Privacy Policy

Tallgrass is operated by JOCO INC, a company based in Québec, Canada. JOCO INC is responsible for the personal information described in this policy (the “controller” under the GDPR).

This policy applies to the Tallgrass website. It is written to meet Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and, where they apply, the EU/UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).

Under Québec law, the person in charge of the protection of personal information at JOCO INC is its President. You can reach them through the Contact page (choose “Privacy request”) or by email at red@tallgrass.io.

When you simply browse. You don’t need an account to browse the catalog and prices. We don’t track you. We count page visits and measure loading speed with Vercel Web Analytics and Speed Insights, which use no cookies, don’t identify you and only give us aggregated totals (a visitor is recognized for at most one day through a hash that is discarded). To deliver pages and protect the site, our hosting providers automatically process technical data such as your IP address, browser type (user agent), the page requested and the time; they keep these logs for short periods under their own policies. Two small cookies remember your language and display currency — see the Cookie Policy.

When you use the contact form. Your name, email address, the type of request, your message, an optional page URL, the language of the site when you wrote, your browser’s user agent, the date, and a salted hash of your IP address. We store the hash — not the IP address itself — only to prevent abuse and limit repeated submissions.

When you have an account (public sign-up is currently closed; this will apply once it opens):

• Account details: email address, username and display name. Your password is handled entirely by our authentication provider, Supabase Auth; Tallgrass never sees it and stores no password or password hash. Supabase Auth also keeps technical sign-in records (for example the time of your last sign-in) and a session cookie keeps you signed in.
• Collection data: the cards you own, quantities, condition, grading, purchase price and currency, notes, binders and their names and descriptions, wishlists, sealed products, and anything you import from a CSV file.
• Preferences: such as your display currency and language.

We don’t ask for, and you shouldn’t put in notes or binder descriptions, sensitive information such as health or financial account details. No payments are processed on Tallgrass.

We use personal information only for these purposes:

• to create and secure your account and keep you signed in;
• to store your collection, show it back to you and calculate its estimated value;
• to display a binder on a public share link, only if you choose to share it;
• to import and export your data (CSV);
• to answer your messages and handle your requests, including privacy requests and takedown requests;
• to fix bugs you report and keep the site working;
• to prevent abuse, spam and attacks (for example rate limiting with the hashed IP address);
• to comply with the law and to establish or defend legal claims.

We collect only what is necessary for these purposes. If we ever want to use your information for a new purpose, we will ask for your consent first unless the law allows otherwise.

• No advertising, no tracking pixels, no third-party marketing cookies, no cookie-based analytics (only cookieless, aggregated visit statistics).
• No sale or rental of personal information, and no “sharing” for cross-context behavioural advertising.
• No profiling and no decisions about you made solely by automated processing.
• No marketing emails. In fact, Tallgrass sends no emails yet.

By sending us a message or creating an account, you consent to the collection and use of your information for the purposes above. You can withdraw your consent at any time — for example by deleting your account or asking us to delete your messages — but we may then be unable to provide the related service. Withdrawing consent doesn’t affect processing already done, or information we must keep by law.

We share personal information only with:

• Our service providers, who process it on our behalf and under contract: Supabase (database and authentication), Vercel Inc. (web hosting, content delivery, serverless functions and cookieless visit statistics) and, when the security check is shown on a form, Cloudflare, Inc. (Turnstile, which uses technical signals such as your IP address and browser to tell people from bots). They may use it only to provide their services to us.
• People you choose, when you share a binder link — anyone with the link can see that binder.
• Authorities, when the law requires it (for example a valid court order), or when needed to protect rights, safety or the service.
• A successor, if Tallgrass is ever sold or transferred, in which case the information would remain protected as the law requires and this policy would continue to apply.

If we add a transactional email provider (such as Resend) to send account emails, we will update this policy before doing so.

Our database and authentication (Supabase) are hosted in Canada, in the AWS Canada (Central) region in Montréal. The site itself is hosted by Vercel Inc., a company in the United States, and served through a global edge network. This means request data (such as IP addresses) and the content of pages you load may be processed in the United States and in other countries where edge servers are located.

As required by Québec law, we assessed these communications of information outside Québec before relying on them — taking into account the sensitivity of the information, the purposes, the protection measures (including contractual ones) and the legal framework of those countries — and concluded that the information receives adequate protection. Our providers are bound by contract to protect it and to use it only to provide their services. Information processed abroad may be subject to the laws of that country, including lawful access by its authorities.

