Privacy Policy

OP TCG Trade Hub (“the Service,” “we,” “us”) is an unofficial, fan-made web application for the One Piece Trading Card Game. It helps players coordinate wishlists, track collections, browse decklists, and play a game simulator. The Service is operated by Ayhan Okuyan in the Republic of Türkiye, which is the data controller for personal information processed through the Service.

We also use your gameplay and match data to build aggregated, de-identified statistics that we may keep indefinitely, including for commercial purposes such as future paid features — see Statistics & Aggregated Data below.

We have written this policy to be read plainly. If anything is unclear, contact us at privacy@optcgtradehub.com. This policy works together with our Cookie & Local Storage Policy and our Terms of Service.

We collect only what we need to operate your account and provide the Service.

Account details

Your email address; a password (stored only as a salted hash by our authentication provider — we never see or store your plaintext password); and a nickname or display name you choose.

Google sign-in

If you sign in with Google, we receive your email address and basic profile information from Google to create and identify your account.

Security & technical data

Your IP address, a coarse geolocation derived from it (city / country level), and a device hash. We use these to send you “new device” security login alerts and to apply rate limiting that protects the Service from abuse. We do not retain your full IP address: the sign-in history shown on your settings page stores it truncated (the final block removed, so it identifies a network rather than a device), and the rate limiter stores only a salted, one-way hash.

Content you create

Wishlists; owned cards and collections (which you may flag as available for trade or sale); decklists; group memberships; and a wishlist change feed that records who changed what, attributed by nickname, within your groups.

Multiplayer play

Online multiplayer match data and ephemeral in-game chat. Chat is not stored long-term.

Voice chat

Voice chat is optional and inactive until you choose to join it during a match. It connects your browser directly to your opponent’s (peer-to-peer). Establishing that connection requires the two devices to exchange network addresses, so your opponent’s device may be able to see your IP address, and yours theirs, for the duration of the call. This is how peer-to-peer audio works in every browser and is not something we can prevent while the connection is direct. Where a direct connection cannot be established, audio is relayed through a third-party TURN server (Cloudflare) and your opponent sees only the relay. We do not record, store, transcribe, or listen to voice audio at any point — it never reaches our servers.

Preferences

Your email notification preferences.

Bug reports

Reports you choose to submit, which may include screenshots and a description of the problem. These are routed to the developer’s issue tracker.

We do not collect special-category data (such as health, biometric, or precise-location data), and we do not knowingly collect information from anyone under 13. See Children’s Privacy below.

• To create and operate your account and provide the features you request.
• To secure your account — sending new-device login alerts and preventing abuse, fraud, and automated misuse.
• To apply rate limiting that keeps the Service available and stable.
• To send transactional email (account confirmation, password reset, security and notification messages you have not opted out of).
• To monitor and fix errors and to maintain and improve the Service.
• To compile aggregated, de-identified gameplay statistics, analyze game balance, and develop and improve the Service (including future paid features) — see Statistics & Aggregated Data.
• To respond to your support requests, bug reports, and rights requests.
• To comply with our legal obligations.

We do notuse your information for advertising or behavioral profiling, and we do not run third-party advertising trackers. We do use a privacy-preserving product-analytics service (PostHog, hosted in the EU) to understand aggregate feature usage — it stores nothing on your device and receives no personal details beyond a pseudonymous account identifier. See Statistics & Aggregated Data below.

If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases under the GDPR / UK GDPR (Article 6):

• Performance of a contract — operating your account and providing the Service you sign up for.
• Legitimate interests — keeping the Service secure (login alerts, abuse and fraud prevention), monitoring errors, rate limiting, compiling gameplay statistics and analysing game balance and trends, and measuring aggregate product usage through privacy-preserving analytics. We balance these interests against your rights and freedoms, and you may object (see Your Rights).
• Legal obligation — handling and recording data-rights requests where required by law.
• Consent — only for any future marketing communications. We do not send marketing email today; if we introduce it, it will be opt-in and you may withdraw consent at any time.

