Privacy Policy

The Collectibles — the website thecollectibles.io and The Collectibles app for iOS and Android ("the app") — is operated by Horde Inc., a Delaware corporation with its registered address at 2810 N Church St, STE 90840, City of Wilmington, County of New Castle, Delaware 19802, United States ("we", "us", "our"). Horde Inc. is the data controller for the personal data described in this policy.

Contact us about anything in this policy at support@thecollectibles.io.

This policy covers the website, the app and everything they connect to: your account and balance, packs, the vault, selling and shipping, the Marketplace, Live, the community features of the app (posts, comments and direct messages), the card scanner, the waitlist, promotions, the Partner programme and the Vendor programme. The website and the app share one account and one set of records.

Websites of payment providers, carriers, app stores, social networks or our fulfilment partner that you reach through links have their own policies.

Waitlist

Before the website opened to the public on 9 October 2026, visitors could join a waitlist; it takes no new sign-ups. For each entry we keep the first name, e-mail address, country and browser language given when joining, the invite code that brought the person, if any, when the address was confirmed and when the person unsubscribed.

Account

Your e-mail address and a password, which we store only as a salted cryptographic hash. If you sign in with Google, the identity Google passes to us: an identifier for your Google account, your e-mail address, your name, a link to your Google profile picture and the other basic profile details Google returns. Your username, which other users can see. If you turn on two-factor authentication, we keep the secret that links your authenticator app to your account. We also record the country your IP address resolves to when you register, your display currency and your notification preferences. In the app you can add a display name, a short bio, links and a profile picture, and make your profile private.

On the website you confirm at registration that you are at least 18 years old. The app asks for your date of birth when you sign up, and we may ask for it before you add money, buy or open a pack; section 4 explains how we use and keep it.

Sign-ins and sessions

Each time you sign in, we record the IP address, the country it resolves to and the browser or device you used. In the app this includes the app's random device identifier, the phone's platform and operating system version, and the app version.

Purchases, balance and withdrawals

Deposits, pack purchases, Marketplace orders, sales, shipping charges, free packs, rewards and promotion codes, and the resulting balance, including which part of it can be withdrawn. Card, Apple Pay, Google Pay and the other payment methods offered when you pay are handled by our payment partner, in its own payment form or through your phone's wallet. For each deposit we keep our payment partner's payment reference, our own reference, the amount and the payment method; we never receive or keep your card number.

Withdrawals run on our payout partner's own pages: it verifies your identity and holds your bank or card details. We keep a token that identifies the payout destination, its type, the last four digits and the bank or card brand our payout partner shows us, and the amount, fee, speed, expected arrival and status of each withdrawal. We never receive your identity documents. If we ever ask you to verify your identity ourselves (Terms of Service, section 4), we will tell you first who checks it and what they receive.

Packs, the vault and sales

Which packs you opened and the item each one revealed, the items in your vault with their certification number where they have one, the value shown for each item, every sale you make or that happens automatically under the Terms of Service and its price, and your shipments.

Shipping details

When you ship an item from the vault or buy from the Marketplace: the recipient's full name and delivery address and, where you give them, a phone number and an e-mail address for the carrier, plus the tracking number and the delivery status the carrier returns. You can save addresses in your address book.

Marketplace orders

The order number, the items, the prices and shipping charge, the delivery address, the payment, the order's status, and the seller of record (the shop's legal name, registered address and VAT number where it has one).

Live

If you watch streams: the channels you follow, the messages you write in a channel's chat room, the channels you report and why, and the packs you buy from a stream page, including whether you chose to open one on the creator's stage. If you are a creator: your application message, your channel's name, title, bio and game, your stream key (which we store only as a hash), the times you go live and offline, viewer counts, the recordings of your streams, the packs bought from your page and the revenue share calculated from them, and the sign-ups that come through your link.

Community in the app

Posts and captions, the photos and clips you attach, comments, likes and reactions, the collectors you follow and block, the reports you file, the feedback you send, and your notifications. Posts and profile details are visible to other users; if you make your profile private, only your followers see your posts.

Photos and videos you attach are uploaded as your phone stores them, including the information embedded in the file — such as the date, the device and, if location tagging is on in your camera, where it was taken. People who can see the post may be able to read that information; turn location tagging off in your camera settings if you do not want to share it.

Direct messages you exchange with other collectors, including the cards and collections you attach, are stored on our servers. They are not end-to-end encrypted: staff with access to our moderation tools can read them, and do so to act on reports and keep the service safe.

