Privacy policy

Short version. TCG Unbound is an account. We store your email, your card photos, and the artworks we render from them. Card photos go to AI providers so they can paint a background for you. We do not sell your data, run no third-party analytics, and you can delete your account by email.

What we collect

When you sign up:

• Your email address.
• The display name you choose.
• An invite code, while we are in closed beta.

When you use the app:

• The card photos you upload.
• The AI artworks we render from them.
• Your credit balance and a transaction log of purchases and generation costs.
• An internal UUID we use as your account ID.

What our servers record:

• IP address and request timestamps in standard server logs. Used to investigate abuse and outages.
• Backend error logs from our own code. No third-party crash reporter.

Who we send data to

AI providers. To produce a generation, the card photo goes to AI providers that read it and paint a matching background. Calls go from our backend. We do not pass your email, name, or account ID. Under the paid plans we use, the providers do not train their models on the images we send.

Stripe. Handles payment for credit packs. Stripe stores receipt data on its side. We pass our internal UUID and the items being purchased. No email, no name.

External cloud operators. Host our database and object storage. Encrypted at rest, encrypted in transit. They do not access the contents.

What we do not do

• No third-party analytics SDKs.
• No selling of your data.
• No advertising profile built by us.
• No tracking across other apps or websites.

Where data lives

• The database holds your account, generation history, and transactions. Encrypted at rest.
• Object storage holds your card photos and rendered artworks. Encrypted at rest.
• All connections use HTTPS with TLS 1.2 or above.
• Backups are encrypted.

How long we keep it

• While your account is active: as long as you keep it.
• Card photos and generations: for the life of your account.
• After deletion: account row, generations, and stored objects removed within 7 days.
• Purchase records: retained in anonymized form for tax compliance, as required by law.

Deleting your account

Email tcgunbound@sbkrdev.nl from the address on your account, with the subject line 'Account deletion'. We confirm and delete within 7 days.

Children

TCG Unbound is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you are a parent and believe your child has signed up, email us and we will delete the account.

Changes to this policy

If we change something material, we update this page and bump the date at the top. If you have an account on file, we will also email you about the change.

Contact

Privacy questions: tcgunbound@sbkrdev.nl.