Privacy Policy

Who We Are

TCG Speed Shipper ("we", "us") is an independent tool built and operated by Clujkeebs. You can reach us about anything in this policy at privacy@tcgspeedshipper.com.

What This Site Does

TCG Speed Shipper converts TCGplayer order CSV exports (or addresses you paste, on any plan) into printable PDF shipping labels and packing slips. Label generation runs entirely in your browser using JavaScript.

When you upload a CSV file, it is read by your browser's built-in FileReader API and processed locally. The resulting PDF is generated in your browser using the jsPDF library and downloaded directly to your device. At no point is your CSV file, your buyers' names or addresses, the items they ordered, or tracking numbers you paste sent to our servers or to any third party. The exceptions are postage you choose to buy (for each label you buy, that order's address goes through our server to our label provider, EasyPost, to create the label; see below) and the optional USPS address check: when the batch check flags addresses and you tap "Ask USPS", the street, apt or unit, city, state and ZIP of up to 10 of them (never the buyer's name) go through our server to the U.S. Postal Service's address service, and we keep USPS's answer in memory for a day so the same address isn't asked twice. Nothing is saved to a database.

Free Plan — No Account

You can use the Free plan without creating an account. In that mode we do not collect or store any personal information about you or your buyers. Your return address, design preferences, "shipped" checkmarks, pasted tracking numbers, and monthly label count are saved only in your own browser's localStorage, which stays on your device. You can erase them at any time by clearing this site's data in your browser.

What We Store If You Create an Account

If you sign in, we store:

• Your email address and password, via our authentication provider, Supabase. Your password is hashed — never stored as plain text and never visible to us.
• Your plan (Free/Base/Premium), subscription status, and billing period end date.
• A count of how many labels you've generated each month — not the buyer names, addresses, or order contents behind that count.
• Your Stripe customer and subscription IDs, so we can manage billing.
• Your personal referral code, and — if you signed up through someone's referral or creator/affiliate link — which code referred you. We use this only to give the referrer their reward or commission, and the referrer does not see your email address.
• Any free-access period you've earned (for example a referral reward).
• Your label settings: your return address, label format and packing-slip choice, so they are the same on every device you sign in on and in the Chrome extension.

Payments

Payments are processed by Stripe. Your card details go directly to Stripe; we never see or store your full card number. Stripe shares with us the information needed to run your subscription (for example, whether a payment succeeded, the plan, and billing dates). If you ever ask your bank to reverse a payment (a dispute), we may send the bank, through Stripe, proof of the purchase and of your account's activity: your email address, when the account was created, sign-in dates, how many labels were made each month, and our policies. We never send buyer names, addresses or order contents.

Promo Codes and Abuse Prevention

When a 100%-off promo code is redeemed, we store a one-way cryptographic hash of the connection's IP address together with the promo code, so the same free code can't be claimed repeatedly from one connection. We never store the raw IP address for this. Our servers also apply short-lived, in-memory rate limits to sign-ups and promo code checks.

Postage You Buy Here

Buying postage is optional. For each label you buy, the recipient's name and address, your return address, the weight and the service go through our server to the label provider so it can create the USPS label. We then keep, on your account: the tracking number, service, price and fee, the order number you labelled, the label's status (bought, refunded) and your prepaid balance history. These are your shipping and payment records, kept while your account exists.

We also keep a copy of the label PDF so you can reprint it or ask for a refund. Because that PDF shows the buyer's address, we delete the saved PDF 90 days after purchase (the tracking number and price stay in your records). Deleting your account deletes all of it, except payment records the law requires us to keep.

AI Features (Speed Agent)

Speed Agent is an optional helper on paid plans. When you use it, what you type and the information you give it for that request (for example the items and prices from an order file you add, never street addresses) is sent to an AI provider to write the answer: Groq, OpenRouter (which passes the request to the model it names) or Anthropic. We send it through our server so your account's usage can be counted; we store only daily usage totals (number of requests and their cost), not your conversations. AI answers can be wrong: check anything it drafts before you send or publish it.

We don't use your data, your buyers' data or your conversations to train AI models, and we don't sell them to anyone who does. Don't paste anything into Speed Agent that you would not want an AI provider to process.

Early-Access Testers

If you ask to test new tools before they launch, we store what you type in the form (name, email, store, where you sell, rough order volume, your note), which tools you asked for and whether we invited you. We use it only to pick testers, turn their access on and email them about the test. Ask us any time to delete it.

Roadmap Votes

When you vote on what we build next, we store which feature you voted for and a one-way hash of your connection (never the raw IP address), so each connection votes once. If you type an email there, we keep it only to tell you when that feature ships, then stop. Your vote is also remembered in this browser (tcgss_roadmap_votes_v1).

