Privacy Policy

What HaulX LLC collects when you use TCG Bolt, why, and what you can do about it. This describes the system as it is actually built, not as a template imagines it.

1. What we collect

When you create an account

• Email address. Used to sign you in and to send transactional mail about your orders, offers, disputes and payouts.
• Display name. Public. Your handle is derived from it and appears on every listing you post and at your profile address.
• Password. Stored hashed. We cannot read it.
• Two-factor secret and backup codes, if you enable two-factor authentication. Backup codes are stored hashed, which is why they can only be shown to you once.

We do not ask for your legal name, your date of birth, your phone number or your home address to open an account.

When you buy

• Shipping address. Collected at checkout and stored against that order. It is shown to the seller of that collection, because somebody has to post the parcel, and sent to Shippo and the carrier in order to produce the label and track it. Nobody else sees it.
• Order records — what you bought, when, for how much, and the state the order reached.

We never see your card number. Payment details go directly to Stripe from your browser. We receive a payment identifier and the result.

We do keep one thing derived from the card: a fingerprint Stripe calculates, which is the same string whenever that card is used and cannot be turned back into a card number or used to charge anything. It is held against the order and compared only against accounts we have closed, so that somebody barred from the marketplace is recognized if they come back under a new name. Delivery addresses are compared for the same reason and nothing else.

Neither comparison decides anything on its own. A match tells a human to look — a card can be shared and an address can be a housemate’s — and no account is restricted without a person deciding it should be.

There is deliberately no address on your profile. An address exists here only because a parcel has to go somewhere, and only for as long as the order record does — there is no standing directory of customers’ home addresses on this site.

When you sell

• Listing content — the manifest, photographs, description and price. Public once approved.
• Identity and bank details go to Stripe, not to us. Selling requires a Stripe account. Stripe performs identity verification and holds those documents; we receive whether verification succeeded and whether payouts are enabled.
• The address you ship from, to buy the label and quote delivery. It is printed on the label as the return address.
• Packing photographs of the open parcel, which you take before it is sealed, kept with the order as evidence of what was sent.

When you ask, answer or make an offer

• Questions and answers on a listing, which are public, with the handle of whoever wrote them.
• The message attached to an offer, seen by the seller.
• Receipts for return postage, if a dispute is upheld and you post the collection back and claim the postage.

Automatically

• A session cookie, so you stay signed in. It is strictly necessary and there is no way to use an account without it.
• Your IP address and browser, stored with each sign-in session so a session can be recognized and a suspicious one ended. The record is kept after the session expires and is deleted with your account.
• Ordinary server logs kept by our hosting provider, including IP addresses, for security and debugging.
• A record of each time you agree to one of these documents — the document, the version, when, the screen you were on, and the IP address and browser you agreed from. It is kept for as long as an agreement or a payment dispute can turn on it, because the question a card issuer asks months later is what you agreed to at the time. Each record is added rather than replacing the one before it, and they are deleted with your account.

We do not run advertising trackers, and we do not sell or share personal information for cross-context behavioral advertising. See Do Not Sell or Share and Cookie Preferences.

Product analytics

We measure how the marketplace is used — pages opened, how far a listing gets through review, whether checkouts complete, when orders change state. This runs on our server and sets nothing in your browser: there is no analytics script, and no analytics cookie.

It also stays with us. These measurements are written to our own database rather than sent to an analytics company, so there is no third-party product-analytics provider in this list and no copy of your activity held by one.

Each event carries its name, the time, an account or session identifier, and properties describing the action, such as an amount or the policy values in force. It does not carry your email address, your shipping address, or anything about your payment card.

2. Why we hold it

• To run the marketplace — showing your listings, moving your orders, paying you. This is performance of our contract with you.
• To decide disputes. A dispute is decided on the manifest, the photographs and the tracking, all of which are records of the parties involved.
• To meet legal obligations — tax collection and remittance where we act as a marketplace facilitator, and record-keeping requirements.
• To keep the marketplace safe — moderation records, and investigating fraud or account compromise.

