Privacy Policy

1. Introduction

BotCollector ("we," "us," or "our") is a collectibles tracking platform operated as a sole proprietorship based in Georgia, USA. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services (collectively, the "Service").

We are committed to protecting your privacy and handling your data with transparency. Although we are a US-based service, we comply with the General Data Protection Regulation (GDPR) for all users as a matter of best practice.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address - Required for account creation, authentication, and communication
• Username - Your public identifier on the platform
• Password - Stored only in hashed form; we never see your actual password
• Display name - Optional personalization for your profile
• Profile picture - Optional avatar image

2.2 Collection Data

When you use our Service to track your collection, we store:

• Figure ownership status (collected, wishlist, owned previously)
• Custom collections you create
• Notes and personal observations about figures
• Package condition checklists
• Reviews and ratings you submit

2.3 User-Generated Content

If you upload images or create content:

• Figure images - Photos you upload of your figures, stored privately by default
• Public images - If you opt in, images you choose to share with the community
• Reviews - Text reviews visible to other users
• Forum posts - Public community discussions and the images attached to them; see The Forum

2.4 Technical Information

We automatically collect certain technical data:

• IP address - For security, rate limiting, and fraud prevention
• Browser and device information - For service optimization
• Usage data - Pages visited, features used (aggregated and anonymized)

2.5 Payment Information

For paid subscriptions, payment processing is handled entirely by Stripe. We never store, process, or have access to your credit card numbers. We only receive confirmation of successful payments and basic billing information (billing address, last four digits of card for reference).

2.6 Newsletter Subscription

If you subscribe to our newsletter, we collect:

• Email address
• Subscription preferences (frequency)
• Consent metadata (timestamp, IP address, and consent text for GDPR compliance)

3. How We Use Your Information

We use the information we collect to:

3.1 Provide Our Service

• Create and manage your account
• Enable collection tracking and management
• Process and store your uploaded images
• Display your reviews and public content
• Process subscription payments

3.2 Communicate With You

• Send account-related notifications (password resets, security alerts)
• Deliver newsletters you've subscribed to
• Respond to support inquiries
• Notify you of significant changes to our Service or policies

3.3 Improve Our Service

• Analyze usage patterns to improve features (Google Analytics, with your consent)
• Count page views with Vercel Web Analytics, which sets no cookies and stores nothing in your browser (legitimate interest; skipped when your browser sends Do Not Track)
• Count how many searches are made, and how many find nothing, as plain daily totals kept by mattblack.space (our developer's site); each count holds only the date and the kind of event, never what you searched for or anything about you (legitimate interest; skipped on Do Not Track)
• Count page views the same way, by kind of page (for example a figure page or a checklist, never which one), and visits by the kind of place they came from (for example a search engine or another site, which mattblack.space works out from that site's name and then forgets); again only daily totals, with no cookie, IP address or identifier (legitimate interest; skipped on Do Not Track)
• Debug issues and fix bugs
• Develop new features based on user needs

3.4 Ensure Security

• Detect and prevent fraud and abuse
• Enforce our Terms of Service
• Protect the rights and safety of our users

3.5 Display Advertising

For users on our free tier, we display advertisements through Google AdSense. With your consent, these ads may be personalized based on your interests. You can opt out of personalized advertising through our cookie preferences.

3.6 AI Figure Identification

When you use our AI figure identification feature, your uploaded image is sent to Google Cloud Vision for analysis. The image is processed in real-time and is not stored or retained by Google after processing.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we must have a legal basis for processing your personal data. We rely on the following:

4.1 Contract Performance

Processing necessary to provide our Service to you under our Terms of Service:

• Account creation and management
• Collection tracking functionality
• Subscription billing
• Image storage and display

4.2 Consent

Processing based on your explicit consent, which you may withdraw at any time:

• Newsletter communications
• Analytics cookies (Google Analytics)
• Advertising cookies (Google AdSense)
• Sharing your images publicly for use on figure pages

4.3 Legitimate Interest

Processing necessary for our legitimate business interests, balanced against your rights:

• Security logging and fraud prevention
• Service improvement through aggregated, anonymized analytics
• Protecting our legal rights and those of our users

4.4 Legal Obligation

Processing required to comply with applicable laws:

• Maintaining billing records for tax purposes
• Responding to valid legal requests

5. Information Sharing

We do not sell your personal information. We share data only in the following circumstances:

5.1 Service Providers

We use trusted third-party services to operate our platform. Each has a Data Processing Agreement in place:

5.2 Legal Requirements

We may disclose your information if required to:

• Comply with applicable laws, regulations, or legal processes
• Respond to valid government requests
• Protect the rights, property, or safety of BotCollector or our users

5.3 Business Transfers

If BotCollector is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and your choices regarding your data.