Partner Program

If you join the partner program, we store your name, email address, partner code, commission rate and agreement dates, and for each paid month a referred seller brings in: the invoice reference, the amount and your commission. We pay by PayPal, so we keep the PayPal address you give us. If we pay you $600 or more in a year, US tax rules require us to collect a W-9 and send a 1099; we keep those as the law requires. Sellers you refer are never shown to you by name or email: your dashboard shows counts and amounts only.

Emails We Send If You Have an Account

Some emails are part of running your account: sign-in codes and password help, and payment notices such as a note that a renewal payment didn't go through, with a link to fix it. These come with having an account.

New accounts also get up to three short welcome emails in the first week: how to make your first labels, a nudge if you haven't printed a batch yet, and a tip about stamps. Each one has a one-click unsubscribe link, and when you use it we stop sending you welcome and tips emails (payment notices and sign-in emails still come). They include our postal address. To send them we use your confirmed account email address and a note of which of the three you've already been sent; we don't look at your orders. Links in them carry a source tag so our own visit counts show whether the emails were useful.

Newsletter

The seller newsletter (sent every week or two) is opt-in: you're only on it if you enter your email in the "Weekly seller newsletter" box at the bottom of our pages. We store that email address, which box you used, when you signed up, and a one-way hash of your IP address (to stop sign-up spam). If you join the Speed Suite waitlist you can also answer two optional questions (which marketplaces you sell on, and about how many orders a week); we keep those answers with your sign-up to plan what to build first. It is not linked to your account, plan, or usage, and having an account doesn't add you to it. It's never sold or shared. The newsletter is sent through our email provider, Resend, from our own domain (Resend receives the address and the message, nothing else), and every issue has a one-click unsubscribe link, or you can reply "unsubscribe".

Cookies & Browser Storage (Cookie Policy)

Cookie policy last updated: November 6, 2026

Like most web apps, this site keeps some information in your browser: mostly in localStorage (it stays until you clear it), some in sessionStorage (gone when you close the tab), one short-lived cookie, and an offline copy of our own files. We don't use advertising cookies, tracking pixels, social media widgets or third-party analytics, and we don't load fonts or scripts from other companies' servers (except the “I'm human” check described below).

There are two kinds:

• Strictly necessary. These make something you asked for work: your return address and settings, the batch you're working on, staying signed in, security checks, the friend's offer you clicked, and remembering your cookie choice. The law allows these without asking, and the site can't work properly without them, so they are always on.
• Only if you Accept. These only help us count where visitors come from: the broad source of your visit and, if you came from a creator's link, their partner code (so they get credit for sending you). Nothing in this group is written or read until you press Accept. If you press Reject, or simply don't answer, none of it is used and anything left over from before is deleted.

Every tool on the site works the same whether you accept or reject. The one difference: a creator's partner link (/go/… or ?aff=) only gives you its free first month, and only credits the creator, if you Accept, because keeping that code is affiliate marketing. A friend's referral link (?ref=) is different: it is an offer made to you (your first paid month free), so we keep the code you clicked until you sign up whatever you choose.

Everything we store

The Speed Suite apps above are only used if you open them; they store nothing that needs your OK. The Chrome extension keeps its own storage, described under Chrome Extension.

None of the strictly necessary items is sent to us, except your sign-in session (to prove who you are when you use your account), the referral code when you sign up, and the security cookie while you connect eBay. Stripe sets its own cookies on its checkout and billing pages, which are on stripe.com, not on our site; see Stripe's cookie policy.

Changing your choice

The first time you visit, a bar at the bottom of the page asks you to Accept or Reject. Both buttons look the same and either one closes it. We remember your answer (in tcgss_consent_v1) for 6 months, then ask again. You can change it at any time, as easily as you gave it: press Cookie settings at the bottom of any page, or the button below. Choosing Reject deletes the optional items straight away. You can also delete everything by clearing this site's data in your browser settings (that also clears your saved settings and return address).

Cookie settings

Global Privacy Control

If your browser or extension sends the Global Privacy Control (GPC) signal, we treat it as Reject for everything optional, on that browser, without asking you anything, and as a request to opt out of the “sale” or “sharing” of your personal information under California and other US state privacy laws (we don't sell or share it anyway). The Cookie settings button then shows that the signal was honored. To choose Accept instead, turn GPC off in your browser.

Questions about cookies or storage: privacy@tcgspeedshipper.com.

Anonymous Usage Counts

To know whether the site is working and which links bring people here, we count a few actions per day — a visit, loading a file, downloading a PDF, signing up, starting checkout, upgrading, downloading the Chrome extension. Only daily totals are stored (for example, "12 PDF downloads on Sept 26"). There is no cookie, no identifier, no IP address kept, and nothing that could single you out, and it never includes your order data.

