Privacy policy

Tapt (tapt.ca) is a price comparator for Magic: The Gathering cards, aimed at Quebec stores and run independently by Sébastien (the "operator"). Tapt's person in charge of the protection of personal information can be reached at [email protected] for any question or request about your personal information.

Searching for a card, comparing prices between stores, comparing a deck and browsing sets are available without creating an account. The account, which is free, remains optional: it only gives access to the features that keep information from one visit to the next, namely Price tracking, Support tickets, favourite stores and the shopping list.

Collection happens in two ways, and never in a hidden way:

• Directly, when you provide it: when you sign in (by a link sent to your email address, or with Google if you choose that option), when you set your preferences, or when you open a support ticket.
• Automatically, by technical means: a sign-in cookie if you sign in, your IP address for the duration of a request (see below), and internal usage measurement (pages viewed, cards searched, additions to the shopping list, clicks to a store) used to understand how Tapt is used and to improve it, whether or not you have an account. This internal measurement stays entirely on our servers and is never shared with a third party. Separately, and only if you accept it in the banner, Tapt loads a third-party tool: Google Analytics (traffic statistics). The newsletter sends your address to Klaviyo only when you subscribe (see sections 4 and 6).

Tapt collects only what is needed to run and improve the service. No information is collected for advertising or shared with third parties for a fee.

• At sign-in: your email address, and a single-use sign-in link sent to you (valid for 15 minutes, never stored in clear text; only a technical fingerprint is kept, for as long as the link is valid). If you choose "Continue with Google", your name and profile picture are also sent, directly by Google. Tapt neither asks for nor stores any password: that mechanism simply does not exist.
• First name, last name and username: requested once at sign-up (you can change them later from your profile). The first and last name stay private, visible only to you on your profile page. The username is shown publicly when you comment on a deck or publish one, never your email, first name or last name.
• Your preferences: favourite stores, configured thresholds and shipping costs, contents of your shopping list. Used to restore your settings from one visit to the next. Requires an account.
• Support tickets: subject, category, description, and an attachment if you add one. Used only to reply to you. Requires an account.
• Newsletter, only if you subscribe: your email address, the date of your request and the place on the site where you made it (sign-up checkbox, footer field, question asked once at sign-in, or profile). The last two items serve as proof of your consent, as the Canadian Anti-Spam Legislation requires. Subscription is never assumed: the checkbox is unchecked by default, and an email asks you to confirm before anything is sent. Every newsletter contains an unsubscribe link, and the switch in your profile lets you unsubscribe at any time. If you decline, only that refusal is recorded, so that the question is not asked again.
• Sign-in cookie: purely technical, present only if you are signed in. Used to keep you signed in from one page to the next.
• Sign-in log: IP address and time of each sign-in (or sign-in attempt), kept for 30 days and then deleted automatically. Used only to spot abusive use (for example repeated attempts to guess sign-in links). Never used for profiling.
• IP address (outside sign-in): used in a strictly technical and temporary way to spot and block abusive automated use (for example a bot repeating a search hundreds of times), whether or not you are signed in. Never used for profiling or personal identification, and never kept longer than this protection requires.
• Approximate city and country: derived from your IP address at each visit, using a database consulted directly on our servers (GeoLite2, MaxMind). Your IP address is never sent to MaxMind or to anyone else, and is not itself kept for this purpose: only the result (city, country) is. Used only for internal statistics (where visits come from), never to follow an individual from one visit to the next. This data is part of audience measurement: it is recorded only if you have accepted it.
• Bot detection: each visit is compared with a list of known robots (search engines, automated tools) using the information your browser normally sends. Used to keep our statistics accurate, never for profiling.
• Anonymous visitor number: if you accept audience measurement, a random number is assigned so that your actions can be linked together (for example, a search and a click from the same person) and to count the distinct people using Tapt. It contains neither your name, nor your email, nor your IP address, and is used for no other purpose. It is kept for a maximum of 13 months, after which you become an unknown visitor again. If you decline, no number is assigned. If you withdraw later, it is erased immediately.
• Internal audience measurement: pages viewed, cards searched, additions to the shopping list and clicks to a store (with the Tapt page the click came from, for example the Comparator or a deck). Linked to your identity only if you have given consent (see the next section). Otherwise the visit is still counted in a total, but without your email or your city: nothing then allows anyone to trace it back to you. Used only for internal statistics, for example to know which cards are searched most. No advertising, no resale, no third-party trackers in this internal measurement.
• Consent cookie: a small cookie that contains only your answer to the banner (accepted or declined), kept for about 6 months. It is this cookie, and only this cookie, that tells our servers what may be recorded. It contains no identifier and does not allow you to be recognized.
• Third-party tool, only if you accept it: Google Analytics (traffic statistics: page views, approximate origin, device type, with a shortened IP address). It loads a script from Google's servers and may set its own cookies, which receive technical data about your visit (IP address, device, pages viewed). Its use is a choice separate from internal measurement, remembered by an answer cookie (tapt_tiers, 0 or 1, about 6 months). Without your agreement, this script is not loaded and no data is sent to Google.
• A deck made public, by your choice: as long as the "Public deck" box is not checked, a deck is visible only to you. If it is made public, it appears on the Community page and becomes visible to anyone, including search engines, with your username, the publication date, the number of views and the comments received. Neither your email nor your first or last name ever appears there: only the username, provided for this purpose, is shown. Switching back to private removes the deck from the Community page.
• Kept in your browser only: the state of a deck analysis in progress, and the fact that you have already answered the banner, are kept locally (localStorage) and are never sent to our servers.

