Privacy Policy

1. Who we are

TC Market (tcmarket.club) is a marketplace where Tibia players trade Tibia Coins, game accounts and in-game services with each other. It is run by Mohamed Khayal (“we”, “us”), the controller of your personal data: the person who decides how it is used.

For anything about your privacy, this policy or your data, email privacy@tcmarket.club.

Three admins run the site day to day: they help with trades, act as middlemen and handle reports. The site was built by Khufu Systems, which holds the site’s hosting accounts (Supabase and Vercel) and can access the data in them to maintain the site.

2. What we collect

Your account

• Your email address, and your password if you sign up with email. Our sign-in provider stores the password as a hash, never as plain text.
• Your display name and when you last changed it, and when you joined. The display name is yours to choose (3 to 24 characters) and is not tied to a game character.
• Your confirmation that you are 16 or older (“I confirm I am 16 or older.”) and the date you gave it. We do not ask for your date of birth or for proof of age.
• Your role and badges (Verified, Provider, Admin), your number of completed deals and your ratings.
• If you sign in with or link Discord or Google, the details those services send us. Google and Discord below list them.

Your account record is created as soon as you send the email sign-up form, before you confirm your email address, or the moment you first sign in with Discord or Google, before the age step and before you choose a display name. From then on it holds your email address and, if you signed in with Discord, your Discord ID and name.

What you post and do on the site

• Listings. TC offers (buy or sell, amount, price, payment methods, including the name of any other method you type, and a note), account listings (level, vocation, world, skills, items, price and other details) and services (type, description and price), with their status and dates. Account listings have no field for a character name.
• Chats. Your messages, the images you attach, who is in each chat, when people joined or left and when each person last read it. When a chat starts we keep a private copy of the listing as it was at that moment.
• Deals. Who traded with whom, the agreed amount, total price and payment method if recorded, who pressed Deal done and who confirmed, the middleman, each side’s I have sent my side statement, requests to cancel with their reason and outcome, and any note an admin adds.
• Ratings. The stars, the comment, the deal it is about, who gave it and to whom, and when.
• Reports. Who reported whom, where (a chat, a listing or a rating), the reason, and how an admin handled it.
• Warnings and bans. The text of a warning and when you acknowledged it; when you were banned, by which admin and why.
• The admin log. What admins do to members and trades is recorded, such as bans, warnings, hidden listings, removed ratings, handled reports, closed deals and chat takeovers: who did it, what, to whom and when, with details such as a ban reason or a warning text. When an admin reads a chat, an image or your account details, that is not recorded.
• Records of your requests. So that an action you retry (for example after a lost connection) is never done twice, we keep a record of each action: your ID, the action, what you sent and the result.

Chat images

Images are stored exactly as you upload them, with their type and size. A photo can carry hidden details, such as the camera model or the place where it was taken. We do not remove them, and anyone who can view the image can open the original file. Remove such details before you upload, for example by sending a screenshot instead of the photo.

Online status

While you are signed in and have the site open in a visible tab, your browser tells the site every minute that you are active, and we store the time. Pages show you as online if you were active in the last 2 minutes, and the header shows which admins are online.

Discord messages we send

To send you Discord messages and to alert the admins, we queue each message with what it needs: names, the subject of the chat and short excerpts of text (for example the first 200 characters of a support message). See Discord.

Technical data

The companies that host the site and run sign-in log technical details of each request, such as your IP address, your browser and the time, and our sign-in provider records sign-in events with IP addresses. Our own logs record event names, error codes, counts and IDs only: never your email address, your name, your messages or your sign-in tokens.

What we do not collect

The site processes no payments and never asks for card or bank details. It does not use analytics, advertising or tracking tools. But a chat or an image holds whatever you or the other person put in it, such as a payment account, a name on a payment proof or a character name, and admins can read it. Share only what the trade needs.

3. How we use your data and why we may

We use your data to run TC Market and keep it safe. If you are in the European Union, the European Economic Area or the United Kingdom, the law asks us to name a legal basis for each use:

To have an account you must give an email address (or sign in with Discord or Google), a display name and the age confirmation. Without them you cannot use the member features.

