CCG Index

Privacy Policy

Last updated: 2026-04-27

Summary

CCG Index does not require an account, does not ask for your email or any other personal information, and stores no profile about you on our servers. We do use Google Analytics 4 to understand which pages and features are used. Analytics is opt-in via the consent banner shown on your first visit and can be reviewed or revoked at any time below.

Analytics & cookies

On the public site (ccgindex.com) we run Google Analytics 4 (measurement ID G-0DVY2VBYDZ). Analytics is loaded with Google Consent Mode v2 defaulted to denied. Until you accept the consent banner, no analytics cookies are written to your browser — Google receives only an anonymous, cookieless ping for traffic modeling.

If you accept analytics, the following cookies are written to your browser by gtag:

  • _ga — random client identifier (2 years, GA4)
  • _ga_0DVY2VBYDZ — session state (2 years, GA4)

We do not load Google Ads, advertising-storage cookies, Meta Pixel, TikTok Pixel, X (Twitter) Pixel, or any other advertising tracker. Consent Mode flagsad_storage, ad_user_data, and ad_personalization are hard-coded to denied regardless of your analytics choice.

The events we send to GA4 are limited to:

  • page_view — URL, page title, referrer
  • search_submit, search_select, search_results_view — what you searched for and which result you opened
  • search_did_you_mean_click, search_did_you_mean_dismiss — interactions with the typo-suggestion banner
  • affiliate_click, buying_link_click — outbound clicks to TCGPlayer, eBay, Amazon, Manapool
  • watchlist_add, watchlist_remove — entries added to / removed from your local watchlist
  • sub_tab_switch — sub-navigation tab clicks

Google Analytics 4 retains hit-level data for 14 months (the shortest retention Google offers; we have not extended it). Google's own data-handling terms apply to anything they receive — see Google's privacy policy.

Browser-local state

A few features store state in your browser's localStorage. None of it is transmitted to our servers; clearing your browser data removes all of it.

  • ccgindex.watchlist.v1 — list of product IDs you've starred
  • ccgindex.favorite_indices.v1 — list of index categories you've starred
  • ccgindex.consent.v1 — your analytics-consent choice
  • tcg:sidebar-collapsed — sidebar expand/collapse preference
  • Short-lived in-memory caches for the search dropdown (cleared on full reload)

Server logs

Our backend records standard web-server access logs (IP address, user-agent, request timestamp, URL) for operational monitoring, rate-limiting, and security. These logs are not used to build profiles of individual visitors. They live on the host disk for as long as needed to investigate issues and are not exported, backed up off-host, or shared with third parties.

Third-party services

When you click an outbound buy link, your click is passed through the marketplace's affiliate-tracking URL (eBay Partner Network Smart Link, Amazon Associates tag, TCGPlayer / Impact partner, Manapool ref). These redirects are operated by the respective affiliate networks and subject to their own privacy policies. Affiliate links are marked with rel="sponsored".

The site sits behind Cloudflare for DNS, caching, and DDoS protection. Cloudflare may set security-related cookies and log request metadata. See Cloudflare's privacy policy.

Data we display

Price data is aggregated from publicly available sources (TCGPlayer's public catalog, TCGCSV's public mirror, Scryfall's bulk data, eBay's Browse API, Manapool's public price feed). None of it is personal information. We do not buy, sell, or share personal data of any kind.

Your rights

EU / UK (GDPR, UK GDPR, Swiss FADP): the only personal data we process is the analytics data above, and only with your consent (lawful basis: Art. 6(1)(a) GDPR). You can withdraw consent at any time using the button below. Browser cookies set by gtag will continue to exist until they expire or you clear your browser data.

California (CCPA / CPRA): we do not sell or share personal information for cross-context behavioral advertising. The dedicated Do Not Sell or Share My Personal Information page has a one-click opt-out, and we automatically honor the browser-level Global Privacy Control signal.

To request access, deletion, or any other GDPR/CCPA right regarding the limited analytics data we process, contact us through the channel listed on the About page. Because we don't store an account or profile, most data-subject requests boil down to declining analytics — which you can do unilaterally below.

Manage your consent

Current analytics choice: not chosen yet

Changes

If this policy materially changes, the "last updated" date at the top of this page will change. Substantive changes (new third-party processors, new categories of data) will trigger a fresh consent prompt.

Contact

Questions about privacy can be directed through the contact channels listed on the About page.