TCGDrop
Sign In

Privacy Policy

Last updated: 27 July 2026. This explains what personal data TCG Drop holds, why, and your rights over it.

1. Who is responsible

DoniCodes Ltd (trading as TCG Drop), company no. 17358107, registered office 128 City Road, London, EC1V 2NX, is the data controller for the platform. Contact: hello@tcgdrop.co.uk.

2. What we collect

  • Account details: email address, name, display name, and - if you link Discord - your Discord ID and avatar.
  • Activity: your claims, orders, memberships and participation (for example leaderboard scores).
  • Technical basics: sign-in cookies and security logs. We use essential cookies only - no advertising or tracking cookies, which is why there is no cookie banner.
  • Anonymous usage statistics: we use cookieless page-view analytics (Vercel Web Analytics) to understand how the site is used. It sets no cookies, does not track you across sites, and cannot identify you - visitors are counted with an anonymised identifier that changes daily.

Payment card details are collected and held by Stripe, our payment provider - they never touch our systems.

3. Why we use it

  • To run the platform - your account, claims, drops and memberships (performance of our contract with you).
  • To fulfil your orders: when you claim or buy from a store, we share the details the store needs (your name and what you ordered) with that store, so it can prepare and hand over your items. Once shared, the store is an independent controller of that information for running its own business.
  • To process payments through Stripe.
  • To meet legal duties: sellers' (stores') details and platform income are reported to HMRC annually under UK digital platform reporting rules. This applies to stores, not to buyers.
  • To keep the platform safe - fraud and abuse prevention (legitimate interests).

4. Who processes it for us

We use a small set of established providers to run the platform: Supabase (database and authentication), Vercel (hosting), Stripe (payments) and Google (email). Each processes data under its standard data processing agreement, with UK GDPR safeguards applying to any international transfers.

5. How long we keep it

Your account data is kept while your account exists. Transaction records are kept for six years after the transaction, as required for business and tax records, even if you delete your account. Everything else is deleted when your account is.

6. Your rights

You can access and correct your details in your account settings, and delete your account (and its data, other than the transaction records above) from settings at any time. You also have UK GDPR rights to request a copy of your data, correction, deletion and restriction - contact us and we will respond promptly. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).