Portfolio and collections

The cards you add to your portfolio, with their condition, grade, quantity and value and, if you enter it, the price you paid, and the collections you sort them into. Items in your vault appear in your portfolio automatically.

Scanner

Each scan in the app is recorded as data: the text lines the on-device reader extracted and where they sat on the card, the identifiers it found (such as name, set, number, language, and a grading company, grade and certification number for a graded card), which game the app decided it was, the candidate cards and how confident the match was, whether the scan came from the camera or from a photo you chose, timing and image-quality measurements, the app version and platform, and what you decided afterwards (kept, dismissed, corrected or reported). A scan is linked to your account when you are signed in, and to the app's device identifier when you are not. For a scan that found nothing, was uncertain or failed, or whose result you dismissed, corrected or reported, the app also uploads the picture of the scan, whether or not you are signed in (see section 5).

Partner programme

If you apply: your name, your country, the social media handles you give us and the campaign or invite code that brought you to the application. If you are accepted: the Partner Agreement you sign (the full name you type, the version you signed, the time, your IP address and your browser or device), the address and phone number you give for the welcome kit, the links to the posts you submit for missions, and the rewards you earn.

Vendor programme

If you apply to sell on the Marketplace: your shop name and country, and then the business verification form: legal and trading name, registration and VAT numbers, registered and ship-from addresses, a contact name, e-mail address and phone number, the name and date of birth of the beneficial owner, and the documents you upload (a company extract, the contact person's identity document and, where you give a VAT number, a VAT certificate). Your shop page shows your legal name, city and country, and every order a buyer places with you shows your legal name, full registered address and VAT number. If you trade as a sole trader, that may be your home address. We also keep your listings, orders, shipping updates and your ledger of sales, commission and settlements.

Promotions

The free packs you claim, the missions you complete, who invited whom through invite links and codes, and the rewards granted.

Support

The content of any message you send us by e-mail, in the website's support chat or with the app's Send feedback form, including attachments and screenshots, and our replies. When you are signed in to the website, the support chat is linked to your account (section 7).

Device and technical data

Your IP address and the country it resolves to (our hosting provider's load balancer tells us the country), your browser or device type, operating system, language, the app version, and the pages and addresses you request and when. Our servers keep request logs for security and fault-finding; the text you write (messages, captions, comments, bios, notes, scan text) and personal fields such as names, addresses and phone numbers are masked in those logs.

In the app, a random identifier is generated on first launch and kept in your phone's secure storage (the iOS Keychain, set to this device only, or Keystore-protected storage on Android, which is excluded from backups). It identifies your device to us for sessions and for scans made while signed out. On Android it is removed when you uninstall the app; on iPhone it can stay in the Keychain after you delete the app, so a reinstall may reuse it. The app's requests also tell us its name, platform and version.

Marketing source

If you arrive through a link that carries a source code, an invite code or campaign parameters, the website keeps them in your browser and attaches them to your account when you sign up, or to your Partner or Vendor application, so we know which campaign or friend brought you.

Usage measurement, crash reports and install attribution

When measurement is on (section 8), Google Analytics records how the website and the app are used: the pages or screens you open and when — the app sends a screen as a pattern, without the name or number of the profile or item shown on it — and actions such as signing up, signing in or out (and by which method), going through the app's introduction screens and its sign-up prompts, viewing or opening a pack, viewing a card or adding it to a collection (with the card's catalogue number, value and currency), scanning (that a scan was made, from the camera or a picture, in which mode, how many cards were read and found, the catalogue number of a card that was identified and how confident the match was; never the picture or the text that was read), searching (the number of characters you typed and the number of results, never the text), sharing, watching a Live channel (the channel's public name), confirming your age, starting a deposit or a checkout, asking for a shipment, applying to a programme and deleting your account. Google Analytics adds its own records of a first visit or first opening, sessions, time spent, app and system updates and, on Android, removal of the app. With these it receives technical data — your browser or device model, operating system, screen size, language, the app version and the approximate place (country, region and city) that your IP address resolves to; Google Analytics does not store the IP address — the page that linked to us and any campaign tags in the link, a random identifier for your browser (kept in a cookie) or for your installation of the app and, when you are signed in, the internal number of your account, so that your use of the website and of the app counts as one. On the website, page addresses are sent without their query string, apart from campaign tags.

While measurement is on, the browser or app you are signed in with tells our servers its Analytics identifier, and we keep the latest one for the website and for the app with your account. Our servers use it to add to the same measurement what a browser or app cannot report reliably: a completed purchase, deposit, sale, withdrawal or refund, with its amount, currency, our reference for it and the pack or product concerned. An action you took in a browser or in the app is added to that browser's or app's measurement; one we complete for you, such as the automatic sale of a card or a refund, is added to the measurement that reported to us most recently. When you decline, switch measurement off or sign out, we delete the identifier of that browser or app and our servers add nothing more for it.

