Privacy Policy

Who we are

This website, toploaderos.com, and the Toploader OS app are run by:

Liam Tizzard, trading as Magic Sausage
43 Terrace Road
Flat 1
Walton On Thames
KT12 2SP
United Kingdom
Email: liam@toploaderos.com

We are the “controller” of the personal information described in this policy, which means we decide how it is used. If you have any questions about this policy or your information, email us at liam@toploaderos.com.

Information we collect and why

When you buy from our shop

When you place an order we collect your name, billing and delivery address, email address, phone number (if you give one) and the details of what you ordered. We use this to take payment, make and deliver your order, send order updates, handle returns and keep the records the law requires for tax and accounting. Our legal basis is that we need this information to carry out our contract with you and to meet our legal obligations.

Payments are handled by the payment provider you choose at checkout (see “Who we share information with” below). We never see or store your full card details.

If you create an account, we also keep your login details and order history so you can view your past orders.

WooCommerce, the software that runs our shop, records how you arrived at the site (for example, the website or campaign that referred you) and attaches it to your order. We use this to understand which of our marketing works. Our legal basis is our legitimate interest in running and improving our shop.

When you leave a review

Our review form asks for your name or handle, an optional description of what you do, a star rating, your review and, optionally, your email address. We only publish your name, description, rating and review, and only after we’ve checked it. Your email address is never shown and is only used if we need to contact you about your review. We rely on your consent to publish your review, which you give by ticking the box on the form. You can ask us to remove your review at any time.

To stop spam, the review form uses Google reCAPTCHA, which collects information about your device and browser and sends it to Google. Google’s Privacy Policy and Terms of Service apply. We also use a scrambled version of your IP address to limit how many reviews can be sent from one connection; it is deleted automatically after an hour. Our legal basis for these anti-spam measures is our legitimate interest in keeping the site free of abuse.

Website analytics

If you accept analytics cookies, we use Google Analytics (loaded through Google Tag Manager) to understand how the site is used, such as which pages are visited and how visitors found us. This tells us about visits in general, not about you by name. Our legal basis is your consent, which you can give, refuse or withdraw at any time using our cookie banner and the cookie settings button shown on every page.

When you contact us

If you email us or message us on Discord, we use the details you send to reply and help you. Discord is run by Discord Inc. under its own privacy policy.

Server and security logs

Like most websites, our hosting provider automatically records technical information such as IP addresses, browser type and the pages requested, to keep the site secure and working. These logs are kept for a short time and are not used to identify you.

The Toploader OS app

Toploader OS is a local-first desktop app. Your inventory, collection, decks, trades, settings and imported files are stored on your own computer, and we cannot see them.

The app connects to some online services so that its features work:

• Lemon Squeezy, to activate and check your licence key;
• GitHub, to check for and download updates;
• Scryfall and TCGdex, for public Magic: The Gathering and Pokémon card data and images;
• Cardmarket, for public price data;
• an exchange-rate service, for currency conversion;
• your own WooCommerce or Shopify store, if you connect one. The app talks to your store directly to publish the products you choose and read its paid orders; nothing about your store or its orders comes to us.

These requests don’t include your inventory or collection. Two optional features send information to us, and both are off unless you switch them on:

• Anonymous usage analytics. The app asks before sending anything. If you allow it, it sends anonymous feature-usage events, such as which tools are used, along with your app version, operating system and region. It never sends card names, inventory, collection or CSV contents, buyer or seller names, file paths, licence keys or personal details. You can turn it off in the app’s settings.
• Help improve the scanner. If you turn this on in the card scanner, the app sends us cropped images of scanned cards (never the full camera view) together with the scanner’s guesses and settings, so we can improve card recognition. Samples are stored with Cloudflare and deleted from Cloudflare within 30 days. From some samples we make card fingerprints, short codes describing how a card looks from which the picture can’t be rebuilt, and publish them with the scanner’s card index so everyone’s scanner recognises those cards better. Turning the setting off stops sharing and deletes any samples that haven’t been sent yet.

The Toploader OS phone app is optional. If you pair it with the desktop app, the two talk directly over your own Wi-Fi network and nothing passes through us. What the phone app does with information is explained in our phone app privacy policy.

The app’s full privacy notice is available inside the app under About.

Who we share information with

We only share personal information with organisations that help us run the website, shop and app, and only what they need to do that:

• Payment providers: Stripe (through WooPayments), PayPal, and Klarna, Clearpay, Apple Pay, Google Pay or Amazon Pay if you choose them at checkout. They process your payment and may carry out fraud checks under their own privacy policies.
• Royal Mail, who receive your name and delivery address to deliver your order.
• IONOS, who host this website and its data.
• Google, for Analytics, Tag Manager and reCAPTCHA.
• CookieYes, who run our cookie banner and keep a record of your cookie choices.
• Lemon Squeezy, who sell Toploader OS licences as the merchant of record. When you buy a licence, Lemon Squeezy handles your payment and details under its own privacy policy.
• Cloudflare, who run the services that receive the app’s optional analytics and scanner samples.
• Sentry, who store crash reports from the phone app, if you leave crash reports switched on in the app (stored in the EU, kept for up to 90 days).

We don’t sell your personal information, and we’ll only share it with anyone else if the law requires us to.

Some of these providers process information outside the UK. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement.

Cookies

Cookies are small files stored by your browser. We use:

• Essential cookies, which keep your basket and checkout working, keep the site secure and remember your cookie choices. These can’t be switched off.
• Analytics cookies from Google Analytics, only if you accept them.
• Fraud and spam prevention cookies set by payment providers and Google reCAPTCHA when you check out or leave a review.
• Order attribution cookies used by WooCommerce to record how you arrived at the site, as described above.

You can change your choice at any time using the cookie settings button in the corner of every page, or by clearing cookies in your browser.

How long we keep information

• Orders and related records: six years, as required for tax and accounting.
• Customer accounts: until you ask us to close your account, apart from order records we have to keep.
• Reviews: for as long as the review is published, or until you ask us to remove it. Reviews we don’t publish are deleted.
• Review-form spam protection data: one hour.
• Analytics data: for the retention period set in our Google Analytics account.
• Emails and messages: for as long as we need them to deal with your query.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict, or object to, how we use your information;
• ask for your information in a portable format;
• withdraw your consent at any time, where we rely on consent (this doesn’t affect anything we did before you withdrew it).

To use any of these rights, email us at liam@toploaderos.com. We’ll reply within one month.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first, so please contact us.

Children

Our shop is for adults. If you’re under 18, please ask a parent or guardian to place an order for you. We don’t knowingly collect information from children under 13.

Changes to this policy

We may update this policy when our website, shop or app changes. The date at the top of this page shows when it was last updated.