Privacy Policy
Last updated October 2, 2026. Lockstock TCG LLC (“Lockstock”, “we”).
The short version
We store what the software needs to do its job: your account, your card inventory, your orders, and your connections to the places you sell. We don't sell personal information and we don't share it for advertising. One seller's own numbers are never shown to another seller. Card payment details never touch our servers.
Who this covers
- Visitors to lockstocktcg.com.
- People who join the beta list through the form on this site.
- Sellers who have a Lockstock account, and the staff they add to it.
- A seller's own customers: people who buy from, or sell cards to, a shop that runs on Lockstock.
What we collect
If you join the beta list
Your email address, how you sell, roughly how many cards you hold, and anything you type in the note box. We use it to contact you about the beta and for nothing else. The form is delivered to us by Formspree.
If you have an account
- Account. Your email address, your display name, and a one-way hash of your password (never the password itself). If you choose to sign in with Google, Google gives us your name, your email address and an identifier for your Google account. We ask Google for nothing else and we never see your Google password.
- Your business records. The cards in your inventory, their prices, costs and conditions, your orders and sales history, your buy lists, and your settings, including your shop's name, contact email and posting address.
- Your eBay connection. The access tokens that let Lockstock work with your eBay account, and your eBay username. Tokens are encrypted before they are stored. Through that connection we read your listings, orders, fees and Best Offers. A Best Offer includes the buyer's eBay username and any message they wrote.
- Other connections you make. If you connect Stripe for your website's checkout, or your own Shippo account for postage labels, we store what those connections need. Keys are encrypted before they are stored.
- Card scans. The photographs you upload to have cards identified and graded. Scans you keep as listing photographs are stored at long, unguessable web addresses that are reachable without a login, because a marketplace has to be able to fetch a listing's pictures.
- Technical records. The ordinary logs a web service keeps to stay up and to investigate faults, and a count of the scans your account has used.
If you are a customer of a shop that uses Lockstock
When you order from a shop's website, we store your name, delivery address and what you ordered so the shop can send it. When you send a shop a list of cards to sell, we store your name, your email address and the list. Your card details go straight to Stripe and never reach us. That information belongs to the shop: we hold it on the shop's behalf, we don't use it for anything else, and we don't market to you. To see, correct or delete it, contact the shop, or write to us and we will pass your request on.
What we do with it
We use it to run the service for you: to identify and price your cards, keep your stock and orders, work with the marketplaces you connected, take payments for your website, and tell you about problems with your account. We do not sell it, rent it, or use it to advertise.
Market statistics built from many sellers
Lockstock shows sellers what cards are selling for. Some of those figures are built from sales recorded in Lockstock by many sellers together. A figure is only published when it comes from at least five sales, made by at least three different sellers, with no one seller making up more than half of them. Only middle values are published, never a highest or a lowest sale. No seller's name, costs, fees, margins or customers are part of it.
We also record, without your prices or your customers, when a person corrects what the card reader read. We use that only to measure how accurate the reader is.
Who else handles data for us
Only the services the product needs, and only the part each one needs:
| Service | What it does | What it receives |
|---|---|---|
| Render | Runs the application and its database, in the United States | Everything stored in your account |
| Cloudflare | Serves this website and stores listing photographs | Website requests; the scans you keep as photographs |
| Anthropic | Reads card photographs to identify and grade them | The photographs you scan. Under Anthropic's business terms they are not used to train its models |
| eBay | The marketplace you connected | Listing, price and stock changes for your own eBay account |
| Stripe | Takes payments for your website's checkout | The order total, the delivery details the buyer enters, and the buyer's card, which only Stripe sees |
| Shippo | Postage labels, through your own Shippo account, if you connect one | The addresses and parcel details for the labels you buy |
| Resend | Sends email from the service | The recipient's address and the message |
| Formspree | Delivers the beta form on this website | What you typed into the form |
| Sign-in, only if you choose it | That you signed in to Lockstock | |
| TCGplayer data, JustTCG and PriceCharting | Card market prices | Which cards are being priced. Nothing about you |
Cookies and tracking
This website sets no cookies and runs no advertising or analytics trackers. Its fonts are served from our own site, so loading a page does not contact Google.
The application sets one cookie, which keeps you signed in. A shop's website remembers a shopping cart in the browser's own storage. We use no advertising cookies and no cross-site tracking.
Do Not Track. We do not track people across other websites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We treat every visitor as if they had sent one.
Children
Lockstock is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, write to us and we will delete it.
Where it is kept, and for how long
The application and its database run in the United States. We keep your account's data for as long as the account is open. If you joined the beta list, we keep your details until you ask us to remove them.
Deleting your data
You can disconnect eBay, Stripe or Shippo at any time from your Connections page, which removes our access. To close your account and have its data deleted, email [email protected]. We will delete your inventory, orders, connections and account, keeping only what the law requires us to keep. Some data may remain in encrypted backups for a limited period before it is overwritten.
When eBay tells us that an eBay member has closed their account, we erase that member's username and messages from every shop's records.
Keeping it safe
Connections are encrypted at rest. Every seller's data is separated from every other seller's in the database itself, not only in the screens. No system is perfectly secure, but we treat credentials and customer data as the things most worth protecting.
Your rights
Depending on where you live, you may have the right to see the personal information we hold about you, correct it, have it deleted, or get a copy of it. Write to [email protected] and we will help. We will not treat you differently for asking. We do not sell or share personal information, so there is nothing to opt out of.
Changes
If we change this policy in a way that matters, we will tell account holders by email and change the date at the top of this page.
Contact
Lockstock TCG LLC · [email protected]