Buy · Sell · Trade
Last updated: March 10, 2026
VNDR, operated by TCG VNDR LLC ("we," "our," or "us"), is a platform built for TCG vendors to manage inventory, transactions, and show sessions. This Privacy Policy explains what information we collect when you use VNDR, how we use it, and who we share it with. This policy is part of our Terms of Service.
VNDR does not sell your data, run advertising, or use tracking analytics of any kind.
We use Google OAuth to authenticate you. When you sign in, Google shares the following with us:
We do not receive or store your Google password.
Everything you log inside VNDR is stored in your account:
Notes attached to transactions are free-form text you write. Do not include sensitive personal information about your customers in notes.
If you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card number or full payment details. We receive and store:
If you use the camera card identification feature, the image you capture is sent to Ximilar's card recognition API to identify the card name, set, and number. If Ximilar is unavailable or unable to identify the card, the image may be sent to Anthropic's Claude API as a fallback. We do not store the image on our servers. See Section 3 for details on third-party services.
We do not use your data for advertising, profiling, or any purpose beyond operating the app for you.
VNDR relies on the following third-party services to function:
Your name, email, profile picture, and OAuth tokens are shared with Google as part of the sign-in flow.
VNDR is deployed on Vercel's infrastructure. Your requests pass through Vercel's servers. Vercel may log request metadata (IP addresses, user agents) per their standard practices.
All your account and business data is stored in a Neon-hosted PostgreSQL database. Neon is a Vercel Postgres provider. Data is encrypted at rest and in transit.
When you search for a card or sealed product, or when the daily price refresh runs, your search queries and card identifiers are sent to Scrydex's API to retrieve market pricing data. No personal account information is sent to Scrydex.
If you use the camera card identification feature, your card image is sent to Ximilar's TCG recognition API to identify the card name, set, and number. Ximilar's data usage policies apply to that image. We do not store the image.
If Ximilar is unavailable or unable to identify a card, your card image may be sent to Anthropic's Claude API as a fallback. This also handles sealed products and graded slabs. Anthropic's data usage policies apply to that image. We do not store the image.
If you subscribe to a paid plan, payment is processed by Stripe. Stripe receives your payment card details, billing address, and email. We do not store your card number — Stripe handles this securely. We receive confirmation of payment status and subscription details.
If email notifications are enabled, your email address and session summary data are sent to Resend to deliver session close emails with CSV attachments. Emails are transactional only — no marketing emails are sent.
When you submit feedback through the in-app help button, your name, email address, and message are sent to a private Discord channel via webhook so our team can respond. Only VNDR team members can see this channel.
If rate limiting is enabled, your IP address is temporarily stored in Upstash Redis to prevent API abuse. This data expires automatically within seconds.
VNDR sets a single HTTP-only, secure session cookie (authjs.session-token) when you sign in. This cookie:
We set no advertising cookies, no tracking pixels, and no third-party analytics cookies.
Your business data (inventory, transactions, show sessions) is retained until you delete it. You can delete data from the Settings page inside the app:
Your Google account connection (name, email, profile picture) is retained to keep your account active. It cannot currently be deleted through the app interface. To request full account deletion — including your Google auth record — contact us at the address below and we will remove it from our database manually within 30 days.
VNDR is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of VNDR after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or want to request deletion of your account data, reach out at:
support@tcgvndr.com