Privacy & Terms

Privacy Policy Terms of Service

Effective April 19, 2026

We collect your email (for auth and recovery only), username, display name, birth year (for age verification only — never displayed publicly), profile photos, card collection data, and messages you send. Passwords are stored only as cryptographic hashes — never in plaintext. Session tokens are stored in sessionStorage only and cleared when you close the browser.

Payment handles (Venmo, Cash App, PayPal) are stored privately and never shown publicly. The only way your handle reaches another user is when you explicitly tap 💳 in a private chat and confirm the share prompt. We are not a payment processor and have no involvement in transactions between users.

To operate the service: authentication, profile display, enabling trades and messaging. We do not sell your data, use it for advertising, or use it to train AI models.

We use Supabase (database/auth/storage, AWS-hosted, AES-256 encrypted at rest), Netlify (hosting only), and Google Tenor (GIF search — your search queries are sent to Tenor). We do not sell data to any third party. We may disclose data if required by applicable law or valid legal process.

All data in transit uses TLS encryption. Database encrypted at rest (AES-256). Row-Level Security (RLS) enforces per-user data access. PIN login uses SHA-256 hashing with email salt, stored only on your device, and locks after 5 wrong attempts. Password login locks after 5 failed attempts for 10 minutes.

You have the right to access, correct, export, or delete your personal data at any time. GDPR requests are responded to within 30 days. CCPA requests within 45 days. To request data access, correction, or deletion, contact us at [contact email coming soon]. You may also delete your account directly from the app — your profile and content will be hidden immediately and all data permanently deleted within 30 days. TINCASE does not sell personal information. California residents have the right to know what data is collected and to opt out of sale (we do not sell data). We do not discriminate against users who exercise privacy rights.

Active account data is retained while your account is active. On soft-deletion, public content is hidden immediately and all data is permanently purged within 30 days. Message logs may be retained up to 90 days for abuse/safety review before deletion. Backup systems may retain data up to an additional 30 days after purge request.

TINCASE requires users to be at least 13 years old (or older where local law requires). We collect your birth year at registration and use it to verify minimum age eligibility before account creation is permitted. This check occurs both in the app and is enforced at the database level — accounts that fail age verification cannot be created. We do not knowingly collect personal information from children under 13 (or under 16 where EU/EEA law applies). If you are between 13 and 15 years old and located in the EU/EEA, you may be required to provide verifiable parental consent before using TINCASE, depending on your country of residence. If we discover an account belongs to a user below the applicable minimum age, we will immediately suspend the account, delete all associated personal data, and notify the account email. Age of consent by region: United States: 13+ (COPPA); EU/EEA: 13–16 depending on member state (GDPR Art. 8); United Kingdom: 13+ (UK GDPR); Canada: 13+ (PIPEDA); South Korea: 14+ (PIPA/COPA); Brazil: 12+ with parental consent (LGPD); Australia: 15+ recommended (Privacy Act); Japan: 13+ with parental consent (Act on Protection of Personal Information). Parents or guardians who believe their child has an account in violation of these requirements may contact us at [contact email coming soon] to request immediate deletion.

In the event of a data breach affecting your personal information, we will notify affected users via the email address on their account within 72 hours of discovery where required by applicable law (including GDPR Article 33). We will also notify relevant supervisory authorities as required.

TINCASE is operated from the United States. Data is stored on AWS infrastructure (Supabase) which may be located in the US or other regions. By using TINCASE, you consent to the transfer of your data to the US and other countries whose data protection laws may differ from your own. Where required by applicable law (including GDPR Chapter V), we rely on your explicit consent as the lawful basis for international data transfers. EU/EEA users should be aware that the US does not currently hold an EU adequacy decision, though Supabase (AWS) maintains standard contractual clauses and applicable certifications. Users in South Korea, Brazil, Japan, Australia, and Canada: your data is subject to US law and the laws of the region where Supabase infrastructure is located. You retain the rights described in the Your Rights section regardless of your country of residence, subject to applicable local law.

[contact email coming soon]

Effective April 19, 2026

TINCASE is currently in Beta. The service is provided for testing and early-access purposes only. Features, pricing, availability, and data structures may be added, changed, or removed at any time without notice. Data loss may occur during the Beta period. TINCASE makes no guarantees of data preservation, uptime, feature continuity, or fitness for any purpose during Beta. TINCASE and its sole developer/owner expressly disclaim all liability for any loss, inconvenience, financial harm, or other damage arising from the Beta nature of the service, including but not limited to: loss of card collection data, trade history, messages, account access, or any content you upload. Use of TINCASE during the Beta period is entirely at your own risk. The transition from Beta to a paid or monetized service will be communicated via in-app notice and/or email. Continued use after such transition constitutes acceptance of any updated pricing or Terms.

TINCASE is an independent fan-made platform operated by a sole developer/owner ("TINCASE," "we," "us"). TINCASE is not affiliated with, endorsed by, sponsored by, or connected to any K-pop label, agency, entertainment company, or artist.