We never send Google Analytics your name, e-mail address, delivery address, phone number or payment details, the text of your searches, posts or messages, your pictures or your precise location. Advertising features are switched off: no advertising identifier is collected, and the data is not used to build advertising profiles or to show you advertisements.

When the app crashes or hits a serious error, Firebase Crashlytics sends us a report: the error message and where in the app's code it happened, the time, the device model, operating system and app version, the free memory and storage, whether the device is rooted or jailbroken, and random identifiers for the installation and the session. A crash report is not labelled with your account; in rare cases an error message can quote a piece of the data the app was handling at that moment.

On Android, when measurement is on, the app uses AppsFlyer to tell us which link, campaign or store page an installation came from. AppsFlyer receives the referrer that Google Play passes to the app (the link that was followed and when, when the installation began, and which store or app installed it), its own random identifier for the installation and, when you are signed in, the internal number of your account. It also receives details of the device and the app — brand, model and build, operating system version, processor type, screen size, language and country setting, free storage, battery level and whether the device is charging, when the device was last started, the connection type and the mobile network's country and operator codes, the app version and when and how often it was installed and opened — your IP address, and the same actions the app reports to Google Analytics. To tell a real phone from an automated one, each time the app is opened it also reads the phone's motion sensors (accelerometer, compass and gyroscope) at two moments, and it asks Google Play for an integrity check of the device and the app. It does not read the advertising identifier, the Android ID or any other identifier of the device itself, and it is set not to pass this data on to advertising networks.

On your phone

The app keeps your session tokens and its device identifier in your phone's secure storage, and keeps copies of your portfolio, collections, recent card searches (up to the last 100), recently matched scans and its settings on the phone so it works quickly and offline. Scan pictures waiting to be uploaded are kept on the phone for at most seven days.

We ask for your date of birth only to confirm that you are 18 or older, as the Terms of Service require. It is stored once, apart from your profile, and cannot be changed in the service; nobody else sees it, our staff tools show only whether your age has been confirmed, and it is masked in our server logs. We do not use it for marketing or measurement and do not share it. It is removed when you delete your account (section 11), apart from the 14-day backup window in section 10. Legal basis: performance of our contract with you, since the service is open only to adults, and our legitimate interest in keeping it so.

Camera. The app uses the camera to scan cards, to read another collector's profile QR code, and to take the photos and clips you add to posts and the picture for your profile. Card recognition reads the card on your phone: the camera frames are read by on-device models (Google ML Kit text recognition and object detection, and a small model of our own), and the text read is then looked up in our card database and, for some games and searches, in the public card catalogues named in section 7.

Camera frames are not stored or uploaded, with one exception: when a scan finds nothing, is uncertain or fails, or when you dismiss, correct or report the result, the app uploads one JPEG picture of that scan (at most 1,280 pixels on its longer side and 3 MB) so we can study why recognition missed. It is cropped around the card when the app found one in the frame; otherwise it is the whole camera frame, or the whole photo you chose, so anything else in view — your hand, the table, the room — can be in it. This happens whether or not you are signed in. If you are offline, the picture waits on your phone for up to seven days and is then discarded. A plain accepted match never uploads a picture.

Uploaded scan pictures are stored in a private storage bucket in the European Union that is never publicly readable, and only staff with access to our admin tools can view them.

Photo library. The app opens only the photos you choose in your phone's picker: a photo of a card to identify, a picture for a post or for your profile. It can also save the share pictures you make to your library; iPhone and Android 10 or older ask for your permission first. It does not browse or index your library.

Microphone. On iPhone, the microphone is used only while you record a video clip for a post with the camera. On Android, clips are recorded by your phone's own camera app.

Motion sensors. The gyroscope is used to tilt cards and packs on screen as you move the phone; nothing from that leaves your phone. On Android, when measurement is on, AppsFlyer also reads the motion sensors (accelerometer, compass and gyroscope) briefly each time the app is opened, to tell a real phone from an automated one, and receives those readings (section 3).

Notifications. If you allow them, the app reminds you when your daily free pack is ready. The reminder is scheduled on your phone; nothing about it is sent to us, and the app has no push service.

The app does not access your location, your contacts or your advertising identifier. You can withdraw any of these permissions at any time in your phone's settings; the related feature then stops working and nothing else changes.

