The short version. Listrune sets no analytics, tracking or advertising cookies, and loads no fonts, maps or videos from other people's servers. What we store is your email address, your password as a hash, card data and listing photos you provide. None of it is sold or passed on for advertising.
1. Controller
The controller within the meaning of Art. 4(7) GDPR is the provider named in the Imprint. For privacy questions, write to support@listrune.com.
No data protection officer has been appointed; the conditions of § 38 BDSG are not met.
2. Visiting the website
When you open listrune.com, your browser transmits technically necessary data to our host: IP address, date and time, the address requested, the amount of data transferred, the referrer and your browser identification. These server logs exist to run the site and to fend off attacks.
- Legal basis: Art. 6(1)(f) GDPR — legitimate interest in stable, secure operation.
- Retention: The host keeps the logs briefly and deletes them automatically. We do not analyse them by person and do not combine them with other data.
3. Newsletter
The form on the homepage subscribes you to our newsletter. It carries news from the card market, pricing and selling tips, product news about Listrune and, from time to time, offers on our paid plans. It is therefore expressly advertising for our own service. We normally send it a few times a month and never more than weekly.
Double opt-in
After you enter your address we first send a single email containing a confirmation link. The subscription begins only when you click that link; until then you hear nothing else from us. If you never click it, the address stays unconfirmed and is never mailed.
In the course of this we store your email address, when you signed up, which page you came from, and the IP addresses and timestamps of both the sign-up and the confirmation. That log exists for one purpose only: to show that the consent really came from you. As the sender, § 7 of the German Unfair Competition Act (UWG) puts the burden of proving consent on us.
Unsubscribing and withdrawal
You can withdraw your consent at any time, without giving a reason and at no cost beyond your own connection charges. The simplest way is the unsubscribe link at the foot of every newsletter: one click, no questions asked. An informal email to support@listrune.com does the same. Processing carried out before the withdrawal remains lawful.
- Legal basis: Art. 6(1)(a) GDPR together with § 7(2) no. 2 UWG — your express consent, given by confirming the link.
- Recipients: Sending is handled by Resend (Plus Five Five, Inc., San Francisco, USA) as a processor, see section 7. We use no tracking pixels and measure neither open nor click rates.
- Retention: Until you withdraw. After you unsubscribe we do not delete your address straight away: we block it from any further sending and keep the record of consent and of withdrawal for up to three years, to the end of the year in question. That matches the standard limitation period and is what allows us to defend ourselves against a claim of unsolicited advertising (Art. 6(1)(f) GDPR). If you would rather have the record erased entirely than blocked, tell us and we will do that.
- Unconfirmed addresses: If the confirmation link is never clicked, we delete the entry after twelve months at the latest.
4. Your account
An account needs an email address and a password. We store the password only as a scrypt hash with a random salt — we do not know it in clear text, which is why we can reset it but never send it to you. We also record when the account was created and when you last signed in.
- Legal basis: Art. 6(1)(b) GDPR — performance of the user agreement.
- Retention: For as long as the account exists. After deletion we remove the account and its contents, unless commercial or tax retention periods require otherwise.
5. Your card data
Everything you create in Listrune — batches, cards, conditions, purchase prices, list prices, pricing rules and the names of your eBay business policies — is stored so that you can work with it. It belongs to your account and is not visible to other users.
- Legal basis: Art. 6(1)(b) GDPR.
- Retention: Until you delete the data or your account.
If you scan a card or upload a listing photo, we process that image to identify the card and prepare a smaller photograph for your listing. We store the prepared photo with the card in Cloudflare R2 and use it only for that card's listing. The original upload is not stored there. A photo attached to a card is removed when you remove that card or its batch. A scan photo that you do not attach to a card is removed after 30 days. Publishing to eBay sends the listing photo to eBay, where eBay's own retention rules apply. Anyone with the unguessable photo URL can view the image, so do not include personal information in the photograph.
6. Cookies and local storage
We set exactly one cookie, and only after you sign in:
| Name | Purpose | Lifetime |
|---|---|---|
| lr_session | Keeps you signed in. Signed, httpOnly, SameSite=Lax. | Session |
The application also keeps a few settings in your browser's localStorage: light or dark theme, which batch you had open last, and a short list of your recent CSV downloads. None of this leaves your browser or ever reaches our server.
Both are strictly necessary to provide the service you explicitly requested (§ 25(2)(2) TDDDG) and therefore need no consent. There is no cookie banner because there is nothing else to store and nothing we measure.
7. Recipients and processors
We pass data on only where running the service requires it. Data processing agreements under Art. 28 GDPR are in place with every provider below. Where data reaches the United States, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
| Provider | Purpose | Data |
|---|---|---|
| Netlify | Serving the website | Server logs, IP address |
| Railway | Application server and database | Account and card data |
| Cloudflare | Storage and delivery of listing photos | Card photographs |
| Anthropic | Reading card details from scans | Card photographs |
| Resend | System email (e.g. password resets) and the newsletter | Email address |
| Stripe | Payment processing | Payment data, email address |
We neither collect nor see payment details such as card numbers. You enter those with Stripe only; from there we receive a customer identifier and the status of your subscription. Stripe's own privacy policy applies in addition.
8. Lookups against card databases
For card data and prices, our server — not your browser — queries TCGdex, Scryfall and YGOPRODeck. Only search terms such as card name, set and number are sent. Your IP address and your account data are not passed on.
9. No third-party fonts, maps or videos
The Inter typeface is served from our own domain. There is no connection to Google Fonts or any other external CDN, so simply opening the page transmits your IP address to nobody outside the providers listed above.
10. Your rights
You have the following rights against us:
- Access to the data we hold about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) — you can export your card data as CSV yourself at any time
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
An informal email to support@listrune.com is enough.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
11. Security
All traffic is TLS-encrypted end to end. Passwords are stored with scrypt and an individual salt. Session cookies are signed and are invalidated when a password changes.
12. Changes
We update this policy when the processing changes — for instance because a new feature requires a further provider. The version published here is the one that applies.