The site applies some fixed rules by itself, such as the posting limits, the 30-day expiry of listings and the rating you must give after a completed deal. No decision with legal or similarly significant effects on you is made automatically: warnings, bans, hidden listings and removed ratings are decided by an admin.

We do not sell your data, show you ads or share your data with advertisers or data brokers.

4. Who can see your data

Everyone, including visitors who are not signed in

Your public profile: display name, badges, member since, online status, deals completed and deals closed through a middleman, your ratings as trader or provider and as customer with their comments, who gave them and what the deal was. Your open listings, with everything you wrote in them. The ratings you gave. Whether you are banned. Your email address, your Discord ID and name, your warnings and the reason for a ban are never shown.

The other people in a chat

Your messages and images in that chat, the deal and everything recorded on it, including any note an admin adds, and whether you are online.

Admins

Admins can read every chat and see every image on the site, even in chats they have not joined. They can also access your email address, your Discord ID and name, your deals, reports, warnings and ban details, and the admin log. They need this to help with trades, act as middlemen and handle reports. The site does not record when an admin reads something.

Details the pages do not show

The pages show only what is described above. A few more details can be read through the site’s data interface by someone who knows how to query it:

• the exact time you were last active (anyone);
• when you last read a chat, when you joined or left it, and when the site last sent you a Discord message about it (the other people in that chat);
• an admin’s note on a deal (both people in that deal);
• which admin created a Site offer (anyone);
• the reason an admin gave for hiding your listing (you, as its owner);
• how a report was handled: its status, the admin’s note about it and which admin handled it (the member who sent the report, not the member it is about).

Others

The companies that run the site for us (next section), and Khufu Systems, which holds the hosting accounts (Who we are). We share data with authorities only when the law requires it.

5. Companies that run the site, and where your data is

Some of these companies are based in the United States or elsewhere outside Europe, or use their own providers there, so your data can be accessed from those countries. Supabase, Vercel and Resend process data for us under data processing terms that include the European Commission’s Standard Contractual Clauses; Vercel and Resend are also certified under the EU-U.S. Data Privacy Framework. Discord and Google handle sign-in and messages under their own terms. Discord is based in the United States: the Discord messages and admin alerts we send, with the names and short excerpts they carry, are delivered and stored by Discord.

6. How long we keep it

Most records have no end date: we keep them while TC Market runs, because trades, ratings and reports involve other members and may be needed to settle a dispute or stop a scammer. Nothing is removed automatically except what the table says. If this changes, we will update this policy.

7. How we protect it

• The site works only over an encrypted connection (HTTPS).
• The database checks every request against access rules, so each person can read only what they are allowed to, whichever way they ask.
• Chat images are in private storage with no public address. The site shows an image only after checking who is asking, and tells browsers not to keep a copy.
• The keys that give full access to the database stay on the server and never reach a browser.
• On the site, only the three admins have admin access. What they do to members and trades is recorded in the admin log; what they read (chats, images, account details) is not.
• Khufu Systems, which holds the hosting accounts, can reach the database directly, outside the site, to maintain it. The admin log does not record that access.
• Signing out ends your session on every device where you are signed in.

No system is perfectly secure. If a breach puts you at risk, we will tell you as the law requires. If you find a security problem, email privacy@tcmarket.club.

8. Your rights

You can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data;
• limit how we use it, or stop using it for our legitimate interests;
• give you the data you provided in a format you can take elsewhere.

What you can do yourself. Change your display name in Settings (once every 30 days), link Discord, edit, close or renew your listings, and reset your password from the sign-in page. A new display name does not change what chats already show: messages the site writes into a chat, such as “[Name] asked for a middleman”, keep the name you had then.

What needs us. Changing your email address, deleting your account, removing a Discord link, a copy of your data and everything else. Email privacy@tcmarket.club from the email address of your account, so we can tell it is you; we may ask you to confirm. It is free, and we answer within one month.

Deleting your account. There is no delete button on the site and no admin tool for it yet: we handle each request by hand, directly in the database. Some of your data is also part of other members’ records, such as chats, deals, ratings and reports, and some of it cannot be removed yet without breaking those records. We will tell you what we deleted, what we kept and why, for example to settle a dispute, handle a report or protect other members.

