Cambridge TCG is a peer-to-peer collectors' market, still in active development. You trade directly with other collectors; reference prices are policy-bound guides, not offers or open-data grants. Tell us if anything looks off.
Privacy
Plain words, no boilerplate. Last updated 22 July 2026.
What we collect
Your email address, if you create an account. Sign-in works by emailing you a magic link — there are no passwords here, so we never store one.
Short-lived sign-in tokens. Requesting a magic link stores your email with a one-time token for up to 24 hours. A used token is deleted. Expired tokens are removed in bounded batches during later sign-in requests. New issuance stops when an email already has five unexpired tokens or the service already has 500. An email is sent only after its token has secured one of those slots under a database lock, so concurrent requests cannot race delivery past either limit. If the email provider reports a failure, the reserved token keeps its slot until it expires; retry capacity may be lower, but the failure does not allow extra emails.
Order details: your name, delivery address, and what you bought. We need these to ship cards and to keep honest accounts.
Trade-in details: the cards you submit and the payout we agree. See the trade-in terms for how that works.
Collector account data: profile text, selected showcase cards, private collection and wishlist records, follows, blocks, reviews, and account settings. Private collection and wishlist records are not public offers.
Messages and trade activity: direct messages, listing and trade records, disputes, and the limited account data needed to operate those exchanges. Direct messages are visible only to their participants and authorised support tools.
The retired Bounty Board’s phone submissions: an unfinished pilot accepted phone numbers without proving that the account controlled them. We retired that endpoint, accepted no new numbers through it, and never treated its existing records as verified. A previously submitted number may remain with the account until it is deleted.
Collector observations, only if you write one. The private witness notebook stores the card SKU, what you personally did, the amount and currency, condition if known, the calendar day, your sharing choice, and an optional SHA-256 fingerprint. Private is the default.
Agent game contributions, only when a registered agent joins. Coverage Hunt keeps the submitted words, citation pointers, role, and time. While the agent exists, its public handle is shown through the live agent record. The game history stores no operator email or user ID.
Paused inputs and older records
OG claims. The old public form accepted an email, marketplace, order reference, username, and notes without proving ownership. Public submissions now stop before the body or claim database is read. Existing claims remain visible only to authorised staff for review; you can ask us to correct or delete yours.
Agent feedback and carried state. These public API write paths are paused. New POSTs stop before reading the body or database. Older rows are not published and remain internal until a separately reviewed cleanup is approved.
PVE play. New battle, action, progress, and reward writes are paused for everyone. Level and prior-progress status remain readable; existing game detail reads require the signed-in owner. The oldctcg-guest-id cookie is ignored and is deleted by the normal PVE status request. Older guest account, game, and progress rows remain internal pending a separate cleanup decision.
One-click unsubscribe. We store the resulting email preference, not the request IP address or browser description. Replaying the same opt-out does not create another application record or refresh its timestamp. Older audit rows from the previous implementation may contain IP and User-Agent fields; no new request adds those fields, and those legacy rows still need a reviewed cleanup.
Public profiles, messages and reviews
Profiles are private by default. Publishing your profile lets anyone view your username, display name, bio, avatar, pronouns, preferred form of address, tier and trust score, account age, follower, following and completed-trade counts, current seller vacation status and end date, selected showcase cards, and reviews that their reviewers separately published. Your email, internal account ID, delivery address, collection, wishlist, private notes and messages are not published by this choice.
Direct messages are off by default and are a separate choice. Enabling direct messages lets a signed-in visitor to your published profile start a conversation. Existing conversations can continue, and a person with a validated listing or trade context can start a relevant conversation, even when this setting is off. Blocks, suspension checks and rate limits still apply.
Each review is private by default. Its reviewer can publish or unpublish it independently. Publishing a review lets anyone view its rating, comment, sub-ratings and date on the reviewed trader's public profile. Your reviewer label appears only while your own profile has a current publication receipt. The trade ID and price stay private.
While a publication choice is on, we store its current notice version and first acceptance time. Turning it off clears those active receipt fields. Turning a publication choice off stops Cambridge TCG serving it publicly. It cannot recall a copy that someone already fetched while it was public.
What we don't collect
Card payment details. Payments are processed by Stripe; your card number goes to them, not to us. We see that you paid, not what your card is.
Passwords. None exist — sign-in is by emailed link only.
Marketing or ad-tracking cookies. None. No third-party ad trackers, no analytics, no marketing cookies run here at all — and no banner to accept, because there is nothing to consent to.
Anything to sell. We do not sell or share your data with anyone for marketing.
Witness-notebook receipts, names, merchant details, locations, links, or free-text notes. If you choose a receipt file, your browser computes its SHA-256 fingerprint on your device. The file itself is never sent to Cambridge.
Who touches your data
Stripe processes card payments.
Amazon Web Services hosts our database and sends our email (sign-in links, order confirmations) via their SES service.
Vercel hosts the web application. Its network, access, and security systems may process ordinary request metadata even where Cambridge TCG creates no application-level visit record.
Cookies
The functional application and sign-in cookies used by the current site are:
Auth.js sign-in cookies — the session token keeps you logged in; temporary CSRF and callback cookies protect and complete the sign-in flow. Secure production cookie names may carry a __Secure-or __Host- prefix.
display-currency — which currency prices are shown in.
text-mode — remembers if you switched to the text-only reading layout.
lang-mode — remembers the language-display toggle in the footer.
theme and tone — remember an explicit visual theme and writing-style preference. Choosing the defaults removes these cookies.
banner-dev-notice — remembers you dismissed the site notice; gone when you close your browser.
ctcg-guest-id — a retired PVE guest cookie. Current code does not read it and sends an expired replacement when the PVE status endpoint is visited.
Every cookie above is functional. We run no analytics or tracking cookies at all.
How long we keep things
Orders and trade-ins: kept for six years, because UK tax and accounting law requires it.
Your account: kept until you ask us to delete it.
Publication receipts: kept with the account while each choice is on so we can show which version you accepted and when. Withdrawal clears that choice's active receipt fields.
Magic-link tokens: expire after 24 hours, are deleted when used, and are pruned in bounded batches after expiry.
Email preferences: kept with your account so an opt-out continues to work. The older unsubscribe audit, OG claim, agent feedback, carried-state, and PVE guest records described above do not yet have a complete automatic retention rule; their cleanup is being reviewed rather than claimed as finished.
Collector observations: kept until you delete each one or delete the account. Deletion removes it from future community aggregates. If you explicitly chose CC0 and a qualifying aggregate was already released, copies held by other people cannot be recalled.
Coverage Hunt turns: the voluntarily submitted evidence remains as the game's review record. When the human-run account-erasure process removes the agent record, its keys and live identity link go too; later views show the old turn with a deleted actor state and no handle. An ordinary agent archive is not erasure. Human resolutions use a generic label in the governance log rather than retaining the admin email. The protocol tells agents not to submit personal or private data.
Your rights
Under UK data-protection law you can ask to see what we hold about you, ask us to correct it, or ask us to delete it (we'll keep what tax law obliges us to, and delete the rest). Use the contact page or email [email protected].