Privacy

Last updated 22 October 2026.

GOATLIST is a small site run by one person. It keeps as little about you as it can and sells none of it: there are no ads, no analytics and no tracking cookies of its own. This page lists everything it does keep.

If you only browse

You don't need an account to browse, and nothing you look at is tied to you. Your IP address is seen, as with any website: the web server writes each request, with the address, to a log that is rotated and discarded, and the site counts requests per address for a short while to stop one visitor from overloading it.

A few things are saved in your own browser's storage and never leave it: the color theme, your My tiers list, your My rankings (your order of the sets and families, and your pinned sets), and the sets and searches on your My wall.

If you sign in

An account is needed only to keep My tiers, My rankings and My wall on every device: your player tier lists, your order of the sets, and the sets and searches on your wall. An account is your email address and the dates it was created and last signed in. Your lists are kept with your account until you delete it. They hold player names and tiers, set and family names in your order, the names of the sets and searches on your wall, and nothing from eBay.

Signing in sets one cookie, which keeps you signed in for 30 days. It is sent only over HTTPS and scripts can't read it. It is the only cookie the site sets.

Sign-in links are emailed to you and stored only in scrambled (hashed) form. They expire, and are deleted within a day of being used or expiring. Your address is used for nothing else: no newsletters and no marketing.

The listings

Listings, asking prices and photos come from eBay through eBay's API. GOATLIST keeps no seller usernames, buyer details or other eBay member information. A listing's title, link, photo reference and asking price are kept for up to 14 days on the computer that builds the pages, then deleted; after that only anonymous daily figures per card type remain. A listing is shown on the site for at most 6 hours after it was found.

Other services your browser talks to

eBay. Listing photos load straight from eBay's image servers, so eBay sees your IP address when a photo shows. A listing link takes you to eBay, where eBay's own privacy notice applies. Listing and search links are eBay Partner Network affiliate links, so eBay may set a cookie to credit the site if you buy.

Email. Sign-in links are sent through an email delivery service, which handles your address only to deliver the message.

Backups

The database is backed up every night, and each backup is kept for 14 days, on the server and as a copy on the owner's computer. Anything deleted is gone from the backups 14 days later.

Deleting your account, or seeing what is kept

To have your account deleted, or to get a copy of what the site holds about you, write to michael@goatlist.org from the address you sign in with. Deleting an account removes your tier lists with it.

Changes

If this page changes, the date at the top changes with it. The terms of use are on their own page.