Privacy Policy

Noxus Trader is operated by Tarraco Labs, which acts as the data controller for the personal data described in this policy.

For anything related to your data — access, correction, deletion, or a complaint — write to manelhidalgoagraz@gmail.com.

We do not use advertising trackers, analytics cookies, or third-party profiling of any kind.

• Account data — Your email address, plus an optional display name, location (a free-text town or area, not GPS coordinates), and avatar image. If you sign in with Google, we receive your email address from Google — never your password.
• Collection data — The binders you create and the cards in them, including quantity, condition, finish, and any notes you add.
• Trading data — Your trade lists, the trades you propose or receive, the messages you exchange with the other trader, and the store you pick as a meeting point.
• Billing data — If you subscribe to Premium, we store a Stripe customer identifier and your subscription status. Card numbers are entered directly into Stripe's checkout and never reach our servers.
• Technical data — A session cookie that keeps you signed in, a cookie remembering your language choice, and standard server logs kept by our hosting provider (IP address, timestamp, and requested page).

• To run the service (Art. 6(1)(b) GDPR — contract) — Creating your account, storing your binders and lists, delivering trade proposals and messages, and managing your subscription.
• To keep it safe (Art. 6(1)(f) GDPR — legitimate interests) — Preventing abuse, spam, and unauthorised access, and diagnosing technical faults. We balance this against your interests and use the minimum data needed.
• To meet legal duties (Art. 6(1)(c) GDPR — legal obligation) — Retaining invoicing and accounting records for subscription payments.
• Because you chose to (Art. 6(1)(a) GDPR — consent) — Optional profile details such as your avatar and location, which you can add or remove at any time.

Trade lists you publish are public: anyone, signed in or not, can see the list, the cards on it, and your trader profile (display name, location, and avatar). Keep a list private if you do not want it browsable.

If you have not set a display name, your email address is shown in its place to other users so counterparties can identify you. Set a display name in your profile to avoid this.

Messages attached to a trade are visible to you and to the other trader in that trade. Your binders are private to you.

We never sell your personal data. We share it only with the providers that make the service work, each acting as a processor under contract:

• Supabase — Database, authentication, and avatar storage. supabase.com
• Vercel — Application hosting and server logs. vercel.com
• Stripe — Subscription payments and billing portal. stripe.com
• Google — Only if you choose to sign in with a Google account. policies.google.com
• CARTO and OpenStreetMap — The stores map loads map tiles directly in your browser, so your IP address is visible to the tile provider while the map is displayed. carto.com

Some of these providers process data outside the European Economic Area, primarily in the United States. Those transfers rely on the European Commission's standard contractual clauses or, where applicable, the EU–US Data Privacy Framework.

Account, collection, and trading data is kept for as long as your account exists. When you ask us to delete your account, we remove your profile, binders, lists, and trades.

Messages that form part of a trade with another user may be retained in that trade's history so the other party keeps a record of what was agreed.

Billing records are kept for the period required by Spanish tax and accounting law, which is generally between four and six years.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.

Email manelhidalgoagraz@gmail.com and we will respond within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es or to the supervisory authority where you live.

All traffic runs over HTTPS. Access to your rows in the database is enforced at the database level with row-level security, so one account cannot read another's private data, and uploaded avatars are scoped to their owner. No system is perfectly secure, but we keep the data we hold to what the service actually needs.

Noxus Trader is not directed at children under 14. If you believe a child under 14 has created an account, contact us and we will delete it.

If we change how we handle personal data, we will update this page and the date at the top. Significant changes will be announced in the app before they take effect.