Privacy Policy

This Privacy Policy explains what personal data MichiMarket collects, why, and what rights you have over it. It's part of our Terms of Service.

1. What we collect

• Account data: email, username, display name, and a securely hashed password if you register with email (we never store your password in plain text). If you sign in with Google, we receive your name, email, and profile picture from Google; we don't receive your Google password.
• Content you create: your binders, the cards you add to them, custom images you upload to a binder pocket, bios, and favorites.
• Transaction data: what you've bought or sold and for how much. Full payment card details go straight to Stripe, our payment processor, and never touch our own servers. If you sell on MichiMarket, Stripe collects identity and banking information directly from you (as part of its own KYC/anti-fraud checks, required before it can pay you out) — we never see or store your bank account number or government ID, only Stripe's confirmation that your account is verified.
• Usage and device data: standard server logs (IP address, browser type, pages requested, timestamps) used for security and troubleshooting. These are always collected as part of operating and protecting the service.
• Analytics data (only with your consent): if you accept analytics in the cookie banner, we collect how the service is used: pages viewed, referring links, approximate location (from IP, not stored precisely), device and browser type, and a random identifier stored in your browser (our own mm_vid value and Google Analytics' _ga cookies) so repeat visits can be recognized. This feeds both our own internal dashboards and Google Analytics. It is never used for advertising, and you can withdraw consent at any time; see Section 5.
• Cookies and local storage: see Section 5.

2. How we use it

• To operate the service: your account, your binders, processing a purchase or sale.
• To keep the service secure: detecting fraud, abuse, and unauthorized access.
• To communicate with you: account, order, and (if you opt in later) product updates.
• To understand and improve how MichiMarket is used: which features get used, where people drop off, how many people are on the site. This is analytics, and we only do it if you've accepted analytics in the cookie banner. The legal basis is your consent, which you can withdraw at any time (Section 5).
• To comply with legal obligations, including tax reporting for sellers where required.

We don't sell your personal data, and we don't use it for advertising or cross-site tracking. The only analytics we run, our own usage telemetry and Google Analytics, is described in Section 5 and never runs without your consent.

3. Who we share it with

We share data only with the services that actually make MichiMarket work, each acting under their own privacy terms:

• Google (sign-in): if you choose to sign in with Google.
• Google Analytics (Google LLC in the US, or Google Ireland Limited for EEA/UK visitors): only if you accept analytics. Your device receives Google Analytics cookies and your usage events (pages, referrer, truncated IP, device type) are sent to Google. We enable IP anonymization and turn off data sharing for advertising. We do not use Google Analytics' advertising features, Signals, or ad remarketing.
• Stripe: our payment processor, to process a purchase or a seller payout. If you sell on MichiMarket, Stripe also runs its own identity verification before it can pay you out.
• Cloudflare: object storage (R2) for uploaded images and mirrored card art, and general infrastructure/CDN.
• Pkmn Prices: the third-party catalog we query for card details and market prices (we send it a card lookup, not your personal data).
• Law enforcement or regulators, only where required by law.

Some of these providers operate internationally, which can mean your data is processed outside your own country. Google Analytics in particular may process data in the United States. Where that happens, we rely on the safeguards those providers themselves offer for international transfers (such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework).

4. How long we keep it

We keep account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep transaction records for tax, accounting, or legal reasons.

Analytics data is kept only briefly. Our own usage records tied to a browser identifier are deleted about 24 hours after your last visit; the aggregate “how many people were on the site” counts we keep are just numbers, with no identifier attached. Google Analytics retains event-level data for 14 months (the shortest option Google offers) before aggregating it. Server security logs are rotated on a short schedule.

5. Cookies, local storage, and your choices

MichiMarket uses no advertising cookies and does no cross-site tracking. The cookies and browser storage we do use fall into two groups.

Essential: always on

These are required to deliver the service you asked for, so under GDPR/ePrivacy they don't need consent, only disclosure.

• Sign-in session (cookie): keeps you logged in; cleared when you sign out.
• Consent choice (mm-consent-analytics, local storage): remembers whether you accepted or declined analytics, so we don't ask again.
• Theme preference (local storage): remembers light or dark mode on this device. Never sent to our servers.
• Cart (local storage): remembers what you've added while shopping.

Analytics: only with your consent

None of the following is set, and no analytics request is sent, until you choose Accept in the cookie banner. Choose Decline and the service works exactly the same.

• Our usage telemetry: a random identifier (mm_vid, stored as a cookie and in local storage) plus which pages you view and when, so we can see feature usage and how many people are on the site right now. First-party only; not shared. The identifier and your visit records are deleted ~24 hours after your last visit.
• Google Analytics: _ga and _ga_<id> cookies (typically a 2-year lifetime) used by Google Analytics 4 to measure traffic and usage on our behalf. Configured with IP anonymization on and advertising features off. See Google's Privacy Policy.

You can change your mind at any time: Cookie preferences re-opens the banner (it's also in the footer of every policy page), or you can clear cookies/site data in your browser. Withdrawing consent stops future analytics collection; it doesn't retroactively delete data already gathered, though that data ages out on the schedules in Section 4.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. If you're in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority. California residents have similar rights under the CCPA, including the right to know what's collected and to request deletion. And, again, we don't sell personal data, so there's nothing to opt out of on that front.

Most of this you can already do yourself: edit your profile or delete a binder from Settings, and accept or withdraw analytics consent from the cookie banner or the Cookie preferences link in any policy footer. For anything else, including a full account deletion or data-export request, contact us using the details below.

7. Children's privacy

MichiMarket isn't directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has created an account or given us personal data, contact us and we'll delete it.

8. Security

We use reasonable technical and organizational measures to protect your data: passwords are hashed (never stored in plain text), connections are encrypted, and access to production data is limited. No system is 100% secure, and we can't guarantee absolute security.

9. Changes to this policy

We may update this Privacy Policy from time to time. If a change is material, we'll make reasonable efforts to let you know before it takes effect.

10. Contact

Questions about this policy, or want to exercise one of the rights above? Reach us at [email protected].