Where the EU or UK General Data Protection Regulation applies to you, we rely on the legal bases below; for everyone else, these are the purposes for which we use your data.

• Keeping the waitlist entries made before launch and writing to the people on the list — waitlist details — consent, which you can withdraw at any time with the unsubscribe link.

• Creating and running your account, selling and opening packs, keeping your vault and portfolio, paying sales and withdrawals, running the Marketplace, Live and the community features — account, purchase, opening, item, order and content data — performance of our contract with you.

• Confirming that you are 18 or older — date of birth — performance of our contract with you and our legitimate interest in keeping the service for adults (section 4).

• Shipping items to you — shipping details — performance of our contract.

• Recognising cards and improving recognition — scan records and the pictures of missed scans — our legitimate interest in making the app's core feature work. You can object to the upload, or ask us to delete your pictures, at any time by writing to support@thecollectibles.io.

• Delivering what you post, stream or send, and keeping the community safe: acting on reports, removing content, blocking and suspending accounts — content, reports, blocks, chat and moderation records — performance of our contract and our legitimate interest in a safe service.

• Running the Partner and Vendor programmes — application, agreement, kit, submission, business verification, listing and ledger data — performance of our contract with you, and legal obligation for business verification and invoicing.

• Preventing fraud, payment abuse and multiple accounts, and keeping the service secure — technical data, sign-in records, purchase data, device identifiers — our legitimate interest in running a safe service, and legal obligation where anti-money-laundering or sanctions law applies.

• Measuring which campaign or friend brought you to us and paying referral rewards — marketing source, invite codes — our legitimate interest, and performance of our contract for rewards you earn.

• Measuring how the website and the app are used, finding crashes and learning which links and campaigns bring people to the app, so that we can fix and improve the service — usage measurement data, crash reports and install attribution data — your consent where we ask for it (section 8); elsewhere our legitimate interest in understanding and improving the service, which you can object to at any time by switching measurement off.

• Sending service e-mails about your orders, shipments, sales, free packs, rewards, streams you follow and your account — account data — performance of our contract. You can turn off notification e-mails in your settings or with the unsubscribe link they carry; receipts and sign-in codes are always sent.

• Sending marketing e-mails — e-mail address — consent, or our legitimate interest in writing to existing customers about similar products, always with an unsubscribe link.

• Keeping accounting records — purchase, sale, order and ledger data — legal obligation.

• Running the website's support chat, answering you in it and showing our support team whether you are signed in and which account is writing — chat messages, internal account number, e-mail address, username, account creation date, sign-in state, country, language and technical data — performance of our contract with you and our legitimate interest in answering support requests.

• Answering your requests and defending legal claims — any relevant data — legal obligation and legitimate interest.

We do not sell personal data and we do not share it with advertisers. Data leaves our systems only where the service needs it:

• Other users. Your username and profile are visible to other users. Anything you post, say in a chat room, open on a creator's stage or send in a direct message is visible to the people it is addressed to. A creator's replays are visible to anyone who can open the creator's page.

• Our fulfilment partner Phygitals, Inc. (United States) and the vault operators it works with (Alt, PSA and Fanatics). They hold the physical items and ship them. Phygitals receives an internal identifier for your account with each pack you buy and, when you ship an item, the recipient's name, delivery address and the phone number and e-mail address you gave for the delivery.

• Carriers, which receive the delivery details from our fulfilment partner or from a Marketplace shop.

• Marketplace shops. When you buy from a shop, it receives your username and the order's delivery details: the recipient's name, delivery address and phone number. An outside shop is the seller of record and handles that data under its own responsibility.

• Our payment partner, which processes deposits by card, Apple Pay, Google Pay and the other methods offered when you pay. It receives an identifier for your account and our reference for the deposit, the amount, the payment and contact details you enter in its form or the payment token from your phone's wallet, your device's IP address and, with some payment partners, your e-mail address. Its fraud-prevention script runs on our website's pages once you open the payment form, and with some payment partners on every page while you are signed in; it collects device and browser signals so that a payment can be screened.

• Our payout partner, which pays out withdrawals. It receives an identifier for your account, the amount, speed and destination of each withdrawal, and the identity and bank or card details you give it on its own pages.

• Google — Google Cloud hosts our servers, databases, file storage, request logs and internal reporting data; Google Sign-In if you use it; Google Pay if you pay with it. The app's on-device card reader (Google ML Kit) sends Google technical data about its own performance, such as device model, app version, a per-installation identifier and error codes, and never camera pictures or what it read. Google Analytics and Firebase Crashlytics receive the usage measurement data and crash reports described in section 3 and process them for us; we have switched off the settings that let Google use that data for its own products or for advertising.

