Privacy Policy

Effective October 17, 2026 · Updated October 24, 2026: added Stripe (paid plans) and Square (store card payments) to the service providers we use

BackstockTCG is a card inventory, scanning and store-management service run by Scotty Limbaugh in Arkansas, United States ("BackstockTCG", "we", "us"). This policy explains what information we collect, why, who we share it with and the choices you have. It covers backstocktcg.com, app.backstocktcg.com, store pages under backstocktcg.com, in-store kiosks and order boards, and the emails we send.

1. Information we collect

Account information

• Your first and last name, username, email address and password. Passwords are stored only as a secure one-way hash; we never see or keep the password itself.
• Optional details you add: a display name, profile picture, public profile settings and trade notes.
• Your role at a store (owner, manager or associate), and whether your account is a store account or a personal collection.

Store and collection information

• Cards and products you add: names, sets, conditions, quantities, prices, what you paid, storage locations, tags, collections, photos you upload, and grading details.
• Store settings: store name, logo, address on backstocktcg.com, buy-in rates, calendar events and other preferences.
• Buy-in records, including the customer name staff type in, and the cards and amounts involved.
• An activity log of changes made by the store's team, which the store's owners and managers can see.
• Market prices for cards you hold, kept up to two years so we can show price history.

Team chat

• Messages, photos, shared cards and orders, and read receipts in a store's team chat. These are kept as long as the store's owner chooses (two years unless they change it), then deleted automatically.

Customers of a store

• When you send a pull request from a store's kiosk, we collect your first and last name, any note, the cards requested and, if you give it, your email address so the store can send you updates on the order.
• Order status links work without an account, using a private code in the link.

Camera and photos

• When you scan cards, frames from your camera, or photos you choose, are sent to our server to read the card's text and, for some cards, to compare its picture with catalog images. They are processed and discarded, not stored. Only the cards you choose to add are saved.
• Photos you deliberately upload (card photos, chat photos, store logos, profile pictures) are stored with your account or store.

Technical information

• One cookie, which keeps you signed in. We use no advertising or tracking cookies.
• Your browser's local storage, for preferences like dark mode, scanner settings and your last view. This stays on your device.
• IP addresses and basic request information, used to protect against abuse (for example limiting sign-in attempts) and to troubleshoot errors. These aren't used to build profiles of you.

2. How we use information

• To provide the service: your inventory, collections, scanning, kiosk, orders, analytics, calendar and chat.
• To send emails you need or asked for: account confirmation, password resets, security notices and order updates.
• To keep the service secure, prevent abuse and fix problems.
• To give support. A site administrator can see basic account information (name, username, email, store, plan) to run and support the service. Store chat is read only with the owner's support code, as described below.
• To improve BackstockTCG. We look at how features work, not at you personally, and we don't use your data to train AI models.

3. What's public

• Your store's public stock page, events calendar, kiosk and order board show only what the store turns on: card listings and prices, public events, and on order boards a first name and last initial with an order number.
• A collector profile is private unless you switch it on, and shows only what you choose to share.
• Costs, locations, team members, chat and personal collections are never shown on public pages.

4. Who we share information with

We don't sell or rent your information. We share it only:

• Within your store. Owners, managers and associates of a store see its inventory and records. Chat messages are seen by the people in each conversation.
• With service providers who help run BackstockTCG, only as needed:
  • Cloudflare, which carries our network traffic securely.
  • Resend, which delivers our emails.
  • Stripe, which handles payments for BackstockTCG's paid plans. Your card details go to Stripe and never reach us; we keep only your plan, its status and renewal dates, and Stripe's customer number for your account. Stripe's own privacy policy applies to what you give them.
  • Square, for stores that connect it to take card payments at the counter. Payment details go to Square, under the store's own Square account.
  • Card data services Scryfall and TCGplayer (through tcgcsv.com), which provide card details, images and prices. Card images load from their servers, so they may see your IP address, like any website you visit.
• For support, with the store's permission. A store's owner can create a time-limited support code that lets BackstockTCG support read the store's chat, read-only. The owner chooses whether it covers private messages, can revoke it at any time, and each use is recorded in the store's activity log.
• If the law requires it, or to protect the safety, rights or property of our users or others.
• If BackstockTCG is sold or merged, in which case this policy continues to apply to your information and we'll tell you before anything changes.

5. How long we keep information

• Account, store and collection information: until you delete it or your account.
• Team chat: as long as the store's chat history setting (two years by default, or as the owner sets).
• Price history: up to two years.
• Password reset links expire after an hour; email confirmation links after a day.
• Kiosk orders, including the customer's name and any email given: kept with the store's records.
• When an account is deleted, its personal collection, chat messages and account details are removed from our live systems straight away. The store keeps its own business records of work done by that account, such as activity log entries and buy-ins, which show the username.

6. Your choices and rights

• See and update your information in the app, under Profile and Store.
• Delete your account in Profile, under Edit profile & settings. If you're the only account at your store, the store and all its data are deleted too. A store's only owner must hand ownership to someone else first if other people still have accounts there.
• Ask for a copy of your information, or ask us to correct or delete it, by emailing us. We'll answer within 30 days.
• Depending on where you live, you may have further privacy rights under local law. Contact us and we'll help.

7. Security

We use encrypted connections (HTTPS), store passwords only as one-way hashes, limit repeated sign-in and reset attempts, and keep access to systems to those who need it. No service can be perfectly secure. If a breach affects your information, we'll tell you as the law requires.

8. Children

BackstockTCG is not for children under 13, and you must be at least 13 to create an account. If you're under 18, you need a parent or guardian's permission. If we learn we've collected information from a child under 13, we'll delete it. If you think that's happened, please contact us.

9. Where information is stored

BackstockTCG is run from the United States, and your information is stored and processed there.

10. Changes to this policy

If we make important changes, we'll update the date above and tell you in the app or by email before they take effect.

11. Contact

Questions or requests about privacy: [email protected]
Scotty Limbaugh, BackstockTCG, Arkansas, United States.