Privacy Policy — Card Collector DB
Effective · Operator: David Bowles
Information we handle
When you use an account, we process your email address, account identifier, username if chosen, assigned role and permissions, authentication and account-security information, session information, and site preferences. Supabase Auth manages sign-in, passwords, email confirmation, password recovery, and authentication factors.
Collection entries you choose to save may include Owned, Wanted, Ordered, For Trade, or Sold status; condition; quantity and printed serial numbers; storage location; purchase details; source; notes; and serial-correction history. We also store your Favorite Releases and optional trading-discovery settings.
Catalog contributions, correction and release/checklist requests, and imports may include source names, uploaded workbook contents parsed for review, card and person details, catalog images, notes, review decisions, and contributor or reviewer identifiers. Support messages include your account email, message category, subject, details you provide, and staff review notes. Please do not send passwords, verification codes, or unnecessary private collection information in a submission.
How we use information
We use this information to provide account access, personal collection tools, Favorite Releases, catalog and import workflows, support, reports, and CSV exports; to review and correct shared catalog information; to apply your trading-discovery choices; and to protect, maintain, and troubleshoot the site.
Who can see information
Visitors can browse the shared catalog without an account. Personal collection records and support messages are not public catalog content. Approved catalog submissions and catalog images may be visible to other visitors. Access controls restrict personal records, but authorized administrators or staff may access information when their assigned work requires it.
Trading discovery is optional. If you enable it, other signed-in members may see anonymous counts of members with matching For Trade or Wanted cards. That feature does not display your name, notes, serial numbers, quantities, or other detailed collection records.
Service providers and external sites
Supabase provides authentication, database, and file-storage services. Vercel hosts and operates the website. These providers may process technical request and diagnostic information, including IP address, browser or device information, and timestamps, to deliver, secure, and troubleshoot their services. Authentication email is delivered through the configured email provider. If a security challenge is enabled, its provider may process browser and challenge information for that purpose.
Links to eBay take you to an external site and may contain affiliate parameters. An eBay-hosted image may also load on pages showing its search link. eBay may receive browser request information under its own policies. Card Collector DB does not conduct transactions that follow those links.
Cookies, browser storage, and operational data
We use cookies to maintain and refresh authentication sessions. Some import forms temporarily save text drafts in your browser's session storage so work can survive a validation problem; a browser-selected file cannot be restored that way. The application does not include a separate visitor-analytics SDK. Hosting and security providers may still process operational data needed to run the site.
Retention, exports, and deletion requests
We keep information while needed to provide the account and service, review contributions, resolve support or security issues, and meet applicable obligations. Eligible private import drafts have separate expiration rules; abandoning one does not erase it immediately. Approved shared-catalog contributions may remain after account closure. Where reasonably possible, contributor identity should be detached or anonymized, subject to security, legal, and operational needs. Operational logs, support or security records, and backups may have separate retention periods.
Collection Reports provide CSV downloads of your collection information. Managing your collection and downloading a CSV copy of your collection data will remain free. Self-service account deletion is not currently available. For a privacy or account-deletion request, email privacy@cardcollectordb.com. We may need to verify your identity before acting and will explain any information that must be retained or treated separately.
Children and younger members
Children under 13 may not create an account. Members under 18 must have permission from a parent or legal guardian. We do not ask for a full birth date to apply this account rule. If you believe an account belongs to a child under 13, contact privacy@cardcollectordb.com.
Security, changes, and contact
We use authentication and access controls to protect information, but no online service can guarantee absolute security. We may update this policy as the site changes and will post a revised effective date; material changes will receive appropriate notice.
Card Collector DB is operated by David Bowles. Privacy questions and requests: privacy@cardcollectordb.com. General support: support@cardcollectordb.com.