Privacy

Effective 24 October 2026. WinnTCG is operated by Crazy Space Labs LLC, a Delaware limited liability company doing business as WinnTCG. This describes what we collect, why, and who else sees it. It is written from the system rather than from a template, so it is specific.

What we collect

One contact. An email address or a mobile number, whichever you sign in with. There is no password, so that contact is your credential. We keep the account it belongs to and nothing else about you: no name, no date of birth, no marketing profile.

The photographs we take of your card. Two per card, plus the set and number we record from it. You send us the card and we photograph it here, so none of this comes off your phone.

A session cookie after you sign in. It is essential, it holds a hashed token and nothing readable. Signing in sets two more for a few minutes while it happens — one holding the code you were sent, one remembering the page to put you back on — and both go as soon as you are in.

One more, if you arrive through a partner’s link. A page at winngrading.com/@their-code (or the same address on winntcg.com) leaves a cookie holding that code and nothing else, for 90 days, so that if you join the Slab of the Month Club we know who to pay. Everyone who visits the same partner’s page gets the same cookie, so it cannot tell you apart from them and is not used to. If you never join, nothing is ever read from it.

Your IP address, at one moment only: when you tick the box to accept the submission agreement for a mail-in order. We record it beside the version of the agreement you accepted, a fingerprint of its exact wording, and the time — so that what you agreed to, and that it was you who agreed, can be established later. It is not used to track you, it is not recorded on any other page, and if you never send us a card we never take it.

A mailing address, once you order something that has to be shipped. The name, address and optional telephone number you type at checkout. It is used to price the shipping, buy the label, and send the parcel. An address is written once and never edited: changing it writes a new one, so a label already bought still says where it was actually sent.

What is published, and what stays private

This is the part worth reading twice, because it is unusual.

A cropped copy of each photograph is published permanently on your certificate page, where anyone with the certificate number can see it. That is the product: the grade is only checkable because the photographs of the card are public.

Our original photographs are never published. They are kept as the record of what was graded, and they are visible only to WinnTCG.

Your email address and phone number are never published and never appear on a certificate.

Who else sees your data

We use these companies to run the service. They see only what their job requires.

• Anthropic receives the photographs of your card. An AI takes the first pass at the four sub-grades, and a person confirms or overrides every card.
• Cloudflare hosts this site, stores the published certificates and photographs, holds the sign-in database, and runs the bot check on the sign-in form.
• DigitalOcean hosts the grading database, which holds your card records.
• Stripe takes the payment. It sees your email address, what you bought, and — where sales tax has to be worked out — the address it is going to. WinnTCG never sees your card number.
• EasyPost prices and buys the shipping label. It sees the name and address the parcel is going to, and passes them to the carrier, which has to have them to deliver it.
• Smarty checks addresses as you type one, so a parcel does not go missing over a mistyped street. It sees what you type into that box.
• Postmark delivers sign-in emails. It sees your email address.
• Twilio delivers sign-in codes by SMS. It sees your mobile number.
• Cloudflare serves this site, and counts visits to it. See below.

Your data does not leave us

We do not transfer your data to any outside organisation, under any circumstances, and not even with your consent, except where that is strictly required to provide the service you asked for (the companies listed above, each for its own job) or to comply with applicable law. That includes your mobile number and anything else collected when you sign up for text messages. It is never sold, rented or shared for anyone else’s marketing.

What stops it being shared without authorisation:

• Access is limited to authorised WinnTCG personnel. The grading bench and the databases sit behind sign-in, and nobody outside WinnTCG has an account on them.
• Service providers are bound by contract. Each company above works under its own data-processing terms, which limit it to using your data to provide its service to us and forbid it from using that data for its own purposes.
• Procedures, not good intentions. Credentials are kept in a password manager rather than shared by hand; data moves only over encrypted connections; and nothing is exported from our systems to anyone not on the list above.

Text messages

The only texts we send are the one-time codes you ask for when you sign in with a mobile number. You can opt out of SMS messages at any time by replying STOP or UNSUBSCRIBE to any message. We will confirm, and then send no more. Reply HELP for help. The full terms are in the terms of service.

Questions about our messages or your data

If you have questions about our messages or your data, contact us at hello@winntcg.com, or by mail at WinnTCG, PO Box 337, Fate, TX 75132.

The mailing list

If you tick the box when you sign in, we add your email address to a mailing list so we can tell you what we are up to. You will get an email asking you to confirm it first, and if you ignore that email you are not on the list — ticking the box asks the question, and answering that email is what joins you.

That list runs on our own server, not a mailing company’s. It is Listmonk, on a machine we own, so your address is not handed to a marketing platform in order to be mailed. Every message it sends carries an unsubscribe link, which works immediately and needs no account and no reply.

If you did not tick the box, nothing is sent to that list at all. It is not used for anything to do with your order — receipts, tracking and your grade are sent whether you are on it or not, because those are things you asked us for.

We do not sell your data and we do not share it for advertising.

How we count visits

Cloudflare Web Analytics counts page views on this site. It is cookieless: it stores nothing on your device, sets no identifier, and there is nothing in it that can follow you to another website or recognise you when you come back. What it records is the page, where the link came from, roughly how fast the page loaded, and your country, browser and screen size. Not your name, not your address, and nothing tied to your account or your cards.

It is on every page here, including this one and including certificate pages. Looking up a certificate is counted the same way as reading the pricing page. If you would rather not be counted at all, any content blocker stops it, and nothing on this site breaks when it is blocked.

The site itself is still built to reach nowhere: it has no scripts of our own, no fonts or images from anyone else’s server, and the build fails if a page ever loads one. Cloudflare adds its counter to the page as it serves it, which is why it is the one thing here we do not build ourselves.

We count one more thing ourselves: visits to a partner’s page. A partner or advocate has a page at winngrading.com/@their-code, and we keep a running total of how many times each of those pages was loaded each day, so we can show them whether sharing their link did anything.

It is a tally and nothing else. We store the code, the date, the number of loads, and which broad kind of place the link was clicked from — a search engine, a social site, or no referrer at all. We do not store your IP address, a cookie, an identifier, your browser, or the address of the page you came from. There is nothing in it that is about you, which is also why it can only tell a partner how many times the page was opened and never how many people opened it.

How long we keep it

Sign-in codes and links expire in minutes. Sessions expire and are deleted daily.

The agreement record stays with the order. The version, the wording fingerprint, the time and the IP address are kept for as long as the order is — they are the record of a contract, and a record of a contract that is deleted while the contract still matters is not a record.

A published certificate is permanent, and that is deliberate. Its number is sealed inside a plastic case that outlives every server we own, so the page has to keep answering for as long as the slab exists. We cannot delete a published certificate or its photographs without breaking a slab someone owns, possibly one they have since sold.

What you can ask for

Email hello@winntcg.com and we will tell you what we hold about you, correct it, or close your account and delete your contact details and your original photographs.

The one thing we cannot undo is a published certificate, for the reason above. If one has to come down we withdraw it, and the page then says plainly that the slab is no longer certified. That is as close to deletion as anything sealed inside someone else's plastic can get: a page that simply vanished would leave the slab in circulation with nothing to check it against.

Children

This service is not for under-13s, and we do not knowingly collect their data. If you believe we have, email us and we will delete it.

Changes

If this changes materially, the effective date above changes with it. We will not quietly broaden what we do with photographs already published under an older version of this page.

Contact

hello@winntcg.com
WinnTCG PO Box 337 Fate, TX 75132