Privacy Policy

Who we are

Hiding TCG provides multi-game TCG tools such as card databases, prices, decks, collections, and play simulators. We may also operate our own online shop (`/shop`) for physical goods when enabled; fulfillment for those orders is by courier / parcel delivery (택배), not in-store pickup as the primary method. Contact for privacy questions: use the site’s published contact channels when available (email in the footer).

Information we process

Account data: if you sign in (for example with Google OAuth), we process identifiers needed for authentication (such as email, name, and provider account id) and store account-linked data you create (decks, collections, binders).

Usage data: on ordinary page visits we record first-party traffic for internal operations. This recording is not gated by the advertising consent banner and has no separate bot filter, so it is closer to “always recorded” for eligible page paths. Fields stored: path, referrer host and UTM/entry-path metadata, the visitor IP address, a salted hash of that IP, country (when it can be resolved at record time), User-Agent, and—if you are signed in—your email and user id. For API calls to our own `/api/*` endpoints we also record path, HTTP method, response status, duration, User-Agent, a salted IP hash (and the IP address for operations), and—if you are signed in—your email and user id. We do not store request bodies, passwords, or payment secrets in these logs. This is not a third-party advertising pixel.

Cookies and similar storage: we use essential cookies/local storage for language, theme, and session. If you accept advertising cookies, Google AdSense may set additional cookies as described in our Cookie Policy.

Shop orders (when public purchase is enabled): order and payment metadata (contact email, ordered items, amounts, payment status from our payment provider). We do not store full card numbers; payment secrets stay with the payment processor. Delivery address and related fields are described under “Shop delivery personal data” below. Exact checkout UI may evolve at launch, but the categories in this policy apply.

Shop delivery personal data (shipping address)

When you place a `/shop` order for physical goods, we collect delivery information as personal data so we can ship the parcel. Primary fulfillment is courier delivery; we do not operate `/shop` checkout around in-store pickup.

Items collected (typical): recipient name; contact phone number; delivery address (postal/ZIP code, basic address, and detailed address); optional delivery notes / requests; and contact email for order confirmation. We may also keep order ID, items, payment status, and tracking numbers linked to that order.

Purposes: order confirmation and customer service; packing and dispatch; courier handover and delivery tracking; handling returns/exchanges/withdrawal; fraud prevention; and statutory record-keeping (commercial, tax, and e-commerce rules).

Consent: placing a purchase (when buy is enabled) includes required notice and agreement that we may process the delivery personal data above for those purposes. Without recipient name, phone, and address, we cannot complete shipment. Optional delivery notes are not required to place an order.

`/trade` and related market screens are comps / reference only. We do not collect shipping addresses there, and browsing those screens alone does not create a delivery-address record.

Card page views

When you open a card detail page (paths like `/g/{game}/cards/{id}`), we count that visit using the same first-party traffic beacon / access_events recording described under usage data above—including path, optional account identifiers if you are signed in, and IP/geo fields already disclosed there.

We use these counts to improve the service, understand card popularity, and may display a view count on the card page (and in internal admin tools). Numbers shown to visitors are human-oriented: known bots are excluded from the displayed total. Bot and crawler hits may still be logged in general traffic, as described under usage data.

Market prices vs our shop

Market and price features (including `/trade` and related views) provide reference information about collectible markets. Those screens are not operated as mail-order sales or mail-order sales intermediation under Korea’s Act on the Consumer Protection in Electronic Commerce, etc., and are not investment advisory or similar investment advisory business under Korea’s Financial Investment Services and Capital Markets Act. We do not accept trade offers, broker third-party transactions, or process payments on `/trade`. Service characterization and liability limits are set out in the Terms of Service.

Our shop (`/shop`), when purchase is enabled, is separate: we may sell physical goods as the seller (통신판매) and fulfill by parcel delivery. Order and delivery personal data for that activity are described under “Information we process,” “Shop delivery personal data,” and “How we use information.” Refund and business disclosures are on `/refund`.

