The Card Vault
Privacy Policy
Effective October 19, 2026
The short version. We collect only what the game needs: your public Twitch name and ID, the cards and coins you earn, and anything you choose to send us. Your binder and leaderboard spots are public. We don't sell your information, show ads, or use tracking cookies. Email qtb.vault@gmail.com to get a copy of your data or have it deleted.
Who we are
The Card Vault is a free, fan-made trading card game run by the Twitch streamer QTB Vault ("we", "us"). This policy covers:
- the website at qtb.cards;
- the chat game played through the TCG Vault Bot account (TCG_Vault_bot) and in twitch.tv/qtbvault chat; and
- the TCG Vault Bot extension on Twitch.
We are not affiliated with Twitch, The Pokémon Company, Nintendo, Game Freak or Creatures. Twitch's own Privacy Notice covers what Twitch itself collects.
What we collect
| Information | When we get it | Why |
|---|---|---|
| Twitch user ID, username, display name and profile picture | When you use a game command or emote in chat, sign in on qtb.cards, or share your identity with the extension | To know which binder is yours and to show your name on your binder and leaderboards |
| Game data: cards, grades, favorites, Vault Coins, trades, pack battles, stats, cooldown timers, cosmetic choices, gifts received, and which channel a card was pulled in | As you play | To run the game |
| Subscriber badge, tier and months; Bits, raid and gift-sub events | From Twitch's chat data, in channels where the game runs | To unlock cosmetic perks and to thank supporters in chat |
| Chat messages | Twitch delivers messages from channels where the bot is active | To spot game commands and emotes. We read them as they arrive and don't keep a copy of chat text |
| Feedback you send, with your username if you are signed in | When you use the feedback box | To fix bugs and answer questions |
| Extension data from Twitch: the channel ID, your role (viewer, moderator or broadcaster) and an anonymous viewer ID | When the extension loads | To show the right channel's game. We only receive your real Twitch user ID if you click to share it |
| Streamer settings | When a streamer adds the game or changes its settings | To apply that channel's choices |
We never ask for your password, email address, real name, location or payment details. Signing in with Twitch only asks Twitch for your public profile.
Cookies
qtb.cards uses two cookies, both needed for sign-in: qtb_session keeps you signed in for up to 30 days, and qtb_oauth protects the sign-in step and expires after 10 minutes. We use no advertising or analytics cookies.
IP addresses
Like any website, our hosting provider sees your IP address when you visit. Our own code does not store raw IP addresses. To stop spam in the feedback box from visitors who aren't signed in, we keep a scrambled, one-way code made from the IP address that can't be turned back into the address.
What is public
The game is played in public chat, so it is public too. Anyone can see your binder at qtb.cards/u/your-username, your leaderboard positions, big pulls you make, and messages the bot posts in chat about your pulls, grades, trades and battles. Your feedback, coin history and settings are not public.
How we use information
- To run the game, keep your collection, and show your binder.
- To keep the game fair: cooldowns, spam limits and stopping abuse.
- To answer support requests and improve the game.
- To sort feedback. We send feedback text to an AI model run by our host, Cloudflare (Workers AI), which labels it as a bug, idea or question. It is not used to train AI models.
We do not sell or rent personal information, and we don't use it for advertising.
Who we share it with
Only the services that help us run the game, and only what they need:
- Twitch: sign-in, chat, and the extension.
- Cloudflare: website hosting, the game database and server code, and feedback sorting.
- GitHub: stores the website's files, including public binder pages.
- Image and data sources: card art and prices come from TCGdex, with backup art from pokemontcg.io and PokeAPI, and profile pictures are looked up through decapi.me. When your browser loads these images, those services can see your IP address, as with any image on the web.
- Google Fonts: provides the site's fonts, so Google can see your IP address when the page loads.
- PayPal: if you choose to tip, PayPal handles the payment under its own privacy policy. Tips are plain tips and never unlock game items.
We may also share information if the law requires it, or to protect players and the game from fraud or abuse.
How long we keep it
- Game data: for as long as the game runs, or until you ask us to delete it.
- Sign-in sessions: up to 30 days.
- Feedback: until it has been handled. We clear out old feedback from time to time.
- Technical records such as queued actions and records of events already processed: cleared out regularly once they are no longer needed.
Your choices and rights
- Get a copy or delete your data. Email qtb.vault@gmail.com with your Twitch username. To confirm the account is yours, we'll ask you to post a short code in chat or sign in on qtb.cards. Deleting removes your binder, coins and stats for good.
- Correct something. Your name and picture come from Twitch and update when you change them there.
- Stop playing. Just stop using game commands. The extension only sees your Twitch ID if you share it, and you can turn that off in Twitch's extension settings.
- Streamers can remove the game from their channel at any time. Viewers keep their cards.
Depending on where you live (for example the EU, the UK or California), you may have other rights, such as objecting to how we use your information or complaining to a data protection authority. Email us and we will help. We answer requests within 30 days.
Children
Twitch requires users to be at least 13. The game is not directed at children under 13, and we don't knowingly collect their information. If you believe a child under 13 is playing, email us and we will delete their data.
Security
Everything is sent over HTTPS. Sign-in sessions are signed so they can't be forged, admin tools are limited to the game's creator accounts, and keys and passwords are stored with our host, never in the website's code. No system is perfectly secure, but we work to protect your information.
Where your data is processed
We are based in the United States. Our providers may process data in the United States and other countries where they operate.
Changes
If we change this policy, we'll update the date at the top and post a note on qtb.cards for important changes.
Contact
Questions or requests: qtb.vault@gmail.com