Privacy Policy

This policy explains how Dino & Dino TCG (“we”, “us”), a Pokémon card and collectibles shop based in Carlsbad, California, handles personal information collected through this website. It takes effect on September 22, 2026.

What we collect, and why

When you send us a form

Our sell, find-a-card and contact forms ask for your name, a phone number and/or an email address, and your message. The sell form also asks roughly what you have (the size of the collection) and whether you’d prefer cash or trade credit. With each message we record the page you sent it from, your browser’s user-agent string, the referring page and the time, which helps us spot spam.

We use this to reply to you, identify your cards and make an offer. Submissions are delivered to the owners through the alert services we have set up (a push notification through ntfy, an email through Resend, or a webhook to a tool we use to manage messages), and a copy is written to our hosting provider’s server logs. They are not stored in a database on this site. If you give an email address and our email service is switched on, you’ll also get an automatic note confirming we received your message.

When you place an order

Checkout is handled by Stripe Checkout. Stripe collects your payment details and processes the payment; we never see or store your full card number. Read Stripe’s privacy policy (opens in a new tab) for how Stripe handles that information.

Stripe passes us the order details we need to fulfil it: the items, your name, shipping address, email address and phone number. We use them to pack and ship your order, send you tracking, handle returns and keep the business records the law requires. Your name and address also go to the shipping carrier so it can deliver the package.

When you text or call us

Texts, photos and calls to (760) 453-6389 stay on our phone and are used to answer you, identify cards and make offers.

What stays in your browser

Your cart, your light or dark theme choice, the inputs you type into our free tools and your set-checklist progress are saved in your own browser’s local storage, so they’re still there next time. That information is never sent to us. Clearing this site’s data in your browser deletes it.

The site sets no advertising or tracking cookies. The only cookie is a strictly necessary sign-in cookie for the shop’s staff admin area, and it is set only when a staff member signs in.

Server logs

The site is hosted by Vercel, which processes standard request data such as your IP address, browser details, the pages requested and the time, to deliver the site and keep it secure. See Vercel’s privacy notice (opens in a new tab).

Analytics and advertising

There is no analytics software and no advertising on this site at the moment. If we ever add analytics, we’ll update this policy before it goes live. Because we don’t track you across sites, there is nothing for a Do Not Track or Global Privacy Control signal to switch off, but we’ll honor those signals if that ever changes.

Who we share it with

• Stripe, to take payment
• Our alert services (ntfy, Resend or a webhook tool), to deliver your message to us
• Vercel, which hosts the site
• The shipping carrier, to deliver your order
• Anyone the law requires us to share it with, such as in response to a valid legal request

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

How long we keep it

Messages you send stay in our phone, inbox or message tools for as long as we need them to deal with your request, and in the host’s logs for the host’s standard retention period. Order records are kept as long as we need them for shipping, returns, taxes and accounting. Ask us to delete what we hold about you and we will, unless the law requires us to keep it.

Your California privacy rights

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

• Know what personal information we have collected about you, where it came from, why we collected it and who we shared it with
• Get a copy of it
• Ask us to correct it or delete it
• Opt out of the sale or sharing of your personal information (we don’t sell or share it)
• Limit the use of sensitive personal information (we don’t collect any for that purpose)
• Not be treated differently for using any of these rights

To make a request, text or call (760) 453-6389 or email team@dinostcg.com. We’ll confirm it’s you by matching the contact details we already have, then answer within the time the law allows. You can also have an authorized agent make a request for you.

Children

This site is not directed to children under 13, and we don’t knowingly collect personal information from them. Purchases should be made by a parent or guardian. If you think a child has sent us personal information, contact us and we’ll delete it.

Security

The site is served over HTTPS, and payments are handled by Stripe rather than on our own servers. No system is perfectly secure, so please don’t send anything through our forms that we don’t need, such as ID numbers or bank details.

Changes to this policy

If we change how we handle personal information, we’ll update this page and its date before the change takes effect. Our terms of sale and accessibility statement are on their own pages.

Questions

For anything about your information, text or call (760) 453-6389 or email team@dinostcg.com.