The site has no newsletter. You give us an e-mail address only if you set up a price alert or create an account to save your collection. This policy explains what happens to that data and what is left after every visit.
Data controller
WXQ Sp. z o.o., ul. Stanisława Bełżeckiego 4, 26-613 Radom, Poland, VAT ID PL5252844355, KRS 0000871653. Data protection contact: [email protected].
Price alerts
On a card page you can ask to be e-mailed when its price drops to a target. We store: your e-mail address, the card and variant, the target, today’s price, the chosen language, the dates of sign-up, confirmation and sending, and a cryptographic hash of your IP address (used only to limit sign-ups from one place; we do not store the IP address itself).
Purpose: sending one price-drop e-mail. Legal basis: your consent (Art. 6(1)(a) GDPR), given in the form and confirmed via the link in the first e-mail. Without confirmation we send nothing else and the request expires after 7 days. We do not use the address for anything else or share it with anyone.
You can withdraw consent via the “Unsubscribe” link in every e-mail or by writing to [email protected]. Alert data is kept until you unsubscribe and, after the alert is sent or expires, for no longer than 12 months. E-mails are sent by our hosting provider’s mail server.
Contact form and set ratings
A contact form message (text, optional name and e-mail, the page concerned) is stored and forwarded to [email protected] so we can reply, and kept for up to 12 months. When you rate a set (1–5 stars) we store the rating and a cryptographic hash of your IP address — only so one vote from one place counts once. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Account and saved collection
An account is optional. You create it with your e-mail address, to which we send a one-time sign-in link (valid for 30 minutes). We store: your e-mail address, language, sign-up and last sign-in dates, the cards in your collection with quantities, the daily history of the collection’s value, your wishlist (cards, price targets, notification dates), and cryptographic hashes of sign-in and session tokens together with a hash of your IP address (to limit sign-in attempts). There are no passwords.
Purpose: running your account and syncing your collection across devices. Legal basis: providing the service you request (Art. 6(1)(b) GDPR). After you sign in we set two strictly necessary cookies: cm_s (session identifier, 12 months) and cm_u (signed-in flag for the page script). We use your address for signing in and — if you add cards to your wishlist — for at most one e-mail a day about cards that got cheaper; clear the wishlist on your account page. You can delete your account and collection yourself with the “Delete account” button — the data is removed immediately.
Server logs
Every visit is recorded in server logs: IP address, date and time, page address, browser information and referrer. This is required to run the site and detect abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Logs are kept for up to 12 months.
Browser storage
We store your chosen theme (light or dark) in your browser’s localStorage and — if you use it — your card collection (card IDs, quantities and a daily history of its value). Without an account this data never leaves your device (when signed in it syncs with your account, see above); the collection page only fetches current prices of the listed cards from our server, without recording who asked. Remove the collection with the “Clear” button or by clearing site data in your browser. We use no tracking cookies and no analytics; our only cookies are the two needed for signing in.
Third-party resources
Card images and set logos load from TCGdex servers (assets.tcgdex.net), some card images from the Pokémon TCG API (images.pokemontcg.io), and fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Sealed product photos load from the servers of the shops that sell them. Your browser fetches them directly from these providers, who then see your IP address and browser information. The “Search on Cardmarket” link takes you to Cardmarket, whose own terms then apply.
Shop links
“Go to shop” buttons are affiliate links of affiliate networks (e.g. Convertiser, Adtraction). After a click, the network and the shop may set a cookie to attribute a possible commission to us. They do so under their own privacy policies. Cardometer receives none of your data from them.
Processors
Our hosting provider and Cloudflare, Inc. (content delivery and attack protection), through which traffic to the site passes.
Your rights
You have the right to access, rectify, erase or restrict processing of your data, to object, to data portability, and to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). Write to [email protected] and we will reply within 30 days.
Last updated: October 30, 2026.