Privacy Policy

Last updated 26/10/26

This Privacy Policy explains how Oshikatsu Labo Pte Ltd ("OSHI TCG", "we", "us") collects and uses your personal data when you visit oshitcg.com or join the OSHI TCG waitlist. OSHI TCG is a free app for trading card collectors and traders. It is not launched yet, and public release is planned for 2027.

This policy is written in English. A Bahasa Malaysia version is available on request at info@oshitcg.com.

1. Who we are

OSHI TCG is run by Oshikatsu Labo Pte Ltd, which is responsible for your personal data.

Contact for privacy questions: info@oshitcg.com

2. What we collect

Data you give us

Email address (required to join the waitlist).
What you collect (optional): Pokémon, One Piece or Other.

Data collected automatically when you sign up

The referral code in the link you used (from ?ref=), if any.
Campaign tags showing where you came from (UTM source, medium and campaign).
A bot-protection token from Cloudflare Turnstile, and a hidden anti-spam field.
The time you signed up and confirmed your email.
Your approximate country, worked out from your request.
A hashed (scrambled) version of your IP address and your browser's user agent. We use these only to prevent referral fraud.

Data we create about you

Your waitlist status (pending or confirmed).
Your Day One badge number, if you get one.
Your own referral code and how many people you have referred.
Whether you opened or clicked our emails (see Section 6).

Website analytics

When you browse oshitcg.com, Google Analytics collects usage data such as pages viewed, device and browser type, approximate location and referring site, using cookies. See Section 7.

3. Why we use your data

We use your data to:

Add you to the waitlist and confirm your email address.
Send you OSHI TCG launch news, product updates and waitlist emails.
Run the referral program, assign Day One badges and deliver rewards when the app launches.
Prevent bots, fake signups, self-referrals and other abuse.
Understand which channels and campaigns bring people to OSHI TCG, and improve our website and product.
Carry your waitlist status, badge and rewards over to your OSHI TCG account at launch, if you sign up with the same email.
Meet our legal obligations.

4. Is giving us your data required?

Giving us your email address is obligatory if you want to join the waitlist. Without it, we can't add you or send you updates. Telling us what you collect is voluntary, and skipping it has no effect on your signup.

5. Legal basis (EU and UK visitors)

If you are in the EU or UK, we rely on:

Consent: for sending you waitlist and marketing emails (given when you submit the signup form and confirm your email), and for analytics cookies where required.
Legitimate interests: for fraud and bot prevention, running the referral program fairly, and understanding where signups come from.
Legal obligation: where we must keep or disclose data by law.

6. How you agree to emails, and how to stop

You join by submitting the signup form, which is clearly labelled as a subscription to OSHI TCG updates. We then send a confirmation email, and you are only added once you click the confirmation link (double opt-in).

Every email we send has an unsubscribe link. You can also withdraw consent at any time by emailing info@oshitcg.com. Unsubscribing removes you from the waitlist emails, and may mean you lose your place, badge or referral rewards.

Our emails may include open and click tracking, which tells us whether an email was opened and which links were clicked. We use this to improve our emails and to measure referral activity.

7. Cookies and analytics

Website: oshitcg.com uses Google Analytics, which places cookies on your device to measure visits and usage. Where the law requires it (for example in the EU and UK), we will ask for your consent before setting analytics cookies, and you can change your choice at any time. You can also block cookies in your browser settings or use the Google Analytics opt-out add-on.
Bot protection: Cloudflare Turnstile may process technical data from your browser to check you are human. This is needed for the form to work.
App (after launch): once the OSHI TCG app launches, we will use PostHog for product analytics in the app. We will tell you more about this in the app's own privacy notice.

8. Who we share your data with

We do not sell your personal data. We share it only with service providers that help us run OSHI TCG, under contracts that limit how they can use it:

Provider	What they do
Vercel	Website hosting and server functions
Our database provider (Google Cloud) [CONFIRM: Google Cloud SQL or Neon]	Stores waitlist data
Resend	Sends confirmation, update and marketing emails, and tracks opens and clicks
Google Analytics	Website analytics
Cloudflare (Turnstile)	Bot and spam protection
PostHog	App analytics, once the app launches

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger, acquisition or sale of our business (in which case this policy will continue to apply to your data).

9. International transfers

Several of our providers are based in, or process data in, the United States and other countries outside Malaysia, the EU and the UK. When we transfer your data, we take steps to protect it, such as using providers that offer standard contractual clauses or similar safeguards, in line with the Malaysian Personal Data Protection Act 2010 and the GDPR.

10. How long we keep your data

We keep your waitlist data until you unsubscribe or until the app launches and your data is moved to your OSHI TCG account.
If you don't create an account, we delete or anonymise your waitlist-only data within [CONFIRM: 12 months] after launch.
If you unsubscribe, we stop emailing you and delete your data within a reasonable period, but may keep your email on a suppression list so we don't contact you again, and keep limited records needed to prevent fraud.
Analytics data is kept according to the retention settings of Google Analytics [CONFIRM: e.g. 14 months].

11. How we protect your data

We use reasonable technical and organisational measures to protect your data, including encryption in transit, access controls and hashing IP addresses rather than storing them in plain form. No system is perfectly secure, but if a data breach affects you, we will notify you and the authorities where the law requires.

12. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Correct data that is wrong or incomplete.
Withdraw consent at any time (for example, by unsubscribing).
Delete your data.
Limit or object to certain uses of your data.
Receive a copy of your data in a portable format.
Complain to a data protection authority.

To use any of these rights, email info@oshitcg.com. We may need to verify your identity, and we will reply within the time the law requires (21 days under Malaysian law). We may charge a fee for access requests where the law allows it.

Malaysia: you can contact the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).
EU / UK: you can complain to your local supervisory authority, or the UK Information Commissioner's Office (ICO).
California and other US states: we do not sell or "share" your personal data for cross-context behavioural advertising, and we do not use it to profile you in ways that have legal effects. You can ask to know, delete or correct your data, and we will not discriminate against you for using these rights.

13. Children

OSHI TCG's waitlist is not directed at children under 13, or under 16 in the EU and UK. If you are under that age, please ask a parent or guardian to sign up for you. If you are a parent and believe your child has given us their data, contact us at info@oshitcg.com and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new effective date, and if the changes are significant, we will let you know by email.

15. Contact us

Oshikatsu Labo Pte Ltd
Email: info@oshitcg.com