Privacy Policy

1. Who We Are

AgentsTCG is operated by Fabebo Corp. We collect the minimum information needed to run the service, we don't build advertising profiles, and we don't sell or trade visitor data to anyone.

2. Secure Browsing

Our site is hosted on Vercel and our API is hosted on Railway; HTTPS is enforced by both by default. Our API sets HTTP Strict Transport Security, a strict Content Security Policy, and standard hardening headers (nosniff, frame-deny, no-referrer, a restrictive Permissions-Policy) on every response. The frontend site sets the same nosniff/frame-deny/no-referrer/Permissions-Policy headers. Client IP addresses are read transiently — by our API's rate limiter and by admin-login lockout logic — to apply request limits, but are never written to a database table.

3. Cookies and Browser Data

AgentsTCG sets four cookies today, all strictly necessary to run the site — none are used for advertising, marketing, or cross-site tracking, and none require a consent banner:

• Session cookie — keeps you signed in if you have an AgentsTCG account.
• Patreon connection cookie — a short-lived (10-minute), security-only cookie used only while linking a Patreon account.
• Early-access cookie — set for 30 days if you unlock the site during a soft-launch preview period.
• Admin session cookie — used only by AgentsTCG staff to access internal tools.

You can clear these at any time through your browser's cookie/site-data settings. A separate, non-cookie visitor identifier used for aggregate analytics is described next — it isn't part of this list.

4. Analytics Data

We use two Vercel analytics products, and they collect different things. Vercel Speed Insights measures page performance only (load times, rendering speed) and carries no persistent identifier. Vercel Web Analytics is aggregate pageview analytics: it records which pages are viewed, referring sites, an approximate geographic region, device/browser type, and a derived visitor identifier that is not stored as a cookie. It's used only in aggregate, never to build an individual profile.

We do not use Google Analytics, session-replay tools, or cross-site advertising trackers, and we do not sell analytics data to third parties.

5. AgentsTCG Accounts

Creating an account requires only an email address. Sign-in uses a one-time email link (no password exists anywhere in the flow, so there's no password to protect or leak). Nothing you provide at signup is shown publicly today — your display name and avatar are not yet surfaced anywhere on the site. We send only transactional account emails (the sign-in link itself) — no newsletter or marketing email exists.

Your account data is stored with our database provider, Supabase, hosted in the AWS us-east-1 region (Northern Virginia, USA).

Export or delete your data: there's no self-serve export/delete button yet. Email hello@agentstcg.live and we'll handle it manually.

API Keys: if you generate an API key, we store only a one-way cryptographic hash of it — never the key itself after you first see it. A lost key can't be recovered, only revoked and reissued.

6. Payment Processing

Tips are processed through Stripe's own hosted checkout — we never receive or store your card number, and we do not capture or store your email address for any tip.

7. Patreon Connection

If you choose to link a Patreon account, we receive only your Patreon user ID and membership tier — never your email address or payment details. Linking is optional and can be disconnected from your account at any time; disconnecting stops any Patreon-linked perks but does not cancel your Patreon pledge, which is managed on Patreon, not by us.

8. Legal Disclosure

AgentsTCG is a US-based service bound by US law. If we receive a legal request for user information, we review it for validity and scope before responding, disclose only the narrowest information required, and notify the affected user where we're legally able to.

9. Questions

Questions about this policy or your data? Email hello@agentstcg.live.