Privacy Policy
Last updated: 14 September 2026
1. Who we are
GrailFinder is operated by GRAILFINDER PTY LTD (ACN 701 721 842, ABN 14 701 721 842), a company registered in Australia (“GrailFinder”, “we”, “us” or “our”). This policy covers everything available at grailfindertcg.com, which is two products under one account:
- GrailFinder Price Compare, which compares prices for trading card game and sports card products across stores in Australia and New Zealand; and
- GrailFinder TCG, an online trading card game played on this website.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). For people in New Zealand, we also aim to meet the Information Privacy Principles in the Privacy Act 2020 (NZ). Questions or requests can be sent to info.grailfindertcg@gmail.com.
2. What we collect
You can search and compare prices without an account. We only collect what is needed for the features you use.
When you visit. Our servers and hosting provider record standard technical information, such as your IP address, browser and device type, the pages you request and when. We use it to run and secure the site, including limiting abusive traffic, and to fix errors.
When you create an account. Your email address, a securely hashed password (we never see the password itself), an optional display name, and whether you have agreed to product update emails.
Price Compare. The watchlist, saved searches and price or restock alerts you choose to save, and a separate alert email address if you set one.
Subscription. Your subscription status, plan and renewal date, and the Stripe customer reference needed to manage it (see Payment information below).
3. GrailFinder TCG
When you play GrailFinder TCG while signed in, we store the game data that makes up your account:
- your chosen Faction, account level and experience;
- your card collection, including card condition, printing and any limited print serial numbers you own;
- the Catalogs (decks) you build;
- your in-game currency balances (Scrip and Echoes) and a record of how they were earned or spent, such as pack openings, crafting and rewards;
- quest and achievement progress, and tutorial completion;
- match statistics, such as matches played and won, Heroes used and totals used by quests; and
- for PvP, your ranked rating, win and loss record for each season, and the rank you are awarded when a season ends.
What other players can see. In a PvP match your opponent sees your Hero and the cards you play. Ranked ratings, records and season ranks may be shown to other signed-in players, for example on leaderboards. Owners of limited print cards may be shown alongside their serial numbers. We do not show your email address to other players.
Game actions during a match are processed by our game server in memory. We keep the counters and results described above, not a move-by-move record of your matches.
4. How we use information
- to provide Price Compare and GrailFinder TCG, and the account features you turn on;
- to send the emails you have asked for, such as sign-up confirmation, password resets and alerts;
- to run matchmaking, record match results, award rewards and maintain ranked ratings;
- to process your subscription and the in-game benefits it includes;
- to keep the service secure and fair, including detecting cheating, abuse and misuse; and
- to understand how the service is used so we can improve it.
We do not sell your personal information, and we do not share it with anyone for their own advertising.
6. Service providers
We use a small number of providers who process information on our behalf so the service works:
- Supabase, for accounts, sign-in and our database, including TCG game data;
- DigitalOcean, which hosts our website, game server and price data;
- Resend, which sends our emails;
- Stripe, which processes subscription payments; and
- Google (YouTube), for review videos shown on product pages.
When you click through to a store, eBay or 130point, you leave GrailFinder and that site's own privacy policy applies. We may also disclose information where the law requires it, or to protect our rights, our users or the public.
7. Overseas disclosure
Our main database and servers are located in Australia. Some of our providers, such as Resend, Stripe and Google, may store or process information in other countries, including the United States and Japan. We choose providers that protect information to a standard comparable to the Australian Privacy Principles.
8. YouTube content
Product pages may display review videos sourced through the YouTube Data API Service. By using this feature you also agree to the YouTube Terms of Service, and Google's handling of related data is described in the Google Privacy Policy. We do not ask you to sign in with Google and we do not access your YouTube account.
9. Payment information
Subscription payments are processed by Stripe. We never receive or store your full card number. Stripe tells us only what we need to run your subscription: that a payment succeeded, your subscription status, and billing references such as your renewal date. In-game packs are bought with in-game currency, not with money.
10. Email
Account and service email, such as sign-up confirmation, password resets, receipts and the alerts you have set up, is part of the features you use. You stop alert emails by turning off or deleting the alert.
Promotional email, such as product updates and offers for Price Compare or GrailFinder TCG, is opt-in only. We only send it if you tick “Send me occasional product updates and offers” on your account page, and you can untick it at any time.
11. Keeping & deleting data
We keep your account data for as long as your account exists. You can delete your account yourself at any time from the “Danger zone” section of your account page. This permanently removes your profile, watchlist, alerts and saved searches, and your TCG data: collection, Catalogs, currency balances, quest progress, match statistics and ranked ratings.
Two things are kept in a form that no longer identifies you. Limited print serial numbers stay in our records so that a serial is never issued twice. Anonymous totals, such as how many matches each Faction has won, are not linked to any account. We may also keep records we are required to keep by law, such as payment records.
12. Security
We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, including encrypted connections, access controls on our database, and restricting server access. No online service can guarantee perfect security. If a data breach is likely to cause you serious harm, we will notify you and the regulator as the law requires.
13. Children and young people
You must be at least 13 years old to create an account. If you are under 18, you should have a parent or guardian's permission to use GrailFinder, and a parent or guardian must manage any paid subscription. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, contact us and we will delete it.
14. Access, correction & complaints
You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing info.grailfindertcg@gmail.com. We will respond within 30 days. We may need to confirm your identity first, and we may keep information where the law requires us to.
If you have a concern about how we have handled your information, please contact us first so we can try to fix it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, or in New Zealand, the Office of the Privacy Commissioner.
15. Changes to this policy
We will update this policy as GrailFinder changes, and change the “Last updated” date above when we do. If a change significantly affects how we handle your information, we will make it clear on the site or tell you by email.
See also our Terms of Use and Subscription Terms.