3. Who we share it with

We use a small number of processors, each for one job:

• Stripe — payments, payouts, identity verification, tax calculation.
• Neon — the database.
• Netlify — hosting.
• Cloudflare — DNS, and object storage for listing photographs.
• Resend — transactional email.
• Shippo — shipping labels, parcel tracking and parcel insurance. Producing a label requires both addresses, so a buyer’s delivery address and a seller’s dispatch address are sent to Shippo and, through them, to the carrier that moves the parcel.
• XCover — the insurer behind that cover, and only when a claim is made. Settling a claim on a lost or damaged parcel means telling them what was in it, what it was worth and where it was going.

We also share what a transaction requires: your shipping address goes to the seller of the collection you bought and to the carrier delivering it, and your handle is visible to anyone. We do not sell personal information.

Payment disputes and chargebacks. If a payment is disputed with a bank or card issuer, we may provide information about the transaction, the account, the agreement you accepted, the delivery and any related marketplace dispute to Stripe, the card networks, the issuing bank and others taking part in resolving it. That can include the order and what was in it, the address it went to, carrier tracking and delivery records, the version of these documents you agreed to and when, and the IP address and browser you agreed from. We provide it to investigate, defend or resolve the dispute, and for no other purpose.

We may disclose information where legally required, and in connection with a sale or transfer of the business — in which case this policy continues to apply to information already collected.

4. How long we keep it

• Account data — while your account is open, and afterwards only as long as needed for our obligations.
• Order records, including shipping addresses — kept as long as tax and accounting rules require, because a completed sale is a financial record and not only a delivery.
• Listing photographs — kept while the listing exists and after a sale as evidence in any dispute about what was sold.
• Moderation records — kept as an append-only log, because the useful question is what has happened with an account over time and a deleted record cannot answer it.

5. Your choices

• Change your email, display name or password in settings.
• Turn off optional email. Only two messages are optional — a price drop and a sale on something you saved. Everything else is part of a transaction, a dispute, a payout, or the security of your account, and cannot be switched off while you have an active account.
• Access, correction and deletion. Write to support@tcgbolt.com. Deletion is limited by the retention above: we cannot erase a completed sale we are required to keep, and we will say so rather than pretend otherwise.

Depending on where you live you may have additional rights, including to know what has been collected, to request deletion, and not to be discriminated against for exercising them. The same address reaches us for all of these.

6. Automated processing

Three things here run without a person, and none of them decides anything about you on its own.

• Text is scanned before it reaches another person. Questions, answers and the message attached to an offer are checked for contact details, links and foul language, and refused as they are written. A refusal is recorded against the account so a pattern has somewhere to accumulate. The scanner blocks a message; it does not close an account.
• Card fingerprints and delivery addresses are compared against closed accounts, so that somebody barred from the marketplace is recognized under a new name. A match tells a moderator to look. A card can be shared and an address can be a housemate’s, so nothing is restricted without a person deciding it should be.
• An accepted offer nobody pays for is recorded against the buyer. Accepting an offer takes the collection off the marketplace and reserves it; if the buyer does not pay before the deadline, the reservation lapses and that is written to their account. It records what happened and nothing more — we do not send it to anyone, it goes to no credit agency, and it is not used for credit, insurance or employment. It sits with the other moderation records, and a pattern of them is a reason for a person to look rather than a restriction that arrives on its own. The Offer Agreement says the same to a buyer before they offer.

We do not profile you for advertising, and we make no decision that produces a legal or similarly significant effect about you by automated means alone.

7. What we do not do

• We do not sell personal information, and we never have, in the ordinary sense or in the broader statutory senses of “sell” and “share” used by state privacy laws.
• We do not process personal information for targeted advertising or cross-context behavioral advertising. Sponsored placements on this site are sold to sellers by position on a page, and which listings you see is not built from anything we know about you.
• We do not collect sensitive personal information. No precise geolocation, no biometrics, no health, racial, religious, sexual orientation, immigration or union data, and no government identification numbers — identity verification for sellers is done by Stripe, and the documents go to them rather than to us.
• There are no third-party advertising or analytics trackers on this site. Our Cookie Policy lists every cookie set, which is why there is no consent banner.

8. Your rights

Most state privacy laws give the rights below to residents of those states. We do not check where you live before answering. It is less work to give everybody the same rights than to run two processes, and a right you have to prove you qualify for is one many people give up on.