5.4 With Your Consent

If you opt in to share images publicly, those images may appear on figure detail pages to help other collectors. You will be credited as the contributor and can withdraw this consent at any time.

6. International Data Transfers

BotCollector is based in the United States. Your data may be transferred to and processed in the United States and other countries where our service providers operate.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) - Our major service providers (Google, Stripe, Vercel, Supabase) include these EU-approved contractual terms in their Data Processing Agreements
• Supplementary measures - Additional technical and organizational protections as needed

By using our Service, you acknowledge that your data may be processed in the United States with these safeguards in place.

7. Data Retention

We retain your data only as long as necessary for the purposes described:

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 Access

You can request a copy of the personal data we hold about you. Most of this is accessible directly through your account settings.

8.2 Rectification

You can update or correct inaccurate data through your profile settings, or contact us for assistance.

8.3 Erasure ("Right to be Forgotten")

You can delete your account at any time through your account settings. After a 30-day recovery period, your account is permanently deleted: your profile, collection, photos, reviews, votes, follows, pending or rejected suggestions and newsletter subscription are all removed, along with your uploaded files. Signing in during the recovery period cancels the deletion.

Facts you added to the shared catalog stay in it, because other collectors rely on them: figures you added that were published, and changes to figure pages that were approved. They stop naming you. Your username comes off them, and your notes on those changes are removed. We also keep data where we have a legal obligation to retain it.

8.4 Data Portability

You can request an export of your data in a machine-readable format (JSON). This includes your profile, collections, photos, reviews, and everything you have contributed to the catalog, with what happened to each contribution.

8.5 Restriction of Processing

You can request that we limit how we use your data while we address your concerns.

8.6 Object to Processing

You can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds.

8.7 Withdraw Consent

Where we rely on consent, you can withdraw it at any time through your privacy settings or by contacting us. This includes:

• Newsletter - Unsubscribe link in any email, or privacy settings
• Analytics/Advertising cookies - Cookie preferences in footer
• Public image sharing - Image settings in your profile

8.8 Exercising Your Rights

To exercise any of these rights, you can use the self-service options in your account settings or contact us at privacy@botcollector.app. We will respond within 30 days (or 90 days for complex requests, with notice).

We may need to verify your identity before processing requests. We will not charge a fee unless requests are manifestly unfounded or excessive.

8.9 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority. For EEA residents, you can find your authority at edpb.europa.eu.

9. The Forum

Forum posts are public: anyone can read them, and they show your username and avatar. Your email address is never shown in the forum or included in anything the forum sends to other people. If your profile is public, your posts also show what your public profile already shows: when you joined, how many catalog changes you have added and, if you show your collection, its size, a few figures you added recently and whether you own the figure a thread is about. Make your profile private, or hide your collection, and the forum stops showing them.

9.1 What We Keep

• The threads you start and the posts you write, with when you wrote and last edited them
• Earlier versions of posts you edit. Only BotCollector moderators can see them; they help us handle abuse reports about what a post used to say
• Images you attach, with the description you give them. Location and other camera data (EXIF) is removed when you upload, before anything is stored
• Which catalog figures your posts link to, so figure pages can list the threads about them
• The posts you like. A post shows how many likes it has and, to anyone who asks, the usernames of who liked it. We never show how many likes you have received
• Unsent text you were writing in the forum, kept only in your own browser so a refresh doesn't lose it. It never reaches us, belongs to your account alone, and is cleared when you send the post, discard it, sign out or delete your account
• The threads you follow, your notifications (replies, quotes and @mentions, with who posted them), how far you have read each thread you opened, and whether you turned on the daily email digest
• Reports you send about posts: the post, the reason you chose and any details you add. Moderators see the report; the author of the post is never told who sent it
• Moderation records about you: what a moderator did about your posts or account (for example removing a post, a warning or a suspension), when, and the reason they gave, which is also emailed to you and shown on your forum notices page

We do not store your IP address, browser or device with anything you post. To stop spam, posting is limited per account and per IP address; the IP address is held only briefly by our rate limiter (Upstash) and is never linked to your posts. New accounts also pass a Cloudflare Turnstile check when they post during their first day.

