Last updated: August 9, 2026
VNDR™, operated by TCG VNDR LLC ("we," "our," or "us"), is a platform built for TCG vendors to manage inventory, transactions, and show sessions. This Privacy Policy explains what information we collect when you use VNDR, how we use it, and who we share it with. This policy is part of our Terms of Service.
VNDR does not sell your data, run advertising, or use tracking analytics of any kind.
You can create a VNDR account with Google OAuth, Sign in with Apple, or an email address and password. When you sign in with a provider, that provider shares the following with us:
We never receive or store your password from Google or Apple.
If you sign up with an email address and password, we store your email address and a secure, one-way hash of your password (using the argon2id algorithm). We cannot read or recover your actual password — we can only verify it when you sign in. To confirm you control your email address and to support password resets, we also generate short-lived, single-use verification and reset tokens tied to your account.
Everything you log inside VNDR is stored in your account:
Notes attached to transactions are free-form text you write. Do not include sensitive personal information about your customers in notes.
If you subscribe to a paid plan, payment is processed by Stripe (web) or Apple In-App Purchase (iOS app). We do not store your credit card number or full payment details. We receive and store:
If you use the camera card identification feature, the image you capture is sent to Ximilar's card recognition API to identify the card name, set, and number. If Ximilar is unavailable or unable to identify the card, the image may be sent to Anthropic's Claude API as a fallback. See Section 3 for details on third-party services.
We store a copy of the captured image on Vercel Blob storage, linked to the inventory item it identified, so you can view it later from the item's detail page. You can delete the image by deleting the inventory item, or by clearing your inventory via Settings → Danger Zone ("Clear all inventory" or "Reset everything"). Deleting your account removes them too, as long as you are the only member of your team. In each case the stored file itself is removed, not just the link to it. An image that another item or bulk lot still points at is kept until nothing references it.
If you manually upload an inventory photo or a batch-lot photo, that image is also stored on Vercel Blob storage under your account.
If you receive or share a referral code, we store:
When another user refers you, we show them a partially masked version of your email (e.g., jo***@***.com) so they can recognize friends they have referred. We never share your full email address or your Google or Apple display name with other users through the referral system.
Referral records are visible to VNDR administrators for fraud review. Administrative actions on referrals or credits (grant, reverse, adjust) are recorded in an internal audit log.
We do not use your data for advertising, profiling, or any purpose beyond operating the app for you.
VNDR relies on the following third-party services to function:
Your name, email, profile picture, and OAuth tokens are shared with Google as part of the sign-in flow.
VNDR is deployed on Vercel's infrastructure. Your requests pass through Vercel's servers. Vercel may log request metadata (IP addresses, user agents) per their standard practices.
All your account and business data is stored in a Neon-hosted PostgreSQL database. Neon is a Vercel Postgres provider. Data is encrypted at rest and in transit.
When you search for a card or sealed product, or when the daily price refresh runs, your search queries and card identifiers are sent to Scrydex's API to retrieve market pricing data. No personal account information is sent to Scrydex.
If you use the camera card identification feature, your card image is sent to Ximilar's TCG recognition API to identify the card name, set, and number. Ximilar processes that image solely on our behalf and on our instructions, as a processor under Article 28 GDPR. Under Ximilar's terms, images sent for recognition are processed in memory to return the result and are not stored, and are not used to train or evaluate any model offered to other customers.
If Ximilar is unavailable or unable to identify a card, your card image may be sent to Anthropic's Claude API as a fallback. This also handles sealed products and graded slabs. Anthropic processes that image solely on our behalf to return an identification result. Under Anthropic's commercial terms, we retain all rights to what we send, and Anthropic may not train its models on it.
Card scan images and manually uploaded inventory photos are stored on Vercel Blob, Vercel's managed object storage. Files are uploaded with unguessable random URLs. The stored file is removed when you delete the item or bulk lot it belongs to, clear your inventory from Settings → Danger Zone, or delete your account as the sole member of your team.
If you subscribe to a paid plan, payment is processed by Stripe. Stripe receives your payment card details, billing address, and email. We do not store your card number — Stripe handles this securely. We receive confirmation of payment status and subscription details.
If you use Sign in with Apple, Apple shares your name and email address (or a private relay address) with us. If you subscribe via In-App Purchase on iOS, Apple processes your payment. We do not receive your payment card details from Apple — we receive transaction IDs and subscription status via RevenueCat.
RevenueCat manages In-App Purchase subscriptions for our iOS app. It receives your app user ID and purchase events from Apple to track subscription status. RevenueCat does not receive your payment card details.
Resend delivers transactional emails (session summaries, subscription confirmations) and optional marketing emails if you opt in. You can manage your email preferences in Settings → Notifications.
When you submit feedback through the in-app help button, your name, email address, and message are sent to a private Discord channel via webhook so our team can respond. Only VNDR team members can see this channel.
If rate limiting is enabled, your IP address is temporarily stored in Upstash Redis to prevent API abuse. This data expires automatically within seconds.
If you connect your eBay account and list items, your card details (name, set, condition, grade, price) and card images are sent to eBay's Inventory and Media APIs to create listings on your behalf. Your eBay OAuth tokens (access and refresh tokens) are stored securely to maintain your connection. eBay's privacy policy governs data shared with them.
VNDR sets a single HTTP-only, secure session cookie (authjs.session-token) when you sign in. This cookie:
If you click a referral link or enter a referral code, we also set a short-lived cookie (vndr_ref) for 30 days to remember which code you used, so we can attribute the referral when you sign up. You can clear it at any time through your browser settings.
We set no advertising cookies, no tracking pixels, and no third-party analytics cookies.
Your business data (inventory, transactions, show sessions) is retained until you delete it. Team owners can delete data from the Settings page inside the app:
Sign-up IP address and user-agent string collected for referral fraud detection are retained while your account exists to support ongoing fraud review, and are deleted when you delete your account.
Your account information (name, email, profile picture) from Google or Apple is retained to keep your account active. You can delete your account from Settings → Danger Zone, which permanently removes all your data. If you need assistance with account deletion, contact us at the address below and we will process it within 30 days.
VNDR is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you through the app, by email, or another reasonable means. Continued use of VNDR after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or want to request deletion of your account data, reach out at:
support@tcgvndr.com