Personal information processed in connection with market browsing (such as usage records) is described in the relevant sections of this policy, consistent with disclosure under Article 30 of Korea’s Personal Information Protection Act. Browsing market pages alone does not create an advertising profile beyond general usage recording and, where you consent, AdSense as described elsewhere in this policy.

Advertising (Google AdSense)

When advertising is enabled on the site and you grant consent, we load Google AdSense. Google and its partners may collect data (including cookies and device identifiers) to show and measure ads. See Google’s policies: https://policies.google.com/technologies/ads

If you choose “Essential only” (or equivalent), we do not load AdSense scripts for that choice. Rejecting ads is our simple “do not sell / share for ads” style control for this site.

How we use information

To operate and improve the service, authenticate users, store your decks/collections, measure basic traffic and card-page popularity, and—only with consent—display ads that help fund the site.

For shop orders (when enabled): to take payment via our processor; confirm the order; pack, ship, and track parcels using the delivery personal data you provide; handle refunds/withdrawals and return pickup/recovery shipping; prevent fraud; and meet tax or bookkeeping duties where required.

Sharing, entrustment, and third-party provision (shop)

We do not sell personal information as a standalone product. Processors that may receive data include hosting/database providers, authentication providers (e.g. Google for sign-in), and—if you accept ads—Google AdSense and its advertising partners.

Payment processing (entrustment / processor): when configured, payment providers such as Toss Payments process payment-related data (order amount, payment method tokens, transaction status, and identifiers needed to confirm or refund payment). Purpose: payment, fraud checks, and refunds. Period: while needed for that transaction and the provider’s statutory retention, then according to their policies and our deletion/anonymization rules.

Courier / logistics (provision or entrustment for delivery): carriers or fulfillment partners receive only what is required to deliver or recover a parcel—typically recipient name, phone, delivery address (including postal code and detail), and optional delivery notes, plus tracking-related order references. Purpose: outbound delivery, delivery inquiry, and return/recovery shipping. Period: until delivery (or return) is completed and any short follow-up for loss/damage claims ends, subject to the carrier’s own lawful retention; we do not keep sharing beyond what is needed for fulfillment and dispute handling.

We share shop personal data with these parties only for the roles above. Exact carrier names may be shown at checkout or on the order/tracking screen when purchase is live.

Retention

Account and user-generated content are kept while your account remains active or as needed for the service. Raw visitor IP addresses in first-party traffic, API operation logs, and related admin alerts are kept for 30 days, then deleted. Salted IP hash, country, path, and timestamps may be kept longer for operations. Consent preferences are stored locally in your browser (and mirrored in a cookie) until you clear site data or choose again.

Shop order, payment, and delivery records (including shipping address linked to an order), when applicable, follow typical Korean e-commerce record-keeping practice under the E-Commerce Act and related rules (policy disclosure—not legal advice): roughly five (5) years for records of contracts / withdrawal and of payment & supply of goods; roughly three (3) years for consumer complaint / dispute-handling records. After delivery, we may also keep delivery and contact details for a commercially reasonable dispute window aligned with those periods (and with any shorter need limited to tracking/loss claims). When statutory or operational need ends, we delete or anonymize the data.

Your choices

You can reject advertising cookies via the consent banner, clear site data in your browser, and manage Google ad settings at https://adssettings.google.com/ when AdSense is in use.

For shop-related data (including delivery address), contact us using the footer email to request access, correction, or deletion where the law allows (some order and shipping records must be kept for statutory periods).

International visitors

The site may be hosted and accessed from multiple regions. By using the service you understand that information may be processed in the location of our hosting providers.

Children

The service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Do not create an account if you are under that age.

Changes

We may update this policy. The “Last updated” date above will change when we do. Continued use after an update means you accept the revised policy where permitted by law.

Account use, deck posts, and shop purchases are also governed by our Terms of Service and, for refunds, `/refund`.