If you press Accept in the cookie bar, each count also carries a broad traffic source such as "google", "reddit" or "direct", worked out from the link you arrived by and kept in your browser until you close the tab (tcgss_src, tcgss_ev_*, see Cookies). If you don't accept, or your browser sends Global Privacy Control, the count says "unknown" source and nothing is stored in your browser for it. With Accept, we also keep, for 90 days, where your first visit came from: the tags on the link you arrived by (utm_source, utm_medium, utm_campaign) and the name of the site that linked here, never the page (tcgss_first_touch). They are added only to the sign-up, checkout and upgrade counts, again as daily totals. A browser opened with ?nostats=1 sends no counts at all.

Feedback Box

If you use the feedback box at the bottom of a page, we store your message, the page you sent it from and, only if you type it, your email address so we can reply. We do not store your IP address. We read feedback to improve the site, and you can ask us to delete it at privacy@tcgspeedshipper.com.

Error Reports

If the website hits a technical error in your browser, it sends us a short error report — the error message, the page it happened on, and your browser type — so we can fix it. Reports never include your CSV, buyer names, addresses, or your IP address, and we delete them after 30 days.

If you add a file that looks like a TCGplayer export but cannot be read, the site counts it and may send us the column titles from its first row (for example "Order #" or "City"), only when that row looks like a header, so we can notice when TCGplayer changes its export. Never any order, buyer name, or address.

Chrome Extension

The “TCG Speed Shipper: Labels for TCGplayer” Chrome extension turns your TCGplayer shipping export into a PDF of labels, entirely on your computer. It does not collect, send or sell your orders, the names and addresses in them, or anything else from your orders. On tcgplayer.com it adds a “⚡ Make labels” button to your order pages. Only when you press it, it presses TCGplayer’s own Export Shipping and takes that file instead of saving it; it does not read your order pages, log in for you or run in the background. It asks Chrome for two permissions: storage, to pass the orders from the TCGplayer tab to its labels page in memory (they are deleted as soon as the labels page takes them, and never written to disk), and downloads, to remove that export from your Downloads list when TCGplayer sends it as a plain download. It cannot read your other tabs or other websites.

The extension is for paying members and signs in to your TCG Speed Shipper account. It connects only to tcgspeedshipper.com, and only for your account: your email and password when you sign in (passed to our sign-in provider, Supabase, and never stored by the extension), your plan and how many labels you have made this month, the number of new labels each time you make some (so the website and the extension share one monthly allowance), and your return address, label format and packing-slip choice, which are saved on your account so they are the same on the website. Order files, buyer names and addresses are never sent. Like any web request, these reach our host's logs with your IP address.

It remembers a few choices in its own storage on your computer: your return address, the print format, the packing-slip setting, the order numbers you have printed this month (so a monthly label limit can be counted; printing the same order again costs nothing), and your signed-in session (so you stay signed in until you press Sign out). Removing the extension, or clearing its site data in Chrome, erases them. None of it is sent to us.

Links inside the extension open tcgspeedshipper.com in a new tab and carry only a source tag (utm_source=extension), so we can count visits that come from it (if you accept cookies on the site); after that this policy applies to the website as usual. The page that offers the download counts clicks on its download button as an anonymous daily total, as described under “Anonymous Usage Counts”.

Service Providers

We use these providers to run the site. Each receives only what it needs to do its job:

• Railway — hosts the website and our server. Like any web host, it processes standard request data such as IP addresses in its logs.
• Supabase — authentication and account/plan storage, if you sign in.
• Stripe — payment processing and the billing portal for paid plans and postage balances.
• U.S. Postal Service — only when you tap "Ask USPS" on flagged addresses: the street, apt or unit, city, state and ZIP (no names) of those addresses, to check they are deliverable.
• EasyPost — only if you buy postage in the app: the recipient and return address, weight and service for that label are sent to EasyPost to create the USPS label and tracking.
• Resend — sends account emails (like a sign-up confirmation, password help, a payment notice or the welcome emails) to the email address on your account, and the weekly newsletter to the people who signed up for it. It receives that address and the message, nothing else.
• Groq, OpenRouter and Anthropic — only if you use Speed Agent: the request you make and the information you give it, to write the answer (see AI Features).
• Scryfall, YGOPRODeck and the Pokémon TCG API — public card-price sources. When you set a price alert, our server sends them only the card name and set you watch, never anything about you.
• Google — our email inbox. If you email us, your message and email address are kept in that mailbox so we can answer and keep a record.
• PayPal — only for partners: how we pay commissions.
• Cloudflare Turnstile — an “I'm human” check on the sign-in / Create Account form, to stop bot sign-ups. It loads from Cloudflare only when you start filling in that form, and Cloudflare uses it only for security, not advertising or tracking.
• No third-party script hosts (one exception: the Cloudflare Turnstile check on the sign-in / Create Account form). The open-source jsPDF, QR code and Supabase libraries are served from our own domain, and our fonts are self-hosted, so loading a page doesn't contact a CDN or Google.

