-
Notifications
You must be signed in to change notification settings - Fork 0
Home
Welcome to the ShapeshifterTCG-Privacy-and-Security wiki!
Last updated: May 26, 2026
Shapeshifter TCG is unofficial Fan Content permitted under the Wizards of the Coast Fan Content Policy. Not approved/endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC.
Shapeshifter TCG is a fan-made companion application for trading card game players. It is not affiliated with, endorsed by, sponsored by, or approved by Wizards of the Coast LLC, Scryfall LLC, The Pokemon Company, Konami, Ravensburger, Disney, Bandai, Fantasy Flight Games, Legend Story Studios, TCGplayer, Apple, or any other card data provider, publisher, trademark owner, platform provider, API provider, or platform service referenced by the app.
All trademarks, card names, set names, game names, mana symbols, artwork, logos, brand assets, card images, pricing data, rulings, rules text, Commander references, and other intellectual property remain the property of their respective owners.
Shapeshifter TCG does not claim ownership of any third-party game data, card metadata, artwork, pricing information, symbols, or reference material supplied through Wizards of the Coast, Scryfall, Pokemon TCG API, YGOPRODeck, Lorcast, SWU API, goagain.dev, Heroi, TCGCSV, TCGplayer-derived feeds, Commander Spellbook, or any other third-party service, API, publisher, rights holder, or company.
Shapeshifter TCG helps players search card databases, build decks, view deck statistics, manage collections, track trades and loans, run life counters, scan cards, share friend profiles, exchange trade lists, maintain offline card data, and import or export app data for supported trading card games.
The app supports Magic: The Gathering, Pokemon, Yu-Gi-Oh!, Disney Lorcana, Digimon, Star Wars: Unlimited, Flesh and Blood, and One Piece.
Depending on the features you use, the app may store:
- Collection entries, including card identifiers, card names, set information, quantities, foil status, condition, language, binder or collection names, tags, notes, purchase prices, current prices, and date added.
- Deck data, including deck names, formats, commanders, companions, deck descriptions, tags, card lists, categories, quantities, prices, Commander bracket fields, known combo results, and related card image URLs.
- Trade and loan records, including card names, quantities, foil status, values, trade partners, loaned or borrowed status, expected return dates, and notes.
- Friend contact records, including display names, profile identifiers, phone numbers, email addresses, notes, avatar image data or icon names, shared deck summaries, shared deck snapshots, trade list data, incoming trade request data, unread counts, and related timestamps.
- App profile data, including display name, generated profile identifier, optional phone number, optional email address, optional notes, optional avatar image or icon, Sign in with Apple identifiers, Apple-provided name or email when granted, and Game Center player identifiers or display names when connected.
- Subscription access data, including the first-launch timestamp used for the first-month unlock and StoreKit product identifiers or active entitlement status returned by Apple.
- App settings, including selected trading card game, display preferences, language preferences, pricing preferences, sync mode, cached set metadata, local database timestamps, life counter state, and import or sync status timestamps.
- Offline card database files, cached card metadata, cached rulings, cached set data, and cached Commander reference data downloaded from supported card data providers.
- Imported and exported backup files, collection files, friend profile files, trade list files, and plain-text deck lists when you choose to import or export them.
This information is primarily stored on your device using Apple platform storage. Some lightweight settings and profile fields are stored in UserDefaults. Some identifiers or timestamps may be stored in Keychain Services so they can persist more reliably. When the CloudKit-backed store is available, collection, deck, trade, friend, and loan records may sync through Apple iCloud using the iCloud account configured on the device. If the app cannot use the cloud-backed store, it may fall back to local-only storage or temporary in-memory storage.
The app uses CloudKit in two different ways:
- Private CloudKit storage may sync your app database across devices signed into the same iCloud account.
- Public CloudKit records may be used when you publish a friend profile or send live trade requests.
Published friend profiles can include your profile identifier, display name, optional phone number, optional email address, optional notes, optional avatar image, shared deck summaries or deck snapshots, and shared looking-for or tradable card lists. Live trade requests can include sender and recipient profile identifiers, names, the trade list payload, card details, prices, timestamps, read status, unread counts, and related metadata.
