TGPTouch Grass Pokemon
Home › Privacy
Legal

Privacy Policy

Last updated September 24, 2026

TouchGrass Pokemon (“the site”) lets you browse Pokémon TCG sets and track a card collection. This page explains exactly what is collected, why, and how to get rid of it. The short version: you can use the whole site without an account, and if you do make one, all it stores is who you are and which cards you have ticked off, plus a trade listing and trade messages if you choose to trade.

Using the site without an account

No account is required. If you track a collection while signed out, it is saved in your own browser (localStorage) and never sent to us. Clearing your browser data deletes it, and it does not follow you to other devices.

If you create an account

Signing in with GitHub gives the site:

  • your name or username
  • your email address
  • your profile picture URL
  • an identifier linking your account to that provider

That is all. The site never sees or stores your password, and it cannot post anything or read your repositories.

What else is stored

  • Your collection — the IDs of the cards and sealed products you mark as owned, how many copies of each, and when you added them.
  • Collection value history — once a day, the total market value of your collection and how many cards and copies it holds, so My Collection can chart it over time. Only you can see it.
  • Session cookies — a signed cookie that keeps you logged in. It is strictly necessary for sign-in and is not used for tracking.

If you choose to trade

Trading is opt-in. Nothing below happens unless you create a listing on the Trade page.

  • Your listing — the location you type (keep it to a city or region), an optional display name and an optional “about” note. Other signed-in users see these, along with your account name (unless you set a display name) and your profile picture.
  • Cards marked for trade — other signed-in users can see the cards you offer and how many copies of each. The rest of your collection, and its value, are not shown.
  • Trades and messages — the cards in each proposal, its status, and the messages you send. A trade and its messages are visible only to the two people in it. When both of you confirm a trade, the site moves the cards between your two collections.

Your email address is never shown to other traders. You can pause or remove your listing at any time; removing it deletes your location and unlists every card. Past trades stay visible to the other person in them until one of you deletes your account.

What is not done

  • No advertising, ad networks, or third-party trackers.
  • No selling or sharing of personal data.
  • No marketing email. Your address is only an account identifier.
  • No profiling or automated decision-making.

Who the data touches

The site runs on a small number of providers, each of which processes data only to keep it online:

  • Vercel — hosting and server logs (including IP addresses, kept briefly for security and debugging).
  • Neon — the PostgreSQL database holding accounts and collections.
  • GitHub — sign-in, when you choose it.
  • TCGdex — card data and images. Loading an image means your browser contacts their servers.
  • TCGplayer — sealed product photos, loaded from their image servers, and the product pages sealed items link to.

Data is stored in the United States. If you are in the UK, EU or EEA, your information is transferred there to provide the service.

How long it is kept

Account and collection data are kept until you delete your account, at which point they are removed immediately and permanently. Sessions expire on their own. Server logs are short-lived and controlled by the hosting provider.

Deleting your account

Go to My Collection and use Delete account at the bottom of the page. You will be asked to type your email address to confirm. This erases your account, your sign-in link, every card in your collection, its value history, your trade listing, and every trade and message you are part of, in one step. Trades are removed for the other person too. It happens straight away and cannot be undone — there is no grace period and no backup copy kept for you.

Your rights

Depending on where you live (for example under GDPR or the CCPA), you may have the right to access, correct, export or delete your data, and to object to its processing. Deleting your account covers erasure outright. For anything else, get in touch and it will be handled.

Children

The site is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has made an account, contact us and it will be removed.

Security

Traffic is encrypted over HTTPS, database connections use TLS, and sign-in is delegated to GitHub so no password ever reaches this site. The collection and trade endpoints are rate limited and always check your session server-side, so one account cannot read or change another’s data. No system is perfectly secure, but the data held here is deliberately minimal.

Changes

If this policy changes materially, the date at the top will change with it. Continuing to use the site after that means accepting the updated policy.

Contact

Questions about privacy, or a request about your data, can be sent through the project’s issue tracker.

TouchGrass Pokemon is an independent project and is not affiliated with, endorsed by, or sponsored by Pokémon, Nintendo, Game Freak or Creatures Inc. Card images, set logos and card names are the property of their respective owners and appear here for informational purposes. Market prices are periodic snapshots and may be out of date — always confirm on the seller’s own site before buying or selling.