Some information (such as your email) is required to create an account; without it we cannot provide the Service — other information is optional. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing; our security and rate-limiting measures may act automatically but do not determine your legal rights.

We do not sell your personal information. We share it only with the service providers (sub-processors) that run the Service on our behalf, each bound by a data-processing agreement to process it solely for the purposes below. These providers operate in the United States and other regions; in particular, our primary database and file storage (Supabase) are hosted in India.

Supabase

Authentication, database, file storage, and realtime — our primary data store (hosted in India, region ap-south-1).

Vercel

Application hosting; provides the IP-based geolocation; server logs.

Sentry

Error monitoring and performance tracing. Session-replay recording is disabled — we do not record your screen or session.

PostHog

Product analytics, hosted in the European Union. Receives usage events (pages viewed, games started and completed, account created) keyed to a pseudonymous account identifier — never your email, name, or message content. Runs cookieless: it stores nothing on your device, honors your browser’s Do Not Track setting, and performs no session recording.

Resend

Transactional email delivery.

Google

OAuth sign-in (for Google logins) and serving embedded YouTube thumbnails.

Upstash

Redis-based rate limiting, keyed on a truncated / normalized IP address.

GitHub

Receives the bug reports you submit (the developer’s issue tracker).

Cloudflare

Relay servers for optional voice chat. Used only when your browser and your opponent’s cannot connect directly; the relay passes the encrypted audio stream between you and sees the participants’ network addresses. It does not record or store the audio.

We may also disclose information where required by law, to enforce our Terms and Acceptable Use Policy, to protect the rights and safety of our users or the public, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

International data transfers

Your information is processed in the United States and other countries, including India, where our primary database and file storage (Supabase) are hosted. Where we transfer personal data of EU / EEA or UK individuals outside the EEA / UK, we rely on appropriate Article 46 safeguards — primarily the EU Standard Contractual Clauses (with the UK International Data Transfer Addendum); for transfers to the United States, where a provider maintains it, we also rely on certification under the EU-U.S. Data Privacy Framework. You can ask which safeguard applies to a given provider by emailing privacy@optcgtradehub.com.

• Account data — retained while your account is active and erased when you delete your account.
• New-device security records — approximately 90 days.
• The wishlist change feed — approximately one month.
• Multiplayer match data — your identifiable match records are erased when you delete your account; we retain de-identified / aggregated match data indefinitely for gameplay statistics and analysis (see Statistics & Aggregated Data). Rooms that never start a match are cleared within 7 days.
• Bug reports — kept until the issue is resolved, then deleted within 90 days.

We may retain limited information for longer where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

We retain gameplay and match data — including online multiplayer match records and actions — and use it to compile statistics, analyze game balance and trends, and maintain, develop, and improve the Service. We rely on our legitimate interests in operating and improving the Service for this processing.

In plain terms: we keep your match history, strip your identity from it, and may build statistics or paid features on the result. We take reasonable measures to ensure this data cannot be re-identified, we commit to maintain and use it only in aggregated and de-identified (anonymized) form, we will not attempt to re-identify it, and we require any recipient to do the same. To the extent any dataset still relates to an identifiable person, we continue to treat it as personal data under this policy. Truly aggregated statistics that no longer relate to an identifiable individual may be retained and used indefinitely, including for research and future paid features.

You can object to this processing at any time by emailing privacy@optcgtradehub.com, and you can stop it for your data by deleting your account.

If you delete your account, your identifiable match data is removed as described under Your Privacy Rights; aggregated or de-identified statistics already derived from it may be retained. We do not sell or share data that identifies you; if we ever intend to, we will update this policy and obtain your consent where required.