Do not publish profile fields, notes, avatar images, deck snapshots, or trade lists that you do not want other Shapeshifter TCG users with the relevant identifier or sharing path to access. Public CloudKit records are not the same as your private iCloud database.
Sign in with Apple is optional. If you use it, the app may store your Apple user identifier and, when Apple provides them and you allow access, your name and email address. The app uses this information to populate your local profile and show account connection status.
Game Center connection is optional. If you authenticate with Game Center, the app may store your Game Center display name and player identifier to show account connection status and populate your local profile.
iCloud is used for cloud availability checks, private database sync, public profile publishing, live trade request records, and CloudKit notification subscriptions where available.
StoreKit is used to load subscription products, make purchases, restore purchases, and check active subscription entitlements. Subscription transactions and payments are handled by Apple. The app stores the first-launch timestamp locally and in Keychain Services to manage the first-month unlock.
Camera access is used only when you choose card scanning or QR scanning features. Captured card images are processed to recognize card text or QR payloads. The app is not designed to save camera captures to your photo library as part of scanning.
Photo library access may be used when you choose an image for your profile artwork through the system photo picker. Selected image data may be stored in your app profile, backup files, friend profile exports, or published friend profile records if you choose to share or publish it.
Notifications may be requested so the app can receive and show CloudKit-related trade update notifications, including live trade request updates from friends. Notification delivery is handled by Apple services and device settings.
File import and export features read or write data only when you choose files through the system file picker, share sheet, or supported file-opening flows. Supported files may include Shapeshifter profile backups, collection exports, friend profiles, trade lists, and plain-text deck lists.
The app downloads, displays, searches, caches, or processes card and set information from third-party data sources. These may include:
- Scryfall
- Pokemon TCG API
- YGOPRODeck
- Lorcast
- SWU API
- goagain.dev
- Heroi bulk data sources
- TCGCSV and TCGplayer-derived feeds
- Commander Spellbook
- Wizards of the Coast web pages for Commander reference information
- Other public, licensed, or user-selected APIs, feeds, and metadata providers added in future versions
Requests to these services may reveal standard network information such as your IP address, device network details, request timing, and the specific endpoints, card names, deck contents, or search queries needed to provide the feature. Third-party services are governed by their own terms, privacy notices, rate limits, and operational practices.
Third-party materials are provided for reference, search, collection tracking, deck building, life tracking, trade support, and other companion-app purposes only. Use of third-party data does not transfer ownership to Shapeshifter TCG or its developer.
The app is not designed to sell personal information, run third-party advertising, or build advertising profiles from user activity.
The app is not designed to collect unrelated sensitive personal information. However, you control freeform fields such as notes, deck descriptions, collection names, trade notes, friend notes, and profile notes. Avoid entering sensitive information that is not needed for card collection, deck, trade, loan, or friend-sharing features.
The app relies on Apple platform protections, SwiftData storage, UserDefaults for lightweight settings and profile fields, Keychain Services for selected persistent identifiers or timestamps, system permission prompts, StoreKit transaction verification, CloudKit transport and storage, security-scoped file access for selected imports, and system share sheets or file pickers for user-controlled sharing.
The app stores temporary export files and temporary CloudKit asset files when needed to complete export, sharing, or upload workflows. Temporary files may remain subject to normal system cleanup behavior.
No software, storage system, network service, or cloud provider can guarantee absolute security. You are responsible for deciding what to enter, publish, import, export, scan, or share, and with whom to share it.
Profile backups can contain a broad snapshot of your app data, including profile fields, settings, subscription unlock timestamps, collections, decks, trades, friends, loans, notes, prices, and image data. Collection exports contain collection card data. Friend profile files and QR codes can contain profile identifiers and contact fields. Trade list files can contain sender, recipient, card, pricing, and contact details.
Anyone who receives a file, QR code, profile link, trade list, or backup may be able to read, store, modify, or redistribute the information it contains. Only share these materials with people and services you trust.
Imported files and scanned QR codes may contain user-supplied content. The developer is not responsible for inaccuracies, malicious content, misuse, or unauthorized redistribution of files or QR payloads shared by users.
