Privacy Policy
Effective August 8, 2026. This explains what The VBC Market collects, why, who can see it, and how long it is kept. Timothy Bryan Reichard is responsible for it.
The short version: the Site collects what it needs to show you cards, tell you when one you want is for sale, and let another member contact you about a card. There is no advertising network, no analytics, and no tracking of any kind.
What is collected
When you sign in with Facebook
Facebook tells us three things: your Facebook ID, your name, and your email address (we ask for the public_profile and email permissions and nothing else). We do not receive your password, your friends, your posts, or anything else on your account.
We store your Facebook ID as your account identifier, and your name so other members can see who they are dealing with. You may add a display handle and a link to your Facebook profile so buyers can reach you.
What you tell the Site
- the cards you need, and in what grade and from which grading company;
- the cards you have listed, their condition, price, and anything you write
about the copy;
- which listings you have hidden from your own view;
- which listings you have registered interest in;
- ratings you leave for other members, and sales you confirm;
- your email address and whether you want match and interest notifications.
Collected automatically
- A session cookie (
nvbc_session) so you stay signed in. It is
HttpOnly, SameSite=Lax, sent over HTTPS in production, and lasts 30 days. A second short-lived cookie exists for a few seconds during Facebook sign-in to prevent a forged login. These are the only cookies. There are no analytics or advertising cookies.
- Your IP address, in the rate-limit ledger only, and only to stop the Site
being hammered by a visitor who is not signed in. Those rows are deleted after 60 minutes and are not used for anything else.
- A record of notification emails sent to you — the address, the card, and
when — so the Site does not email you about the same thing twice.
What other members can see
- Always: your display handle or name, and your listings.
- When you register interest in someone's listing: they are told, and shown
your handle and Facebook profile link so they can reply.
- Aggregate only: how many copies of a card are wanted. It is a count of
copies, never a list of who wants them.
- Your want list is not public. Nobody can see what you are looking for.
- Your email address is never shown to another member. It is used only to
send you notifications.
Why
To operate the Site: to sign you in, show your lists, match listings to your wants, notify you, let members contact each other about a specific card, keep the price guide, and enforce the rules. We do not sell your data, and we do not share it for anyone else's advertising.
Who else sees it
- Facebook (Meta) — because you sign in through them. Their terms apply.
- Our email provider — receives your address and the message when a
notification is sent.
- Our hosting provider — stores the database on our behalf.
- eBay — only if you click a "Sponsored" link, which passes an affiliate
code identifying this site and the card you were looking at. eBay's privacy policy governs what happens then.
- PayPal — only if you choose to donate.
Nobody else. We do not use advertising networks, analytics, or third-party tracking.
How long it is kept
| what | kept |
|---|---|
| account, needs, listings, ratings | until you ask us to remove them |
| sign-in sessions | 30 days, then deleted automatically |
| rate-limit rows (including IPs) | 60 minutes, then deleted automatically |
| notification log | while the account exists |
| confirmed sale prices in the price guide | indefinitely, without your name |
Removal is by flagging, not deletion. When you clear a need or delete a listing, the row is marked hidden so an accident can be undone — it stops being visible to anyone, including you, but it still exists in the database. Say so when you ask for erasure, because it changes what "delete" means here.
Your choices
- Notifications: switch match and interest emails off in your profile at any
time. The Site keeps working; you just read the news on the Activity page instead.
- Your email: change or remove it in your profile.
- Your listings and needs: remove them yourself at any time.
- Your account: see below.
<a id="account-deletion"></a>
Deleting your account
Use Delete my account in the account menu, or email tim@thevbcmarket.com from the address on your account. Doing it yourself takes effect immediately; a request by email is actioned within 30 days.
What is removed: your name, display handle, email address and Facebook profile link. Your needs and listings stop being visible to anyone, and your sign-in sessions are deleted.
What stays, and why. We do not erase the rows outright, and the reasons are about other people rather than about us:
- **Confirmed sale prices stay in the price guide, without anything identifying
you.** Other members value their cards against that history.
- Ratings you exchanged stay, attached to a closed account. A rating is the
other member's record as much as yours.
- A moderation decision about the account is kept. One that could be erased
by the member it concerns would not be a moderation decision.
So this is best described as anonymising rather than erasing: what identifies you is gone, and what other members' records depend on remains without your name on it.
If you sign in with Facebook again afterwards, a new, live account is created and you start over. Nothing from the closed one comes back.
You may also remove this app in your Facebook settings, which stops us receiving anything further from Facebook.
If you are in the EU or UK you also have rights of access, correction, erasure, restriction, portability and objection, and may complain to your data protection authority. Write to tim@thevbcmarket.com and we will respond.
Children
The Site is not for anyone under 18 and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
Security
Passwords are never handled by the Site — sign-in goes through Facebook. Session cookies are HttpOnly so page scripts cannot read them. Traffic is over HTTPS. No system is perfectly secure, and this one is run by a hobbyist for a hobby group; please do not store anything here you would be hurt to lose.
Changes
We will post any change here and update the date at the top.
Contact
tim@thevbcmarket.com