We do not sell or rent personal information, and we do not share it for advertising. We also use AI assistants to help us run the business (for example to draft support replies and read our own daily totals). They work for us under the same rules as this policy; they never see order files, because we never have them.

Our servers and these providers are in the United States, so your information is stored and processed there.

How Long We Keep It

We keep account information for as long as your account exists. Specific limits, applied automatically every day:

• Saved postage label PDFs (they show the buyer's address): deleted 90 days after purchase.
• Error reports and server logs: deleted after 30 days.
• Sign-in codes: deleted a day after they expire.
• Feedback messages: kept until we've dealt with them; deleted on request.
• Newsletter sign-ups: kept until you unsubscribe; after that only the unsubscribe record, so we never email you again by mistake.
• Payment and tax records: Stripe and we keep these as long as the law requires, which can be several years.

Monthly label counts are kept as part of your account history. If you delete your account, we delete your account record, settings and usage counts, except anything we must keep for legal, tax, or fraud-prevention reasons.

Your Choices and Rights

You can ask us to access, correct, export, or delete the personal information we hold about you, or to delete your account entirely, by emailing privacy@tcgspeedshipper.com from the address on your account. We'll respond within 30 days. Signed in? You can delete your account yourself: open the account area and tap Delete my account and data. It cancels any paid subscription right away, deletes your account, plan and usage records, and removes your email from our lists, and it takes effect immediately. Stripe keeps the payment records that tax and bank rules require, and we can't change those. We keep one line saying a deletion request was made (the date and the result, plus a one-way scramble of the email address, never the address itself). If your account has billing, postage or partner records we have to settle by hand, we'll finish the deletion within 30 days. If you have an active subscription, cancel it from Manage Billing first (or ask us to), so you aren't charged again. Depending on where you live (for example California, or the EU/UK), you may have additional rights under local law; we honor those requests the same way. We will not treat you differently for exercising them. We treat a browser's Global Privacy Control signal as a request not to sell or share your data (which we never do anyway) and as Reject for optional browser storage; see Global Privacy Control. Want a copy of your data? Email us from your account address and we'll send everything we hold about you in a plain file within 30 days.

Security

Connections to the site are encrypted (HTTPS). Account data is protected by database access rules so each signed-in user can read only their own records, and all changes to plans and billing happen on our server. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.

Children's Privacy

TCG Speed Shipper is a tool for sellers and is not directed at children under 13. We do not knowingly collect personal information from children under 13; if you believe we have, contact us and we will delete it.

Changes to This Policy

If this policy changes, the updated version will be posted at this URL with a new "last updated" date and a line below saying what changed. For material changes that affect account holders, we'll give notice by email or on the site before they take effect.

• November 8, 2026: pasting addresses works on every plan, not only Premium. Pasted addresses are still read on your device and never sent to us; nothing we collect changed.
• November 8, 2026: added the optional USPS address check (you tap "Ask USPS"; street, apt, city, state and ZIP of flagged addresses, never names, go to USPS).
• November 7, 2026: the Speed Suite waitlist's two optional questions (marketplaces, orders a week) and that we keep the answers with your sign-up; a plain-words Your data page.
• November 7, 2026: named EasyPost as the company that creates postage labels you buy here (it replaced our earlier provider), and listed the label settings (return address, label format, packing-slip choice) we save on your account when you sign in.
• November 6, 2026: a setting (tcgss_nostats) that leaves a browser out of the anonymous daily counts, used for the site owner's own visits.
• November 6, 2026: with Accept, the sign-up, checkout and upgrade counts also carry where your first visit came from (tcgss_first_touch, kept 90 days): the link's tags and the linking site's name, as daily totals only.
• November 2, 2026: a new cookie choice (Accept or Reject, changeable any time under Cookie settings); where-you-came-from storage and creators' partner codes now only with Accept; Global Privacy Control treated as Reject; a full table of everything stored in your browser; referral codes forgotten after 90 days and partner codes after 13 months if you haven't signed up.
• November 1, 2026: added what we keep when you buy postage and the 90-day limit on saved label PDFs; added AI Features (Speed Agent) and its AI providers; added the Partner Program, early-access testers and roadmap votes; firm deletion times for logs and sign-in codes; how to get a copy of your data; Global Privacy Control; that our AI assistants follow this policy; where data is stored; that we never use your data to train AI.
• October 23–25, 2026: the Chrome extension and its account sign-in; the feedback box; the free plan of 15 labels a month.

Contact

Questions about this policy or your data: privacy@tcgspeedshipper.com. For help using the tool, see our Support page.