One for One ("we", "us", "our") is a free, peer-to-peer Yu-Gi-Oh! card trading platform operated by Benjamin Sitbon, an individual based in Switzerland, who is the data controller for your personal data. This policy explains what data we collect, why we collect it, and what we do with it. We keep it plain English, no legalese.
What we collect
Account data: your email address and the password hash managed by Supabase Auth. We never see your raw password.
Profile data: your display name, optional avatar URL, and optional location (country and city) that you provide to help nearby traders find each other.
Phone number: only if you choose to trade. We ask for it before your first trade so that one account means one person, which is what stops somebody creating throwaway accounts to defraud other traders. It is stored by Supabase Auth, is never shown to other users, and is never used to contact you for anything other than the verification code.
Card data: the cards you add to your trade pile and wishlist, and the trade proposals you send or receive.
Usage data: standard server logs (IP address, browser type, pages visited) retained for up to 30 days for security and debugging.
What we do with it
We use your card data exclusively to match you with other traders and to facilitate trade proposals between users.
Your display name and location are visible to other logged-in users so they can find you as a potential trade partner. Your email address and phone number are never shared with other users.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
Third-party services
Supabase: our database and authentication provider. Your data is stored on Supabase's infrastructure (EU region). See supabase.com/privacy.
SMS delivery: if you verify a phone number, it is passed to the SMS provider configured by Supabase Auth solely to deliver your one-time code. It is not used for marketing.
YGOProdeck API: used to fetch public Yu-Gi-Oh! card information (names, images, set data). No personal data is sent to this service.
Google AdSense: we display ads to cover hosting costs. Google may use cookies to personalise ads. See Google's Privacy Policy.
Cookies
We use one session cookie set by Supabase to keep you logged in. We do not use tracking or analytics cookies beyond what Google AdSense requires.
Your rights
You can delete your account at any time from the Account page. Deleting your account removes your profile, card lists, and trade history from our database.
You can request a copy of your data or ask us to delete it by emailing hello@0nefor.one.
If you are in the EU/EEA, you have rights under the GDPR including access, rectification, erasure, and objection to processing.
Changes to this policy
If we make material changes we will update the date at the top of this page and, if the changes are significant, notify you by email.
Questions? Email us at hello@0nefor.one.