• Know and access. Whether we hold information about you, what categories, where it came from, why we have it, and who we have disclosed it to.
• Correct. Fix anything inaccurate. Your email, display name and password are editable in settings without asking us.
• Delete. Erase your account and what hangs off it. An account that has never traded is deleted outright; one that has bought or sold is emptied instead, because those orders are the other party’s history and our tax record. We will tell you which happened rather than implying more was erased than was.
• Portability. A copy of what you gave us, in a machine-readable format.
• Opt out of sale, of sharing for targeted advertising, and of profiling with legal or similarly significant effects. We do none of these, so there is nothing to switch off — but the right exists and the request will be answered.
• Not be treated differently for asking. No worse price, no reduced service, no closed account.

9. How to make a request

Write to support@tcgbolt.com, or to 1424 Turnwood Run, Josephine, TX 75135. Say what you want; you do not need to cite a statute.

• How we verify you. Usually by asking you to send the request from the email address on the account, or to act from inside the signed-in account itself. Where a request would disclose or destroy a lot, we may ask for more, and we will explain why. Information you send to verify a request is used for that and deleted afterwards.
• Authorized agents. Somebody may act for you if they give us written permission signed by you, and we may still confirm it with you directly.
• How long we take. Within 45 days. Where a request is complex we may take a further 45 days and will tell you inside the first 45 that we are doing so, and why.
• Cost. Nothing, for a reasonable number of requests.
• What we may refuse. A record we are required to keep — a completed sale is a financial and tax record, and the moderation log is evidence about an account rather than a profile of a person. Where we refuse we say which of those applies rather than declining without a reason.

10. If we say no

You may appeal any refusal by replying to our decision, or by writing to support@tcgbolt.com with “appeal” in the subject. A different person reviews it, and we will answer within 60 days with what we decided and why.

If we refuse the appeal, we will tell you how to complain to your state attorney general. Texas residents may contact the Office of the Attorney General of Texas; residents of other states may contact their own. That route stays open whatever we decide, and nothing in these terms asks you to give it up.

11. Where you live

• Texas. HaulX LLC is a Texas company and the Texas Data Privacy and Security Act applies to what we do. Sections 8 through 10 are how the rights and the appeal it requires are exercised. We do not sell sensitive or biometric personal data, so the notices the Act requires of businesses that do are not reproduced here.
• California. Sections 1, 3 and 4 are the notice at collection — what is collected, why, and how long it is kept. We do not sell or share personal information as those words are defined by the CCPA, and we do not knowingly collect information from anybody under 16. See our Do Not Sell or Share page.
• Nevada. We do not sell covered information as Nevada defines it. A request may still be sent to support@tcgbolt.com.
• Everywhere else in the United States. The rights in Section 8 are offered to everyone, whether or not your state has passed a law requiring it.
• Outside the United States. This marketplace serves United States buyers and sellers, and information is stored and processed in the United States. If you use it from elsewhere, that is where your information goes.

12. Opt-out preference signals

We honor the Global Privacy Control. Since we do not sell or share personal information, the signal changes nothing about how we treat you — we recognize it rather than ignoring it so that a browser sending one gets a straight answer. We do not respond to Do Not Track, which has no agreed meaning.

13. Security

Passwords are hashed and we cannot read them. Two-factor authentication is available to every account and backup codes are stored hashed, which is why they can be shown to you only once. Sessions are cookie-based and can be revoked everywhere at once from your settings. Payment credentials never reach our servers.

Photographs are resized in your browser before they are uploaded, and re-encoding discards EXIF as a side effect — so the camera original, and the GPS coordinates a phone writes into it, never reach us at all. A photograph of a collection taken at home would otherwise carry the address it was taken at, which is a physical safety problem rather than only a privacy one.

No system is perfectly secure. If a breach affects your information we will tell you, and the authorities where the law requires it.

14. Children

The marketplace is not for anyone under 18. We do not knowingly collect information from children, and we will delete such an account on learning of it. If you believe a child has given us information, write to support@tcgbolt.com and we will remove it.

15. Changes and contact

Material changes carry a new effective date, and we will give notice by email or in your account before they take effect.

HaulX LLC, 1424 Turnwood Run, Josephine, TX 75135. Questions, requests, appeals or complaints: support@tcgbolt.com.

Effective 25 September 2026.