly agree to more. Analytics and marketing tools such as Google Analytics and Google Tag Manager are only loaded after you actively accept them in the cookie banner. Without your consent, no usage data whatsoever is transmitted to Google. You can withdraw your consent at any time via the "Cookie Settings" link in the footer; your choice is stored locally in your browser (localStorage).

3. Google Analytics / Google Tag Manager (only after consent)

Once you have consented, we use Google Tag Manager (container ID GTM-KDP9S6JD) and Google Analytics 4 (property G-RR8EX2MWXT), services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). These services generate pseudonymized usage statistics (e.g. pages visited, time on site, device type) to analyze and improve the website. This may involve a transfer of data to the USA; Google has self-certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with future effect. After you consent we also use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, USA) – a heatmap and session-recording tool that shows how visitors use the site (clicks, scrolling; form fields are masked). Clarity only runs after your consent; the legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

3a. Advertising (Google AdSense, only after consent)

After you consent in the cookie banner, we may show Google AdSense ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Ads are always labeled as “Ad”. Google may process data such as IP address, device and browser information and cookie identifiers in the process. Currently only non-personalized ads are served. Without your consent, no Google advertising scripts are loaded. You can withdraw consent at any time (“Cookie settings” link in the footer); signed-in users can have ads switched off for their account. Legal basis: Art. 6(1)(a) GDPR.

4. Hosting & Database

The website is served via Cloudflare Pages/Workers, and our database (products and account data, see item 6) runs on Cloudflare D1 (Cloudflare, Inc., 101 Townsend St, San Francisco, USA). Cloudflare processes technically necessary server logs (e.g. IP address, timestamp) to deliver the website securely and reliably. Price data is collected by our backend hosted on Render (Render Services, Inc., San Francisco, USA), which also checks price alerts and triggers notification emails. Both providers have self-certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functioning service) and, for account features, Art. 6(1)(b) GDPR. We count clicks on shop links anonymously and in aggregate (day, shop, product name, page area, region) – without IP address, cookies or any link to you or your account – to see which shops and offers are useful (Art. 6(1)(f) GDPR). We likewise count search terms that returned no results (without IP address and without any link to you) to fill gaps in our catalog.

5. Contact Form

If you contact us via the contact form or email (cardpuls.site@gmail.com), we process the data you provide (e.g. subject, message) solely to handle your request. Submission occurs via the form provider Web3Forms (USA) or directly by email. This may involve a transfer to the USA; where the provider is not certified under the EU-U.S. Data Privacy Framework, the transfer takes place at your explicit request (Art. 49(1)(b) GDPR). Legal basis: Art. 6(1)(b) or (f) GDPR.

6. User Account (Sign-in via Magic Link or Google)

Price comparison and search work without an account. A free account additionally gives you price alerts, a wishlist and the collection tracker. When signing in via email link, we store your email address and a one-time, time-limited login token in our database (Cloudflare D1, see item 4); the login link is sent via the email service Resend (Plus Five Five, Inc., USA), which has self-certified under the EU-U.S. Data Privacy Framework. When signing in via Google, we receive your email address and a unique Google account ID from Google Ireland Limited (see item 3) to create or match your account. After signing in, your browser stores a session token (JWT) in LocalStorage (see item 9), which is sent with requests to our API to keep you signed in. For your account we also store: price alerts (your chosen criteria such as country, shop, set, category, target price/currency; when triggered you receive an email via Resend with a link to deactivate the alert plus a notification under the bell icon, kept for 24 hours), release reminders (set, release date and language; on release day you receive an email via Resend and a notice under the bell icon), the weekly deal email (only if you turn it on in your account: region, language and an unsubscribe token; once a week you receive the biggest price drops via Resend – the legal basis is your consent, Art. 6(1)(a) GDPR, which you can withdraw in your account or via the link in every email), your wishlist (saved products) and your collection (card ID, set, card language, version such as Holo/Reverse, and quantity), your sealed collection (set, product type, quantity, and optionally purchase price, purchase date and a note), plus a daily collection value (cards and sealed, for the history chart), plus your virtual Pack Simulator collection (set, card ID, quantity and highest card price; without an account only locally in your browser), the number of packs opened per series and day (for the daily limit) and the interface language of your account (to choose the language of notification emails). If you enable the share link, anyone with the link can view your cards (without your email address); you can turn it off or renew it at any time. The legal basis is the performance of the user agreement at your request (Art. 6(1)(b) GDPR). You can delete your account yourself at any time in the account menu; this permanently removes your email address, price alerts, wishlist, collection (including sealed products) with its value history, and the share link. Alternatively, an email to cardpuls.site@gmail.com is sufficient.

7. Affiliate / Partner Links

The "Open" / "Best Deal" buttons link to the offer pages of independent partner shops. Some of these are affiliate links (including links to Cardmarket and TCGplayer listings, which carry our referral code or partner link), through which we may earn a commission on a purchase at no extra cost to you. The privacy policy of the respective provider applies on the linked pages.

