Privacy Policy

The short version

Reading the market research on this site needs no account. The site counts visits with its own first-party analytics (below) and keeps no IP address in it. There are no advertisements, and no third-party analytics, advertising or tracking scripts. Creating an account stores what you type - your email, the cards you keep and follow, and anything you write down - to run those features. Basic usage statistics help improve the service. Your information is never sold, never used for advertising, and never shared with a third party except where this policy says otherwise.

What is collected

• Account data. Email address, display name, and a password hash (never the password itself) - see "Passwords" below.
• What you keep in your account. Your collection and watchlist (including any price targets), plus any notes and saved views made in the earlier version of the site. Stored to make the features work, visible only to you; administrators' member reports use counts, without private content.
• Contact messages. Name, email address, subject and message body, if you use the contact form - kept so a reply can be sent, and as a record of correspondence.
• Sign-in sessions. While you are signed in, your session record keeps the IP address and browser string it was created from, so misuse of your account can be spotted. It is deleted when you sign out, and after at most 90 days in any case.
• First-party analytics. Described in the next section.
• Web server logs. Described below.

Analytics

We use our own analytics to understand visits and improve Pokespective. These measure page use, referring sites and campaign tags, technical performance and marketplace-link activity, including TCGplayer and eBay, without measuring purchases. A random visitor cookie helps distinguish visits and automated traffic. Traffic statistics are kept separate from account records. No IP addresses are stored in the analytics database, and we use no third-party analytics or advertising trackers.

Account service statistics

Administrators can see basic account-use statistics, such as last use, active days and use of member tools, plus counts of saved cards and tools. Daily account-use summaries are kept for 90 days; the first recorded use is kept with your account. Public browsing and marketplace clicks are not linked to your account, and private notes and purchase costs are not included.

This serves our legitimate interest in improving member features. It is restricted to authorised administrators and is not used for advertising or automated account decisions. You can object through the contact page without losing access to account features.

Web server logs

Like almost every website, the web server keeps a log of requests - IP address, time, the address requested, the referring page and the browser string - used to keep the site secure, deal with abuse and check traffic classifications. Raw IP addresses and browser strings from these checks are not copied into the analytics database. These logs are deleted after at most 14 days.

Cookies

Up to three first-party cookies, all set by this server and read by nothing else:

• pmi_session - only present if you are signed in; identifies your session so the site knows who you are. Deleted when you sign out.
• pmi_visitor - a random analytics identifier, expiring after 13 months.
• pmi_internal - set only in a browser that has been opted out of the visit counts (in practice, the operator's own), and holds nothing but the value 1.

No cookie is used for advertising or shared with anyone. You are free to block them: the research pages work the same either way, and only signing in needs the session cookie.

Passwords

Stored as a memory-hard hash (Argon2id, or scrypt where Argon2 is unavailable) - never as plain text, and never in a form that can be reversed back into your actual password, including by the operator.

Where data is kept

On a single server the operator controls. Account data is backed up nightly and backups are kept for 30 days; the market research data is rebuilt from public sources daily and is not personal data.

Why it is processed

Account data and what you keep in your account are processed to provide the features you signed up for. Analytics and server logs and minimal administrative counts of saved account tools are processed in the operator's legitimate interest in understanding how the site is used, improving the service and keeping it secure. Limited account service statistics use the interest and safeguards described above. Contact messages are processed to answer them.

Your rights

You can ask to see, correct, or delete your account and everything attached to it at any time through the contact page. Deleting an account removes your email address, collection, watchlist, notes and saved views. You also have the right to complain to a data protection authority - in the Netherlands, the Autoriteit Persoonsgegevens.

Children

This service is not directed at children and does not knowingly collect data from anyone under the age required by their local law to consent to this kind of service on their own.

Changes to this policy

This policy may be updated as the product changes. The date at the top of this page is the last time it was.

Contact

Questions about this policy, or a request under "Your rights" above, can be sent through the contact page.