We also measure aggregate product usage (for example: how many visitors sign up, and how many games are completed each week) using PostHog, an EU-hosted analytics provider. These events are keyed to a pseudonymous account identifier, contain no personal details, and are collected without storing anything on your device. We rely on our legitimate interest in understanding and improving the Service; you can object at any time as described below, and your browser’s Do Not Track setting is honored automatically.

Depending on where you live, you have rights over your personal information. You can exercise most of these directly in the app:

• Access & portability — export your data from Settings → Download my data.
• Rectification — correct your profile and details in your profile settings.
• Erasure — delete your account from Settings → Delete my account; this removes data that identifies you, though anonymous aggregated statistics already derived from your gameplay may remain (see Statistics & Aggregated Data).
• Objection & restriction — object to or ask us to restrict certain processing by emailing privacy@optcgtradehub.com.
• Withdraw consent — where we rely on consent, you may withdraw it at any time without affecting prior processing.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before acting on a request.

EU / UK supervisory authority

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first — please contact us at privacy@optcgtradehub.com.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion or correction of your information, and to opt out of the “sale” or “sharing” of your personal information.

The categories of personal information we collect, the purposes for which we use them, and the providers with whom we share them are described in the sections above. To exercise your rights, use the in-app tools described under Your Privacy Rights or contact privacy@optcgtradehub.com. Because we do not sell your personal information or share it for cross-context behavioral advertising, there is currently nothing for an opt-out signal such as Global Privacy Control (GPC) to act on. If we ever sell or share personal information, we will treat a valid GPC signal as a request to opt out.

The Service is operated from the Republic of Türkiye, and we process personal data as a data controller (“veri sorumlusu”) under Türkiye’s Law on the Protection of Personal Data No. 6698 (“KVKK”). If you are in Türkiye, you have the rights set out in Article 11 of the KVKK — including to learn whether your data is processed, to request information, correction, or erasure, and to object to outcomes produced solely by automated analysis; to learn the purpose of processing and whether your data is used in line with it; to know the third parties in Türkiye or abroad to whom your data is transferred; to request that any correction, erasure, or destruction be notified to those third parties; and to claim compensation for damage arising from unlawful processing. To exercise them, contact privacy@optcgtradehub.com.

You may exercise these rights by applying to us first; if we reject your application, our response is inadequate, or we do not respond within 30 days, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). This Privacy Policy also serves as our KVKK information notice (aydınlatma) for users in Türkiye, mapping to the processing conditions in Article 5 of the KVKK — contract performance for your account, our legal obligations, our legitimate interests where your fundamental rights are not harmed (security, abuse prevention, error monitoring, and gameplay statistics), and otherwise your explicit consent.

Because our service providers are located abroad (including the United States and India), using the Service involves transferring your data outside Türkiye. For users in Türkiye, this transfer abroad is carried out under Article 9 of the KVKK. Where the recipient has executed it, we rely on the standard contract published by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or another appropriate safeguard under Article 9/3; where no such safeguard is in place, we rely on one of the exceptions in Article 9/6, including that the transfer is necessary for the performance of the contract you requested. We do not treat your continued use of the Service as explicit consent under the KVKK.

The Service is not directed to children under 13. You must be at least 13 to use the Service. Some countries set a higher minimum age (for example, up to 16 in parts of the EU/EEA, and minors generally require guardian consent in Türkiye); if you live in such a country and are under that age, you may only use the Service with the involvement of a parent or legal guardian, who accepts these terms on your behalf.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact privacy@optcgtradehub.com and we will delete it. If we learn that we have collected personal information from a child under 13, we will delete the account and that information promptly.

We use industry-standard measures to protect your information, including encryption in transit, hashed passwords, access controls, and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; we encourage you to use a strong, unique password and to keep it confidential.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and give reasonable advance notice in the app or by email before they take effect. If you do not agree, you may stop using the Service and delete your account before the change takes effect; continued use after that date means you accept the revised policy.

For any privacy question or to exercise your rights, email privacy@optcgtradehub.com. A postal address is available on request.