8. Card Data & Images (TCGdex)

On the guide pages, in the card gallery, in the collection tracker and in the Pack Simulator, set and card lists, card images and card prices are loaded directly from the open card database TCGdex (api.tcgdex.net / assets.tcgdex.net). Your browser connects to TCGdex servers, which technically receive your IP address; your collection itself is not sent to TCGdex. The legal basis is our legitimate interest in displaying up-to-date card data (Art. 6(1)(f) GDPR). Fonts and flags are served locally from our own server.

8a. Cardmarket prices & product images (TCGGO / RapidAPI)

Our server (Cloudflare Worker) retrieves the Cardmarket prices for sealed products once a day through the TCGGO interface (via RapidAPI, Rapid/Nokia of America Corporation, USA). Only product and price data is requested; no personal data of visitors is sent to TCGGO or RapidAPI. Your browser loads the product images of these listings directly from the TCGGO servers (images.tcggo.com), which technically receive your IP address and browser data. The legal basis is our legitimate interest in displaying the products (Art. 6(1)(f) GDPR). If you click a Cardmarket listing, you leave our site and arrive at Cardmarket (the link contains our referral code, see point 7); their privacy policies apply from then on. You can deselect Cardmarket in the shop selection at any time; no Cardmarket images are loaded then.

8b. Riftbound

For Riftbound, card lists, card images and prices are loaded from public sources (Riot Games card gallery, TCGplayer data via tcgcsv.com). Your browser loads images directly from the servers of Riot Games (rgpub.io) or TCGplayer (tcgplayer-cdn.tcgplayer.com), which technically receive your IP address (Art. 6(1)(f) GDPR). We store your Riftbound collection, sealed holdings and price alerts in your account just like for Pokémon (see point 6). Collection, sealed holdings and price alerts are kept separately per region (Germany, Poland, USA) so that prices are compared in the matching currency (EUR, PLN, USD).

9. Local Storage

We store certain settings as technically necessary data in your browser's LocalStorage: language, currency, region, card language and price source in the collection tracker, Pack Simulator data (virtual collection, opening counters – kept only locally without an account), cookie decision, PWA notice, last news item read (bell icon) and — when signed in — the session token (see item 6). To speed up loading, set lists and card prices from TCGdex are also cached for up to 24 hours. Apart from the session token, this data never leaves your device. The recognition model of the card scanner (see point 13) is kept in your browser cache after it has been loaded once. Only if you use the ?ui= parameter in the address (interface preview), the server additionally sets the technically necessary cookie “cp_ui” (selected interface version, valid for 1 hour, no analytics, no tracking). When you deliberately change language or region, we also set the technically necessary cookies “cp_lang” (selected language) and “cp_region” (selected region: PL, DE or US), each valid for 12 months, with no analytics and no tracking; they let the server deliver the page in your language and region right away.

10. Your Rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) regarding your personal data. Contact cardpuls.site@gmail.com for this. You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). There is no decision-making based solely on automated processing, including profiling, that has legal effects on you. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Polish Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). You may also contact the authority in your place of residence.

11. Minors

User accounts are intended for people aged 16 and over. Younger users may only create an account with the consent of a parent or guardian (Art. 8 GDPR). Our service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (U.S. Children's Online Privacy Protection Act, COPPA). If we learn of such an account, we will delete it.

12. Users in the United States

Because CardPulse TCG is operated from the European Union, the protections of the GDPR described above apply to all users, including users in the United States; you can exercise the rights listed in item 10 regardless of where you live. We do not sell your personal information and do not share it for cross-context behavioral advertising. We only disclose personal information to the service providers named above (e.g. Cloudflare, Render, Resend, Google) to operate the service.

13. Card scanner (camera)

The card scanner in the collection tracker uses your device camera only after you have allowed the browser to access it (Art. 6(1)(a) GDPR); you can withdraw that permission at any time in your browser settings. The camera images are processed locally in your browser only. They are not transmitted to us or to third parties and are not stored. Only the recognition model and the card index are loaded from our own server (card-pulse.org); card data and images then come from the providers named in points 8 and 8b.

14. Automatic region detection

On your first visit your browser calls the Cloudflare service of our own domain (/cdn-cgi/trace) to derive the approximate country from your IP address and preselect language, currency and region. The IP address is processed only technically by Cloudflare (see point 4) and is not stored by us; only the chosen setting is kept locally in your browser (see point 9). You can change language, currency and region yourself at any time. Legal basis: Art. 6(1)(f) GDPR.

15. Retention

We keep personal data only as long as needed for the respective purpose: account data, price alerts, release reminders, wishlist, collection, sealed holdings, value history, the virtual Pack Simulator collection and the interface language until you delete your account; the opening counters of the simulator only for a few days; login tokens only briefly until used or expired; bell messages about price alerts for 24 hours; messages sent through the contact form until your request is dealt with (afterwards only where statutory retention duties apply); server logs at Cloudflare according to the provider retention periods. The anonymously counted click and search statistics contain no personal data.