Privacy Policy

Last updated August 26, 2026

TCG Command Center (“TCC”, “we”) is a trading card collection, scanning, pricing and play platform operated by LevelUpX Solutions. This policy explains what we collect, why we collect it, who we share it with, and how you get it back or get it deleted.

We do not sell your personal information. We do not run advertising networks or third party analytics trackers on the app.

1. Information you give us

• Account. Email address and a password managed by our authentication provider. If you turn on two factor authentication we store recovery codes and, if you set them, answers to security questions. Passwords and recovery codes are stored hashed.
• Profile. Display name, username, and the spoken languages you select so we can match you with players you can actually talk to.
• Collection and inventory. The cards you scan or add, quantities, conditions, storage locations, decks, want lists and trade binders.
• Card images. Photographs you take while scanning. See section 3.
• Business data. If you use the seller or point of sale features: store details, orders, customers you enter, shipments and payouts.
• Support. Bug reports, including an optional screenshot and the page you were on.

2. Information we collect automatically

• Usage needed to run the service: scans counted against your plan, battle minutes used, sign in times.
• Standard server logs from our hosting provider, including IP address, kept for security and debugging.
• A small number of cookies. See section 8.

3. Card scanning and AI

When you scan a card, the image is sent to a third party AI vision provider (OpenRouter, which routes to models including Qwen and Gemini) to read the card, and is stored in our database so you can review the scan afterwards.

• Scan images are held in a private storage bucket and are not publicly accessible.
• Working scan sessions are deleted on a rolling schedule, currently about a week by default with an option to extend.
• If the matcher gets a card wrong and you correct it, we keep that image and the correction so the matching engine can be improved. That is the only case where a scan is retained long term.
• Point your camera at cards, not at people or documents. We are not able to filter what a photo contains.

4. Webcam play, tournaments and broadcasts

Webcam battles are peer to peer where possible, relayed through Cloudflare when a direct connection is not possible. We do not record ordinary battles and your video does not pass through our servers in a form we store.

Tournament feature matches are different. If a host puts your match on stream, that video may be broadcast publicly and recorded, including to YouTube or Twitch. You will be told before a match is featured, and you can decline.

Other players in a room can see and hear you. Treat a battle room as a public space, and be aware of what is behind you.

5. Discord

Connecting Discord is optional. Nothing in this section happens unless you choose to link an account or list a server.

• Linking your account. We store your Discord user ID and username so we can recognise you. We do not receive or store your Discord password or email.
• Listing a server. To confirm you are entitled to list a server, we ask Discord which servers you hold Manage Server on. We keep that answer for fifteen minutes in a temporary cookie and then discard it. We do not store your Discord access token.
• Server rosters. When you use our bot in a Discord server, we record that your TCC account is present in that server so we can scope trade and battle matching to people you share a server with. We do not read the member list of any Discord server, and we do not request the message content, presence or server member privileged intents.
• We never post prices to Discord. Pricing stays inside the app.

You can unlink Discord at any time from your account settings, which removes the stored Discord ID and your roster entries.

6. Payments

Subscriptions and purchases are handled by Stripe. Card numbers never touch our servers. We store a customer reference, your plan, and enough of a record to show you your own billing history. Sellers using the point of sale connect their own Stripe account, and that account belongs to them.

7. Who we share information with

We share only what a provider needs to do its job. We do not sell data, and we do not share your collection or inventory with other users unless you publish it, list it for sale, or share a trade binder.

We may also disclose information if the law requires it, or to protect the safety of our users. If the service is ever sold or merged, your information may transfer with it, and we will tell you before that happens.

8. Cookies

We use cookies that are necessary for the service to work: keeping you signed in, remembering whether you are in personal or business mode, your theme, and a short lived cookie during Discord sign in. We do not use advertising or cross site tracking cookies.

9. How long we keep things

• Account, collection and inventory: until you delete them or close your account.
• Working scan sessions: roughly a week by default, extendable, then deleted.
• Corrected scans: kept to improve matching accuracy.
• Financial records: kept as long as tax and accounting law requires.
• Server logs: a short rolling window.

10. Your rights

You can ask us to give you a copy of your data, correct it, or delete it. Depending on where you live, you may also have the right to object to certain processing or to complain to a data protection authority. Write to privacy@tcgcommandcenter.com and we will respond within thirty days.

Deleting your account removes your profile, collection, inventory and scan images. Some records, such as completed orders and payment history, are kept where we are legally required to keep them.

11. Children

TCC is not directed at children under 13, and we do not knowingly collect their information. Webcam battles and public play surfaces are restricted to users 18 and over. If you believe a child has given us information, contact us and we will delete it.

12. Security

Data is encrypted in transit. Passwords and recovery codes are hashed. Scan images and support screenshots live in private buckets reachable only through short lived signed links. Two factor authentication is available and we recommend turning it on. No system is perfectly secure, and we will notify affected users promptly if a breach occurs.

13. International transfers

We are based in the United States and our providers may process data in the United States and elsewhere. By using TCC you understand your information may be processed outside your country.

14. Changes

We will update the date at the top when this policy changes, and will tell you about material changes by email or in the app before they take effect.

15. Contact

privacy@tcgcommandcenter.com
See also our Terms of Service.