You must meet the minimum age requirement applicable in your country or region to use TINCASE. In most jurisdictions this is 13 years old; in others it is higher (see the Minors & COPPA section of our Privacy Policy for a full breakdown by region). By registering, you represent and warrant that you meet the applicable minimum age in your jurisdiction. Age is verified using the birth year you provide at registration, which is checked both in the app and enforced at the database level. Providing a false birth year to circumvent the age gate is a material breach of these Terms and will result in immediate account termination. Users aged 13–17 represent that they have obtained the consent of a parent or legal guardian to use the service. If TINCASE discovers a user is below the applicable minimum age, we will immediately suspend and permanently delete the account and all associated data without notice. Parents or guardians who wish to report an underage account may contact us at [contact email coming soon]. TINCASE bears no liability for false age disclosures made by users or their parents.

You are responsible for maintaining the confidentiality of your credentials and for all activity that occurs under your account. You may not create more than one account or allow others to use your account. Report suspected compromise immediately to [contact email coming soon]. Automated access, bots, and scraping are prohibited.

You agree not to: harass, bully, threaten, or stalk other users; post hateful, discriminatory, obscene, or illegal content; impersonate any person or entity; list cards you do not own; misrepresent card condition, authenticity, or value; upload malware or malicious code; spam or mass-message other users; attempt to gain unauthorized access to any account or system feature; or use TINCASE for any commercial or promotional purpose without our consent.

TINCASE is a coordination platform only. We do not process payments, hold funds, provide escrow, offer buyer or seller protection, mediate disputes, or act as a party to any transaction. All trades and sales are entirely between individual users. TINCASE bears zero responsibility or liability for lost or damaged packages, non-delivery, payment fraud, scams, disputes over card condition or authenticity, or any other outcome of peer-to-peer transactions. Trade and sell at your own risk. Payment handles (Venmo, Cash App, PayPal) are stored privately and only transmitted when you explicitly initiate sharing via the 💳 button and confirm the prompt. TINCASE is not responsible for how payment information is used once shared between users.

The TINCASE name, logo, visual design, and application code are proprietary and protected intellectual property of TINCASE. You may not reproduce, copy, distribute, or create derivative works of any part of TINCASE without express written permission. Photocard images uploaded by users are the intellectual property of their respective K-pop labels and agencies. By uploading images you represent you own the physical card and are using the image solely to catalog your personal collection for non-commercial purposes.

You retain ownership of content you create and upload. By posting content, you grant TINCASE a non-exclusive, royalty-free, worldwide license to store, display, and transmit your content solely as necessary to operate the service. This license terminates when you delete your content or account.

TINCASE is provided "as is" and "as available" without any warranty of any kind, express or implied. We make no guarantees of uptime, data preservation, fitness for a particular purpose, or freedom from errors or bugs. We are not responsible for any data loss, including loss of card collection data, trade history, or messages.

To the maximum extent permitted by applicable law, TINCASE and its sole developer/owner shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of data, loss of funds, or user conduct. Our total aggregate liability for any claim arising from use of TINCASE shall not exceed USD $0 (the service is free). You agree to indemnify, defend, and hold harmless TINCASE and its developer/owner from and against any claims, damages, losses, or expenses (including legal fees) arising from your use of the service, your violation of these Terms, or your interactions with other users.

We reserve the right to suspend or permanently terminate any account at any time, for any reason, with or without notice, including for violation of these Terms. You may delete your own account at any time via the app. Termination does not affect any accrued obligations or provisions that by their nature should survive.

These Terms are governed exclusively by the laws of Washington State, USA, without regard to conflict of law principles. Any dispute arising from or relating to these Terms or your use of TINCASE must first be submitted informally in writing to [contact email coming soon] for good-faith resolution. If not resolved within 30 days, disputes shall be resolved by binding individual arbitration in Benton County, Washington. YOU WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION LAWSUIT OR CLASS-WIDE ARBITRATION. All claims must be brought within one (1) year of when they arise. International users: Certain mandatory consumer protection or data protection rights granted by your local law (including EU/EEA GDPR rights, South Korean PIPA rights, Brazilian LGPD rights, Australian Privacy Act rights, Canadian PIPEDA rights, or Japanese APPI rights) may apply regardless of this governing law clause and cannot be waived by contract. Nothing in these Terms is intended to limit rights that cannot lawfully be limited under applicable local law.

We may update these Terms at any time. Material changes will be notified via in-app notice or email. Continued use after changes constitutes acceptance.

TINCASE is currently free to use. We intend to introduce optional paid features, subscriptions, or in-app purchases in the future. Any paid features will be clearly labeled. You will never be charged without explicit consent and confirmation. Free tier functionality will remain available to all users. Pricing, availability of paid features, and payment processors used will be disclosed at the time of launch and subject to updated Terms. Users will be given reasonable notice before any currently-free feature becomes paid.

[contact email coming soon]