Last updated: 4 October 2026
The controller responsible for data processing on this website is:
Rene Reuter
Gassen 32, 63599 Biebergemünd, Germany
E-mail: renereuter@ymail.com
We process personal data only to the extent necessary to operate the website and its collection features:
| Data | Purpose | Legal basis |
|---|---|---|
| Username and password (the password only as a cryptographic hash, PBKDF2-SHA256, with an individual salt – the plain-text password is never stored) | Creating and securing your account | Art. 6 (1) (b) GDPR (performance of a contract) |
| E-mail address | Recovering your password (“forgot password”); we use it exclusively to send the reset link, never for advertising | Art. 6 (1) (b) GDPR |
| Your collection data: marked cards, wishlist, language settings and the time your account was created | Providing the core function (storing and displaying your collection) | Art. 6 (1) (b) GDPR |
| Profile sharing and messages: the sharing status of your profile, an optional introduction text, and the content and time of messages you send to or receive from other users | Optional community feature: voluntarily sharing your collection and allowing users to contact each other (only if you enable it) | Art. 6 (1) (a) and (b) GDPR (consent by enabling the feature / performance of a contract) |
| Trading hub: the cards contained in a trade offer, an optional message, the status and timestamps of the transaction, and an optional rating (👍/👎) of your trading partner once it is complete | Optional trading feature: matching suitable trading partners and handling trade offers between users (only if you have shared your profile) | Art. 6 (1) (a) and (b) GDPR (consent by using the feature / performance of a contract) |
| Card scanner error reports: the photo of the reported scan (only if you explicitly choose to send it), your description of the problem, the measurements of the scan and your user ID | Troubleshooting and improving card recognition; the photos are neither published nor passed on to third parties | Art. 6 (1) (a) and (f) GDPR (consent by submitting the report / legitimate interest in working recognition) |
| IP address (held briefly in memory to limit login and registration attempts, and in server logs) | Security, protection against abuse and automated attacks, operation of the server | Art. 6 (1) (f) GDPR (legitimate interest) |
To use the collection features you create an account with a username and password. The password is stored exclusively as a salted hash and cannot be read by us in plain text. Your collection and wishlist data is linked to your account. Your e-mail address is used solely to send you a single-use, time-limited recovery link if you use “forgot password”.
You may voluntarily share your profile (collection and wishlist) so that other users can see it. This feature is disabled by default and only takes effect once you enable it in your account settings. You decide yourself whether your profile is visible only to signed-in members or publicly via a link; you can switch sharing off again at any time.
The messaging feature lets signed-in users write to each other. Message content is stored so that it can be displayed to the people involved. You can block individual users and delete conversations from your view. An introduction text is optional and voluntary; please do not enter sensitive data there. Please treat messages from others as confidential. The legal basis is your consent by enabling the feature, together with Art. 6 (1) (b) GDPR.
You can optionally be notified by e-mail when you receive a new message. That notification contains no message text, only a note and a link to your inbox. You can switch it off at any time in your account settings.
In the trading hub you are suggested suitable trading partners by matching your duplicate cards against the wishlists of other users who have shared their profile (and vice versa). If you create a trade offer, the cards it contains, an optional message and the history of the transaction are stored and shown to your trading partner. Once it is complete you can each rate the other positively or negatively once; this rating is visible on the shared profile. The actual handover of the cards (shipping, payment) takes place outside this site – we only put you in touch. The legal basis is your consent by using the feature, together with Art. 6 (1) (b) GDPR.
You can optionally be notified by e-mail as soon as somebody offers a card from your wishlist for trade (saved search). That e-mail contains only the card names concerned and a link to the trading hub, no contact details of other users. The notification is disabled by default and can be switched on and off at any time in your account settings.
To operate the site we set a single strictly necessary cookie (a session cookie) in order to keep you signed in for the duration of your session. It contains a signed session identifier, but no advertising or tracking information. No consent is required for this (§ 25 (2) TDDDG).
In addition, cookies and similar technologies may be used as part of serving advertising (see section 7). These are set only with your consent, which we obtain through a consent banner (consent management). You can withdraw your consent at any time with effect for the future.
To display the cards, this website obtains data and images from external services. When card images are displayed in your browser, your IP address is necessarily transmitted to the respective provider. This concerns:
When you click a “buy on Cardmarket” link you are forwarded to Cardmarket (cardmarket.com); from that point on Cardmarket's privacy policy applies. The legal basis for these integrations is Art. 6 (1) (f) GDPR (legitimate interest in displaying the card content in working order).
To fund this website we use Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google AdSense uses cookies and comparable technologies to serve ads and to measure their delivery. In doing so, your IP address (usually truncated), information about your device and browser, the pages you visit and cookie or advertising identifiers may be transmitted to and processed by Google. A transfer to the USA is possible; Google bases such transfers on the EU standard contractual clauses and its certification under the EU-US Data Privacy Framework.
The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. We obtain it before any advertising content is loaded, through a certified consent banner (Google CMP). Without your consent no personalised advertising cookies are set. You can withdraw your consent at any time through the banner or the privacy settings.
Further information about Google's data processing and your choices can be found in Google's privacy policy and in the ad settings.
To improve what we offer, we measure the reach of this website using GoatCounter, an open-source analytics tool that we run ourselves on our own server (stats.tcg-completist.de, located in Germany). No data is transferred to third parties.
GoatCounter works without cookies and does not access your device (it neither sets nor reads cookies or stored content). All that is recorded is the page visited, the referring page, rough information about browser and operating system, the screen size and the country derived from the IP address. The IP address itself is not stored; repeat visits are recognised only through a daily rotating, non-reversible check value. No personal profiles are created and individuals cannot be identified. Your browser's “Do Not Track” setting is respected.
The legal basis is our legitimate interest in data-minimising audience measurement under Art. 6 (1) (f) GDPR. As no cookies are set and no information is stored on or read from your device, no consent under § 25 TDDDG is required.
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. When you access the site, the server automatically processes technical access data (including IP address, date and time, the address requested and browser type) that is necessary for secure operation. This data is deleted after a short time. A data processing agreement under Art. 28 GDPR is in place with Hetzner Online GmbH.
When you scan a card, the camera image is transmitted to our server for recognition, evaluated there and not stored. The only exception is when you explicitly click “report a problem” underneath a scan result: in that case we store your description, the measurements of the scan and – if you leave the “send a photo of this scan” box ticked – the photo, so that we can improve recognition in a targeted way. You can untick that box before sending; the report then goes out without an image. Reported photos are held only on our server in Germany, are not publicly accessible and are deleted as soon as they are no longer needed for troubleshooting, at the latest after twelve months. On request we will delete your report sooner at any time.
Some guide articles embed videos from our YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use a two-click solution: when the page loads, only a preview image from our own server is shown and no data is sent to YouTube. Only when you click “play” is the player loaded in privacy-enhanced mode from youtube-nocookie.com. YouTube then receives, among other things, your IP address, browser and device information and the address of the page embedding the video. YouTube may store or read data on your device during playback; a transfer to the USA is possible (Google relies on the EU-U.S. Data Privacy Framework and standard contractual clauses).
Legal basis is your consent given by clicking the video (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without a click, nothing is transferred. More information is in Google's privacy policy.
We store account and collection data for as long as your account exists. On request we will delete your account and the data associated with it. IP data used to prevent abuse is retained only briefly.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To exercise them, please use the contact address given above. You also have the right to lodge a complaint with a data protection supervisory authority.
We update this privacy policy whenever our data processing changes. The current version published here always applies.