From your first visit, a banner asks whether you consent to internal audience measurement and to the third-party tool (Google Analytics), two choices that the banner's preferences let you separate. Three points that cannot be taken for granted elsewhere on the web:

• As long as consent has not been given, it is treated as a refusal. Nothing is linked to your identity while the banner is displayed. Closing the page without answering commits you to nothing.
• Declining is as easy as accepting: a single click, in the same place, on a button of identical size. Declining does not restrict access to any feature of the site.
• This choice can be changed at any time. If you have an account, the switch is in your profile, in the "Privacy" section, and your choice follows you across all your devices. With or without an account, the "Cookies" link at the bottom of every page reopens the banner and its preferences.

The sign-in cookie cannot be declined: without it, it is technically impossible to keep you signed in. It exists only if you sign in, and serves only that purpose.

Tapt does not sell or share your personal information for commercial purposes. Some technical providers have access to it, only as far as needed to run the service:

• Google (only if you choose that sign-in option). Authentication by a magic link sent by email is handled entirely on our own servers, with no intermediary.
• Railway (hosting of the application).
• Klaviyo (sending the newsletter, only if you subscribe). Your email address and subscription status are sent to it by our servers when you click "Subscribe" in the footer, check the sign-up box or change your profile, and only at that moment: that action is your consent. No Klaviyo script or cookie is loaded on Tapt's pages, whether or not you accepted the banner.
• Google Analytics (traffic statistics, only if you accept third-party tools). Google receives technical data about your visit (shortened IP address, device, pages viewed) and may set its cookies. Without your agreement, no Google Analytics script is loaded. You can withdraw your agreement at any time (banner, or profile if you have an account): the page then reloads without these tools.
• Scryfall (public database of Magic cards): no personal information is sent to them, only the name of the card searched.

Stores have access to none of your information: a click to a store from Tapt is a simple external link, like any other link on the web.

Google (sign-in or, if you accept it, Google Analytics), Railway and Klaviyo (newsletter) are international providers whose servers may be located outside Quebec, notably in the United States. Your information may therefore be processed outside the province by these providers, only as far as needed to run the service, and covered by their own security commitments.

Your preferences and shopping list are kept as long as your account exists. A newsletter subscription is kept as long as you remain subscribed. After an unsubscribe, only the record of the unsubscribe is kept, so that no sending resumes by mistake. You can ask for the complete deletion of your information at any time, by email. The request is handled no later than 30 days after it is received, by permanent deletion of the files concerned. The "Close my account" button on the Profile page does the same thing immediately: your public comments lose their text and your name, and your email address is removed from audience measurement. The site's backup copies, used only to repair it after an outage, erase themselves: at the latest 30 days later for the daily copies, 89 days for the monthly copy.

In accordance with the Act respecting the protection of personal information in the private sector (Law 25, Quebec), you have the right to access your personal information, to ask for it to be corrected, or to ask for it to be deleted. To exercise these rights, write to [email protected], or by mail to Tapt, 2278 avenue Georges, Shawinigan, Quebec G9N 2N7, Canada. A reply is sent to you directly, with no form required, no later than 30 days after your request is received. If Tapt refuses your request, or does not answer within that time, you can submit an application for the examination of a disagreement to the Commission d'accès à l'information du Québec.

Exchanges with Tapt are encrypted (HTTPS). Sign-in uses a single-use link sent by email, valid for 15 minutes: no password exists, so there is nothing of the kind to protect or to leak. The sign-in token itself is never stored in clear text in our databases; only a technical fingerprint is kept, for as long as it is valid.

This policy may be updated from time to time. The date at the top of the page is the date of the latest revision. Any significant change will be reported to you directly if you have an active account.