The app includes local data management features such as exporting all data, importing data, and clearing app-managed records. Clearing data from the app affects the local app database on that device, but it may not immediately remove data already synced through iCloud, already published to public CloudKit records, already exported to files, already sent to other users, already stored in Keychain Services, or retained by third-party services.
Users should maintain their own backups where appropriate. Sync, import, export, backup, restore, purchase, and entitlement-check operations can fail or produce incomplete results.
This app and its related documentation are provided on an "as is" and "as available" basis to the maximum extent permitted by applicable law. The developer makes no guarantee that:
- third-party data will always be accurate, complete, current, available, or legally usable in every context
- card prices, legality information, set data, images, Commander references, combo information, and metadata will be correct
- synchronization, public sharing, imports, exports, backups, purchases, notifications, or scans will never fail
- the app will be uninterrupted, error-free, or compatible with every device, service, file, or future API change
This document may be updated as the application evolves, subscription features change, new features are added, third-party integrations change, or legal and operational needs change.
If you are a rights holder, API provider, or user with a privacy, security, attribution, purchase, or data concern, please contact the developer to request review, correction, attribution updates, or removal where appropriate.
Last updated: May 26, 2026
Shapeshifter TCG is unofficial Fan Content permitted under the Wizards of the Coast Fan Content Policy. Not approved/endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC.
Magic: The Gathering card names, set names, rules text, mana symbols, card images, artwork, characters, trademarks, logos, and related materials are property of Wizards of the Coast LLC and/or their respective rights holders.
Magic card data, rulings, set metadata, and image references may be provided by Scryfall. Scryfall is not produced by or endorsed by Wizards of the Coast, and Shapeshifter TCG is not produced by or endorsed by Scryfall.
The app may also reference Commander information, including Commander Game Changers, Commander bracket estimates, and known combo information. Commander reference material remains the property of its respective owners and is provided for companion-app reference use only.
Scryfall API and imagery documentation:
- https://scryfall.com/docs/api
- https://scryfall.com/docs/api/images
- https://scryfall.com/docs/api/bulk-data
Wizards Fan Content Policy and Commander references:
- https://company.wizards.com/en/legal/fancontentpolicy
- https://magic.wizards.com/
- https://magic.wizards.com/en/news
Commander Spellbook documentation:
The app may download, display, cache, search, or process data from:
- Pokemon TCG API
- YGOPRODeck
- Lorcast
- SWU API
- goagain.dev
- Heroi bulk data sources
- TCGCSV and TCGplayer-derived card or pricing feeds
Pokemon, Yu-Gi-Oh!, Disney Lorcana, Digimon, Star Wars: Unlimited, Flesh and Blood, One Piece, TCGplayer, and related names, trademarks, card images, logos, game text, set names, artwork, characters, and brand assets are property of their respective owners.
This product may use TCGplayer-derived data through TCGCSV or related feeds, but it is not endorsed or certified by TCGplayer.
Provider documentation and terms references:
- Pokemon TCG API: https://docs.pokemontcg.io/
- Pokemon TCG API Terms: https://dev.pokemontcg.io/terms
- YGOPRODeck API Guide: https://ygoprodeck.com/api-guide.php
- Lorcast API: https://lorcast.com/docs/api
- SWU API: https://www.swuapi.com/
- goagain.dev: https://goagain.dev/
- TCGCSV: https://tcgcsv.com/docs
- TCGplayer API Terms: https://help.tcgplayer.com/hc/en-us/articles/360061115874-TCGplayer-API-Terms-Conditions
- Heroi API and bulk assets: https://heroi.cc/
The app may use Apple platform services including SwiftUI, SwiftData, CloudKit, Sign in with Apple, Game Center, StoreKit, iCloud, Keychain Services, Photos picker, file import/export, notifications, and camera permissions. Apple is not affiliated with, sponsoring, or endorsing Shapeshifter TCG.