• Contact messages: up to 24 months after your request is closed, and longer only if needed to establish or defend a legal claim (for example a disputed takedown).
• Account and collection data: for as long as your account is active. When you ask us to delete your account, we delete it within 30 days; copies in our provider’s daily backups disappear within about 7 more days.
• Shared binders: stop being public as soon as you stop sharing them or delete them.
• Hosting logs: kept by our providers for short periods under their own policies.

When information is no longer needed, we destroy it or anonymize it in accordance with the law.

We use reasonable security measures suited to the sensitivity of the information: encrypted connections (HTTPS) everywhere, encryption at rest at our database provider, access limited to the people who need it (today, only the owner), strong authentication on administrative accounts, passwords handled solely by our authentication provider, and IP addresses stored only as salted hashes in contact messages.

No system is perfectly secure, but we work to keep risks low and review our measures as the site grows.

If a confidentiality incident (such as unauthorized access to, or loss of, personal information) occurs, we will act quickly to reduce the risk of harm and prevent it from happening again. We keep a register of incidents. If an incident presents a risk of serious injury, we will promptly notify the Commission d’accès à l’information du Québec and the people affected; where PIPEDA applies and there is a real risk of significant harm, we will also report it to the Office of the Privacy Commissioner of Canada and notify those affected.

Subject to the law, you have the right to:

• access the personal information we hold about you and learn how it is used and to whom it has been communicated;
• correct information that is inaccurate, incomplete or ambiguous;
• withdraw your consent to the use of your information;
• ask for deletion of your information, or ask us to stop disseminating it or to de-index links to it where the law provides for it;
• receive your data in a portable format — you can already export your collection as a CSV file, and we can provide your other information in a structured, commonly used format on request;
• complain to a privacy authority (see “Questions and complaints” below).

Once accounts open, you will be able to edit your details and export your collection yourself from your account settings.

Use the Contact page and choose “Privacy request”, or email red@tallgrass.io. We may ask you to confirm your identity before acting, to protect your information. We answer within 30 days, free of charge. If we cannot fully grant a request, we will explain why and tell you how to challenge our decision.

Tallgrass is not directed to children under 13, and they may not create an account. In Québec, we will not collect personal information from a child under 14 without the consent of a parent or guardian. If we learn that we have collected information from a child without the required consent, we will delete it. Parents can contact us to make a request on their child’s behalf.

We rely on these legal bases under the GDPR:

• Contract — to provide your account, collection tracking, sharing and CSV features;
• Legitimate interests — to answer your messages, handle takedown requests, secure the site and prevent abuse (including the hashed IP address and hosting logs), and to establish or defend legal claims;
• Consent — where we ask for it; you can withdraw it at any time;
• Legal obligation — where the law requires us to keep or disclose information.

In addition to the rights above, you can ask us to restrict processing and you can object to processing based on legitimate interests. You can also complain to the data protection supervisory authority where you live or work.

International transfers. Canada is recognized by the European Commission as providing an adequate level of protection for commercial organizations. Transfers to the United States (our web host) rely on appropriate safeguards offered by the provider, such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

Some US states, including California, give residents specific privacy rights. Here is what they require us to tell you, based on the last 12 months:

• Categories collected: identifiers (name, email address, username, hashed IP address); internet activity (hosting logs, browser user agent); information you enter about the cards you own, including purchase prices; and account login credentials, which are used only to let you sign in.
• Sources: you, and your browser when you use the site.
• Disclosures: only to our service providers (Supabase and Vercel) for the business purposes described above.
• No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and we have not done so. We have no actual knowledge of selling or sharing information of consumers under 16. Because there is nothing to opt out of, browser signals like Global Privacy Control are effectively always honoured.

You have the right to know what we collect, to access, delete and correct it, and not to be discriminated against for using these rights. You may use an authorized agent; we may ask them for proof of authorization. If we deny your request, you can ask us to reconsider (appeal) by replying to our answer.

We use only a few strictly necessary first-party cookies and some browser storage for preferences. The full list is in our Cookie Policy.

We will update this policy when our practices change (for example if we start sending emails). The date at the top shows the latest version. For significant changes, we will give notice on the site — and by email to account holders once account emails exist — before they take effect, and ask for your consent where the law requires it.

Please contact us first through the Contact page (“Privacy request”) or at red@tallgrass.io — we will do our best to resolve your concern. You can also complain to:

• the Commission d’accès à l’information du Québec — www.cai.gouv.qc.ca;
• the Office of the Privacy Commissioner of Canada — www.priv.gc.ca;
• if you are in the EU or UK, your local data protection authority;
• if you are in the United States, your state’s attorney general or privacy agency.