When you create an account, we store:
We don't collect payment information, real names, or physical addresses — GCG Ace doesn't process payments directly.
Solely to run the service: authenticating you, saving your collection and decks, and showing you information relevant to what you own or are building. We don't sell your data, and we don't share it with third parties except as described below.
GCG Ace sets one cookie: a signed, HTTP-only session token used to keep you logged in. It isn't used for tracking or advertising, and no third-party analytics or advertising cookies are set by GCG Ace itself.
Pages may show links to card marketplaces (for example, TCGplayer) to help you find cards you're missing, some of which may be affiliate links. Clicking one takes you to that site under its own privacy policy — we don't share your GCG Ace account data with them.
Passwords are hashed with bcrypt before storage and checked against a database of known breached passwords at signup (via the k-anonymity Have I Been Pwned API, which never receives your actual password) so commonly compromised passwords are rejected up front.
We keep your account data for as long as your account is active. To request deletion of your account and associated data, contact [support@yourdomain.example].
GCG Ace isn't directed at children under 13, and we don't knowingly collect data from them.
If this policy changes materially, we'll update the date at the top of this page.
Questions about this policy? Reach us at [support@yourdomain.example].