Apple documentation and policy references:
- https://developer.apple.com/icloud/cloudkit/
- https://developer.apple.com/storekit/
- https://www.apple.com/legal/internet-services/itunes/dev/stdeula/
If attribution is incomplete, inaccurate, or if a rights holder wants content reviewed, corrected, attributed differently, or removed, contact the developer with the relevant details.
Last updated: May 26, 2026
By using Shapeshifter TCG, you agree to use the app only for lawful personal companion-app purposes, including searching cards, managing collections, building decks, viewing deck statistics, importing and exporting app data, tracking trades and loans, scanning cards, sharing friend profiles, sending trade lists, and using life counters.
If you do not agree with these terms, do not use the app.
Shapeshifter TCG is unofficial Fan Content permitted under the Wizards of the Coast Fan Content Policy. Not approved/endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC.
The app is not affiliated with, endorsed by, sponsored by, or approved by Wizards of the Coast LLC, Scryfall LLC, The Pokemon Company, Konami, Ravensburger, Disney, Bandai, Fantasy Flight Games, Legend Story Studios, TCGplayer, Apple, or any other referenced card data provider, publisher, trademark owner, platform provider, API provider, or platform service.
Card data, card images, pricing data, rulings, rules text, set information, symbols, Commander references, combo information, and other third-party materials remain the property of their respective owners. The app provides those materials for reference and companion-app use only.
Third-party APIs, feeds, websites, and platform services are governed by their own terms, privacy notices, rate limits, attribution rules, and availability. Your use of app features that rely on those services is also subject to those third-party rules.
Third-party data can be incomplete, unavailable, changed, rate limited, removed, or inaccurate. You are responsible for verifying rules, prices, legality, deck legality, event requirements, and trade values before relying on them.
Shapeshifter Plus may unlock premium features after the first-month unlock period, including Friends, friend trading, unlimited decks, deck statistics, and full app data import/export. Subscription purchases, renewals, cancellations, refunds, family sharing eligibility, taxes, and payment processing are handled by Apple and the App Store.
Subscription availability, pricing, trial behavior, and included features may change as permitted by App Store rules. You can manage or cancel subscriptions through your Apple account settings.
You are responsible for the profile fields, notes, avatar images, deck descriptions, collection names, trade records, friend records, imported files, exported files, QR codes, and other content you create, scan, import, publish, or share.
Do not upload, publish, import, export, or share content that you do not have the right to use, that violates another person's rights, that exposes private information without permission, or that is unlawful, harmful, misleading, abusive, or malicious.
Public CloudKit sharing is optional. If you publish a friend profile or send a live trade request, the shared record may include personal contact details, notes, avatar data, deck snapshots, trade list cards, prices, identifiers, unread counts, timestamps, and related metadata. Only publish or send information you want the recipient or relevant users to access.
Import, export, backup, restore, and file-sharing features are user-controlled. Files may contain profile data, settings, collections, decks, trades, friends, loans, notes, prices, card identifiers, image data, and other app records.
Anyone who receives a backup, export, QR code, friend profile, or trade list may be able to read, store, modify, or redistribute its contents. Review files before sharing them and only import files from sources you trust.
Card prices, trade values, rules, format legality, Commander bracket estimates, deck statistics, combo information, and database results are informational estimates and references only. The app does not provide financial, legal, tournament, judging, investment, or professional advice.
The app and documentation are provided on an "as is" and "as available" basis to the maximum extent permitted by law. No guarantee is made that the app, data, prices, scans, imports, exports, sync, purchases, notifications, third-party services, or public sharing features will be accurate, complete, current, secure, uninterrupted, or error-free.
To the maximum extent permitted by law, the developer is not responsible for indirect, incidental, consequential, special, punitive, or similar damages, including loss of data, loss of trades, incorrect prices, failed sync, failed backups, failed imports or exports, failed purchases, service outages, third-party API changes, or unauthorized redistribution of information that you choose to share.
Some jurisdictions do not allow certain limitations, so some of these limitations may not apply to you.
These terms may be updated as the app, subscription features, third-party integrations, platform requirements, or legal needs change.
If you are a rights holder, API provider, or user with a legal, privacy, security, attribution, purchase, or data concern, contact the developer to request review, correction, attribution updates, or removal where appropriate.