9.2 Why (Legal Basis)

• Providing the service you signed up for (contract): publishing what you post under your username
• Legitimate interest: moderation (including handling reports and keeping a record of moderation decisions so they can be reviewed and appealed), keeping edit history for moderators, checking images for harmful content, and preventing spam and abuse
• Consent: the daily email digest, which is off until you turn it on and can be turned off on your forum notifications page at any time. In-app notifications and read marks are part of providing the forum (contract)

9.3 Who Processes It

Supabase (database and image storage), Vercel (hosting), Sightengine (an automatic check of each uploaded image for adult, violent or offensive content), Cloudflare (the Turnstile check) and Upstash (rate limiting). Moderation notices, the outcome of your reports and, if you turn it on, the daily notification digest are emailed through Resend. Besides BotCollector staff, trusted volunteer moderators from the community see posts waiting for approval, reports (without who sent them) and moderation records, to moderate the forum; they never see your email address. See Information Sharing.

9.4 How Long

• Posts, edit history and attached images: until you delete the post or your account
• Images you upload but never post: deleted automatically after one day
• Notifications: 90 days, then deleted automatically
• Follows, likes, read marks and your digest setting: until you change them or delete your account. A post's likes are also deleted when the post is deleted
• Reports and moderation records: one year after the report is resolved or the action taken. A report about a post that is then deleted goes with it, and a suspension is deleted when it ends

9.5 Your Rights in the Forum

• Rectification: edit your posts at any time
• Erasure: delete any of your posts at any time, even in a locked thread. Its text, images and edit history are erased and the thread shows "Post removed" in its place, so replies still make sense. Quotes of your posts are links to the post, not copies, so they disappear with it. When your account is deleted, every post you wrote is removed the same way and shows as from "Deleted user". Threads you started stay for the people who replied, without your name
• Access and portability: your data export includes your threads, your posts with their text, details of the images you attached, the reports you sent, moderation records about you, the threads you follow, the posts you liked, your notifications and your digest setting
• Objection and appeal: if you disagree with a moderation decision, reply to the notice email or write to privacy@botcollector.app and someone else will look again

When your account is deleted, your follows, likes, notifications, read marks and digest setting, the reports you sent, reports about your posts, moderation records about you and any suspension are deleted too. Decisions you made as a moderator stay in the record without your name, and notifications your posts caused for others no longer name you.

10. Cookies

We use cookies and similar technologies to operate our Service. For detailed information about the cookies we use and your choices, please see our Cookie Policy.

Key points:

• Essential cookies - Required for the site to function (authentication, security)
• Analytics cookies - Help us understand usage (requires consent)
• Advertising cookies - Enable personalized ads on free tier (requires consent)

You can manage your cookie preferences through the cookie settings link in our footer.

11. Children's Privacy

BotCollector is intended for users who are at least 13 years old. We do not knowingly collect personal information from children under 13.

During registration, users must confirm they are at least 13 years old. If we discover we have collected data from a child under 13, we will:

• Immediately suspend the account
• Attempt to notify the parent or guardian
• Delete all associated data within 48 hours

If you believe we have inadvertently collected data from a child under 13, please contact us immediately at privacy@botcollector.app.

12. Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit - All data transmitted over HTTPS with TLS 1.3
• Encryption at rest - Database and file storage encrypted
• Password security - Passwords hashed with bcrypt; we never store plaintext
• Access controls - Row-level security ensures you can only access your own data
• Regular monitoring - Automated security monitoring and logging
• Content moderation - Uploaded images are scanned for inappropriate content

While we strive to protect your data, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@botcollector.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last updated" date at the top
• We will notify you via email or a prominent notice on our Service
• For significant changes affecting your rights, we may request renewed consent

We encourage you to review this policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: