Last updated: 20 October 2026
This notice explains what personal information ShinyCatch collects, why, who sees it and how long we keep it. ShinyCatch is operated by NEASHY LTD, a company registered in the Republic of Cyprus under number HE 499747, at Steliou Kyriakidi 6, 3080 Lemesos, Cyprus. NEASHY LTD is the data controller.
What we collect from you
When you create an account: your email address, date of birth, country, a nickname and, if you add one, an avatar image. How you sign in: a one-time email code, a passkey, or your Google account (we receive the email address and identifier Google shares).
When you verify your identity: your first and last name, and the document, photo and face scan you give our identity verification provider on its own page. We receive the result and a reference, not your document.
When you ship a card: the recipient name, address and telephone number. When you withdraw: the bank account details you save.
When you use the platform: your purchases, pulls, sales, bids, offers, giveaway entries, balance history, rewards and support messages.
What we collect automatically
A device cookie. We set one cookie of our own, tcgm_device, the first time a browser visits: a random identifier kept for a year, sent only to us and never readable by the page's scripts.
Device and network signals. Behind each purchase, bid, offer, listing, giveaway entry, referral and sign-up we note the device (by that cookie) and the network it came from, reduced and hashed so the address is never kept whole. Each sighting is kept 90 days. Our staff see only labels for them, never the values, and use them to review accounts that may be one person and to check auctions for fair bidding.
Push notifications. If you turn on notifications on a device, we keep that device's push subscription (the address your browser's push service gave it, its keys, the browser's family and the device's identifier) until you turn them off or the push service tells us it is gone, and delete it 30 days after. A notification carries its title, one line, the page it opens and your unread count, and travels through your browser's push service (Apple's, Google's or Mozilla's).
Usage and errors. We count the screens and actions you use with a usage analytics service, which holds your user id and the events we count and sets no cookie of its own. When something fails, our error reporting service holds your user id and the details of the request.
Where your data is held
Our servers, database and files are hosted in the United States (US East). The service that delivers the site also keeps request logs at its edge. If you are in the European Union or the United Kingdom, your personal data leaves the EU or UK when you use the service. We rely on the safeguards the law provides for such transfers, including standard contractual clauses where they are required.
Who else holds it
Stripe processes card payments on its own pages; we never see your card number. Our identity verification provider holds what you gave it to verify you. Our email delivery service holds the addresses we send to. Our vault partner holds the cards and receives the recipient details of a shipment, and the carrier receives the address and telephone number. Our card price source receives nothing personal. We share information with authorities when the law requires it, and with professional advisers under confidentiality.
Why we use it
To run your account and deliver what you bought: contract. To verify identity before a withdrawal or shipment, to prevent fraud and to keep records of transactions: legal obligations and our legitimate interest in a safe platform. To send you notifications and emails you switched on: consent, which you can withdraw in Settings. To send marketing emails: until you unsubscribe, as the Terms of Service describe.
Automated checks
Some checks run automatically: the device and network signals above can hold a referral, flag an auction or put a withdrawal in review. No automated check closes an account or takes anything from you on its own; a person on our team looks at every flag before a decision, and you can ask us to review any decision by writing to support@shinycatch.com.
What is public
Your nickname, avatar, level, badges, public binders and showcase, your pulls in the live feed, your place on leaderboards and, if you win a giveaway, your nickname and the prize. Your email, name, date of birth, addresses, balance and verification details are never public.
How long we keep it
Your account data for as long as your account exists. When you delete your account, there is a 14-day cooling-off period, then your profile, email, sign-in methods, passkeys, push subscriptions, saved addresses, bank account labels and the words of your support messages are erased. Records of your transactions, the ledger and the audit log are kept, as the law on accounting and fraud prevention requires, without the data above.
Your rights
You can download everything we hold about you from Settings ("Download my data") and delete your account there ("Delete account"). Depending on where you live, you also have the right to ask us to correct, erase or restrict your data, to object to processing based on our legitimate interests, to receive your data in a portable form, and to complain to a supervisory authority. In Cyprus that is the Commissioner for Personal Data Protection. Write to support@shinycatch.com for any of these.
Children
ShinyCatch is for people aged 18 or over. We ask for a date of birth at sign-up and do not knowingly let anyone under 18 create an account.
Changes
We will post any change to this notice here with a new date, and tell you by email if the change matters to you.
Contact
NEASHY LTD, Steliou Kyriakidi 6, 3080 Lemesos, Cyprus. Email: support@shinycatch.com.