Privacy
Last updated 31 October 2026
This is a personal hobby site run by one person, called "the owner" below. It is invite only: anyone can reach expshare.gg, but only people the owner has invited, once signed in, see more than the sign-in page. This page says what the site keeps about you, why, for how long, who else sees it, and how to remove it.
The short version
- No ads, no analytics, no tracking pixels, no scripts from other companies. Nothing about you is sold or shared for marketing.
- Just browsing leaves a short web server log (about two weeks) and some settings in your own browser.
- Feedback you send is kept, and the owner reads it with the help of an AI assistant.
- A Rip account holds the name you pick and, only if you choose password sign-in, your email address. Other players never see your email.
- You can delete your account yourself. For anything else, use Send feedback.
When you just browse
The web server's log
Like almost every website, the server that delivers the pages writes one line per request. A line holds:
- your device's network address, as Cloudflare passes it on (below)
- your browser and system (the "user agent"), and your language settings
- the address requested, which includes what you typed into a search or a price check, and the page you came from
- the time, and whether the request worked
It is used to keep the site running and to look into problems. The log is shared by every site on the owner's server and is deleted oldest first as it fills up: at today's traffic, a line lasts about two weeks. The program that answers the site's own requests (prices, accounts, Rip) keeps no log of requests at all.
What your browser keeps
The site saves some things in your own browser, so they are there next time. They stay on your device and are not sent to the site:
- your theme, filters, picture size and sound settings
- your last few price checks, the last cards you opened, and the text of your last lot check
- listings you reported as the wrong card, so they show as reported
- Rip's settings and, if you play without an account, your unopened packs
- a draft of feedback you have not sent yet
Clearing this site's data in your browser removes all of it. The site also installs a small background script (a "service worker") in your browser, used only to show notifications if you turn them on. It does not track you or store pages.
Pictures and links
Card and pack pictures load straight from TCGplayer's image servers, and listing photos from eBay's. As with any picture on any website, those servers see your device's network address and browser, and may see that the request came from this site.
When you follow a link to eBay, TCGplayer or PSA, their own privacy policies apply from there. If the eBay Partner Network is switched on (the foot of the main page says so when it is), eBay links carry the site's partner code, and the site may earn a commission. The site never sends eBay anything about you.
The watchlist is shared
Starred cards and their price targets are one list for the whole site: everyone who uses the site sees it and can change it. It does not record who starred what.
Notifications
If you turn on notifications, your browser gives the site an address at your browser maker's push service (Google, Apple, Mozilla or Microsoft) and two keys. The site keeps these with your alert settings and when it last sent you something. No name, account or network address is attached.
Each notification is encrypted so that only your device can read it; the push service sees only that a message was sent, when, and how big. When a notification has a picture, your device fetches it from eBay or TCGplayer.
All of it is deleted when you turn notifications off from the bell, when the push service says your device is gone, or after 10 failed sends in a row.
Feedback
Feedback (the Send feedback button, the F1 key, or Wrong card? on a deal) is sent only when you choose to send it. A Wrong card? report goes as soon as you pick an answer. It holds:
- your words
- pictures of the page (up to three). They show whatever was on your screen, so look at them before you send; you can draw on them
- the page's address, the last pages you viewed and the buttons you pressed
- the site's own requests the page made, including what they asked for (such as a price check's text or a search) and any error they returned, plus recent error messages and warnings from the page
- your deal filters and search words, and your last price check or lot check with its answer, even if you have closed it. Nothing else you typed into a box
- your browser and system (the full user agent), language, time zone, screen size, number of processor cores, memory, connection type, whether it is a touch screen, and whether the site is installed as an app
- a random number your browser made up, so that it can show you what became of your feedback
The feedback itself holds no name, account or network address, even when you are signed in. But your browser asks the site about that random number when pages load, and the web server's log records those requests with your network address for about two weeks. Pictures show your name if it was on the screen. Invite and device-link codes are removed from page addresses before sending.
If you use the microphone to dictate, your browser's own speech service turns your voice into words; only the words are sent. Feedback that cannot be sent right away waits in your browser and is sent later.
Who sees it: the owner, who reads and fixes feedback with the help of Claude, an AI assistant made by Anthropic. Your feedback, pictures included, is passed to Anthropic for that.
How long: the words and details are kept as a record of what was asked and what was done. Pictures are deleted the next time anyone sends feedback, once the feedback has been closed for 90 days. To have yours deleted sooner, ask, with the code you were shown when you sent it.
Rip accounts
Accounts are for Rip, the pack-opening game, and are by invitation from the owner. If you have one, the site keeps:
| What | Why |
|---|---|
| The name you choose, a friend code, and when you joined | So friends can find and recognise you |
| For each passkey: its public key, a label like "Chrome on Windows", and when it was made and last used | To check a passkey sign-in. The passkey's secret half never leaves your device or password manager |
| Your email address and password, only if you choose password sign-in | To sign you in. The email is never shown to other players, never checked and never sent mail. The password is kept only as a salted scrypt hash, which cannot be turned back into the password |
| Each signed-in browser: a label, when it signed in and when it was last used | To keep you signed in and to list your devices so you can sign them out |
| Friends, friend requests, and trades | To run friends and trading |
| Your Rip game: coins, packs, the cards in them, sales and coin history | To run the game |
The one cookie
Signing in sets one cookie, tcg_session. It keeps you signed in for about 180 days
from when you last used the site, and only the site can read it. The site stores a scrambled copy of it,
never the cookie itself. Signing out removes it.
Stopping password guessing
When you sign in, join from an invite or add a friend by code, the site notes your network address and the time, to limit how many tries one address can make. A wrong password also notes a scrambled form of the email address that was tried; someone who already guessed the email could confirm it from that form. These notes are deleted at the next try made more than a day later.
What other players see
Your friends see your name, the cards in your binder, your last 30 packs (when you opened each, what it cost, what it was worth and its best pull), the total coins you have spent on packs, and your records and medals. Someone you trade with sees your name and the trade. Someone you send a friend request to sees your name. No other player sees your email address, your devices, your coin balance or your sales.
Deleting your account
Open your account page and choose Delete account. That removes your name (you show as "Former player"), your email address, your password, your passkeys and every signed-in browser, and ends your friendships and open trades. What stays: an empty account record (its number, friend code and dates); past friend requests and the invites you made or joined with (who and when); and your Rip game (coins, packs, cards, sales, coin history and past trades). None of it has a name or any way to sign in to it any more. It stays so that the other side of past trades still adds up.
Backups
Every night the site's databases (not the web server's log) are copied to a backup folder on the same server, kept for 14 days, and to the owner's home computer, kept for 90 days. Both are in the owner's home and are not encrypted separately. So something deleted from the site can stay in a backup for up to 90 days.
Who else is involved
- TCGplayer and eBay: pictures load from their servers, and their pages are where links go.
- Google, Apple, Mozilla or Microsoft: your browser's push service, only if you turn on notifications.
- Anthropic: feedback you send, as above.
- Cloudflare: every visit to expshare.gg passes through Cloudflare's network, which connects it to the owner's server and shields that server from attacks. Cloudflare sees your device's network address and the requests it carries; its own privacy policy covers what it keeps.
The owner can see everything the site stores. Nobody else is given it.
Your choices
- Clear this site's data in your browser to remove everything kept there.
- Look at feedback pictures before you send them, and draw over anything you would rather not share.
- Turn off notifications from the bell.
- Rename your account, remove passkeys, change or remove your password, sign out other browsers, or delete the account, all from your account page.
- Ask for a copy of what the site holds about you, for something to be corrected, or for your feedback to be deleted. Wherever you live, the owner will do it by hand.
The site is not meant for children under 13.
Contact
Use Send feedback (or press F1) on any page of the site, including this one. Say what you would like done; if it is about feedback you sent, include its code. The owner reads every one.
If this page changes, the date at the top changes with it.