Complaints. You can complain to the data protection authority where you live, where you work or where you think the problem happened. The European Data Protection Board lists the authorities of the EU and EEA. We would like the chance to help first, so please write to us too.

Wherever you live, you can use the same address to ask about your data.

9. Minimum age: 16

TC Market is only for people aged 16 or older. You confirm it once by ticking the required box “I confirm I am 16 or older.” You tick it on the email sign-up form, or the first time you sign in with Discord or Google, before you can use the site. If you joined before this rule, you confirm it once on your next visit. We store your confirmation and the date you gave it. We do not ask for your date of birth or for proof of age, and we do not check ages in any other way.

A first sign-in with Discord or Google creates your account record before the age step, with your email address and, for Discord, your Discord ID and name. If you never tick the box, that record is kept until you ask us to remove it (How long we keep it).

If we learn that an account belongs to someone under 16, we close it: we ban it at once, so it can no longer sign in and its listings are hidden, and then handle its data as a deletion request. To tell us, use Report this user or email privacy@tcmarket.club. TC Market is not for anyone under 16, and we do not knowingly collect data from children under 13.

10. Google

If you sign in with Google, Google shares with our sign-in provider Supabase your Google account ID, your name, your email address, whether Google has verified that address, and the address of your profile picture.

• We use your email address to create your account and sign you in, and your name only to suggest a display name, which you can change before you save it.
• We do not use your profile picture, and we do not access your contacts, files or any other Google service.
• We do not use Google data for ads, do not sell it, and share it with no one beyond the companies that run the site for us.
• It is protected like the rest of your data (How we protect it): encrypted connections, access rules in the database, and full-access keys kept on the server.
• It is stored with your account while the account exists. To have it deleted, email privacy@tcmarket.club. You can also remove TC Market’s access in your Google Account settings at any time; that does not delete your TC Market account.

TC Market’s use of information received from Google APIs adheres to the Google API Services User Data Policy.

11. Discord

Signing in and Link Discord

If you sign in with Discord or press Link Discord, Discord shares with Supabase your Discord user ID, username, display name, avatar, email address and whether it is verified. We copy your Discord ID and name into your profile. Other members never see them; admins can. A Discord account can be linked to one member only. When you first sign in with Discord, your Discord name is suggested as your display name, which is public; you can change it before you save it.

Discord messages to you

Our bot sends you direct messages if you signed in with Discord or linked it, and are in the TC Market Discord server. Signing in with Discord is enough: you do not have to press Link Discord as well. The messages tell you about your chats and deals, for example “[Name] sent you a message about Selling 750 TC”, a deal marked done or completed, a middleman joining, a cancelled trade, or a warning from the admins, which the message quotes. They never contain the text or images of your chats. The bot uses your Discord ID to send them, and we record whether the last one worked.

The site has no setting to turn them off. To stop them, leave the TC Market Discord server, turn off direct messages from server members in Discord’s privacy settings, or email privacy@tcmarket.club to have the link to your Discord account removed. We remove it by hand.

Alerts to the admins

The bot posts alerts to a private admin channel on Discord. They name the members involved and carry short excerpts: a middleman request with the agreed terms; a report with the first 200 characters of the reason; a support chat with the first 200 characters of your message; a request to cancel a trade with the first 200 characters of the reason.

The bot only sends messages. It does not read your Discord messages or your activity in the server. Messages it has sent stay in Discord, under Discord’s own policy.

12. Cookies

We use only the cookies that keep you signed in. There are no analytics, advertising or tracking cookies, and visitors who do not sign in get no cookies at all. The Cookie Policy lists each one.

13. Changes to this policy

We may update this policy. The date at the top shows the current version. If a change matters for how we use your data, we will tell members on the site or on the TC Market Discord before it applies, and ask for your agreement where the law requires it. We will not use Google data in a new way without telling you and asking you first.

14. Contact

Email privacy@tcmarket.club for anything about your privacy or this policy. See also the Terms of Service, the Cookie Policy and the Rules.