Privacy policy

This policy covers the TCG Weaver plugin for ChatGPT and Codex, the MCP endpoint at https://tcgweaver.com/api/mcp, and the public TCG Weaver website. OpenAI and external sites you choose to open process data under their own policies.

The plugin receives only the arguments needed for the selected tool: a catalog search phrase, public card IDs, a short focus label, or selected public card IDs. The MCP server processes those values to return public card metadata, images, approximate prices, and links. It does not request an OpenAI account identifier, email address, precise location, payment information, password, API key, or complete chat history.

TCG Weaver does not persist plugin tool arguments, tool results, ChatGPT conversations, or in-widget choices. The widget can ask the ChatGPT host to retain private widget state so a visible panel behaves correctly; TCG Weaver does not receive or store that host-managed state. The plugin does not use tool calls for advertising, profiling, or automated model training.

The public website can store saved cards, binder pages, display preferences, and random vote tokens in your browser. Those device-local records remain until you remove them, clear site data, or use an available clear or undo control.

The website records screened usage events after a visible page receives a browser interaction. Events use a random browser token, page identifier, event type, public ranking version, optional public card ID, timestamp, visible time and referring hostname (without its path or query). We inspect browser automation signals and, when available, hosting-provider bot scores; accepted events retain the score and screening reason, not raw user-agent strings. Short-lived keyed network hashes enforce rate limits without retaining raw IP addresses. Rejected submissions are counted only by day and reason. Marketplace redirects contribute a usage event only when linked to a screened browser session and a user-initiated navigation. When you mark a good match, it records a random vote token, the two public card IDs, the public ranking version, and a timestamp. These records do not contain a name or email address. Raw website usage and feedback records are retained for no more than 13 months, after which they are deleted or kept only in aggregate form.

A shared binder is encoded in the link you create. Anyone who receives that link can read the binder data contained in it. Avoid putting personal or confidential information in binder titles.

Cloudflare hosts the service and processes network traffic, application assets, and the pseudonymous website records described above. The MCP server retrieves allowlisted public card images from TCGdex and TCGplayer image hosts. Those server-side image requests do not disclose your ChatGPT identity to the image host.

Tool results and panels can include TCGplayer and eBay links. If you open one, your browser first requests TCG Weaver's redirect service, which may record the screened outbound event described above and apply an affiliate URL, and then sends you to the selected marketplace. Links remain usable when analytics screening excludes the request. TCGplayer and eBay apply their own privacy policies. OpenAI separately processes your conversation and plugin interaction under its policies. TCG Weaver does not sell personal data or share it for cross-context behavioral advertising.

Tool inputs are schema-validated, request and image sizes are bounded, image fetching is restricted to HTTPS allowlisted hosts, redirects are not followed, and internal errors are not returned to users. No internet service is risk-free, but TCG Weaver uses safeguards appropriate to the limited data it handles.

You can exclude this browser from future usage metrics through Analytics preferences. The exclusion cookie remains until you allow metrics or clear site cookies. Rate-limit counters expire after two minutes and are cleaned during subsequent traffic; rejection aggregates are retained for up to 90 days. You can also clear device-local data in the website controls or your browser, undo a saved good-match vote, and avoid opening external links. To ask a privacy question or request deletion of a record that can reasonably be linked to information you provide, use the TCG Weaver Discord support channel. Because the service does not maintain user accounts, it may be unable to associate a pseudonymous record with you.

TCG Weaver is a general-audience card discovery service and is not directed to children below the minimum age required to use ChatGPT in their location. Do not send sensitive personal data, credentials, payment-card information, health information, or government identifiers through the plugin or support channel.

Material changes will be posted on this page with a new effective date. Privacy and data-control questions can be sent through the TCG Weaver Discord support channel.