• Apple — Apple Pay if you pay with it.

• Amazon Web Services — Amazon Interactive Video Service carries creators' live streams and records them, and Amazon CloudFront delivers the recordings as replays.

• AppsFlyer Ltd. (Israel), which tells us where installations of the Android app came from and receives the install attribution data described in section 3. It processes that data for us.

• Mailgun, which delivers our e-mails from its EU region.

• Intercom, Inc. (United States), which runs the website's support chat. The chat loads on every page of the website, whether or not you open it, so Intercom receives whether you are signed in, your country and language, the address of the page you are on, your browser and device, and your IP address, from which it works out an approximate location. When you are signed in, it also receives the internal number of your account, your e-mail address, your username and when your account was created. When you write to us in the chat, it receives what you write or attach and our replies. It processes this data for us.

• Vercel, Inc. (United States), which hosts app.thecollectibles.io, the address our share links and profile QR codes use, and passes those requests to our servers; it sees the IP address of anyone who opens such a link.

• Public card catalogues. When you search for a card, or the scanner looks one up, the app also queries public card catalogues directly from your phone for some games and searches — api.pokemontcg.io, api.scryfall.com, db.ygoprodeck.com, api.tcgdex.net, tcgcsv.com and api.lorcana-api.com — sending the search text, such as a card name, set or number. They see that text and your IP address and handle them under their own terms; they receive no account details. Card images and set symbols load from our own storage and, where we have not copied them, from the catalogue that supplied them (for example images.pokemontcg.io, images.scrydex.com, svgs.scryfall.io or tcgplayer-cdn.tcgplayer.com), which see your IP address as any image request does.

• Professional advisers, and authorities or courts where the law requires it. If our business is sold or reorganised, data may transfer to the acquiring business under the same protections.

Our service providers — Google (Google Cloud, Google Analytics and Firebase), Amazon Web Services, AppsFlyer, Intercom, Mailgun and Vercel — process personal data only to provide their service to us, under terms that require them to protect it to at least the standard of this policy. Phygitals, our payment and payout partners and the carriers receive what they need for their part of an order or payment, under their arrangements with us and their own privacy policies. Outside Marketplace shops and the public card catalogues receive only what the feature you use needs and handle it under their own terms.

We use one first-party cookie to keep you signed in. It is essential, cannot be switched off and lasts up to 30 days.

The website also stores small values in your browser's local storage and session storage: your marketing source, invite or campaign code, the waitlist details entered or confirmed in that browser, the type of client you use (browser or app wrapper), your recent searches, pack and sound preferences, interface settings, drafts, and your choice about usage measurement. They stay on your device.

Usage measurement on the website. If you visit from the European Economic Area, the United Kingdom or Switzerland, the website asks before it measures anything: nothing is loaded from Google Analytics and no Analytics cookie is set unless you choose Accept, and the website works the same if you choose Decline. Elsewhere measurement is on unless you switch it off. Wherever you are, the Cookie settings link in the website's footer lets you change your choice at any time, and a browser that sends the Global Privacy Control signal is treated as having declined. When measurement is on, Google Analytics sets two first-party cookies, _ga and _ga_K3M6TSGQLY, which hold the random identifier described in section 3 and last 12 months; switching measurement off deletes them. Where we asked for your choice, we ask again after 12 months.

Usage measurement in the app. The first time you open the app in the European Economic Area, the United Kingdom or Switzerland, it asks whether you want to share how you use the app, its crash reports and the link that brought you here, and sends nothing to Google Analytics, Firebase Crashlytics or AppsFlyer unless you agree. Elsewhere they are on unless you switch them off. You can change this at any time under Settings → Usage data or, when you are not signed in, with the Usage data link on the sign-in page; switching it off stops all three on that device. You can also ask AppsFlyer directly to stop measuring your device at appsflyer.com/legal/opt-out.

Support chat. The website loads Intercom's support chat on every page as part of the service, not as measurement, so your choice about usage measurement does not switch it off. Intercom sets three first-party cookies: intercom-id-jv1r61r8, a random visitor identifier, which lasts 9 months from your last visit; intercom-session-jv1r61r8, which keeps your conversation open from page to page and lasts one week; and intercom-device-id-jv1r61r8, which identifies your device to protect the chat from abuse and lasts 270 days from your last visit. When you sign out, the website ends the chat session and starts a new one without your account. The website also keeps in local storage the number of the account the chat was last started for, so that your chat session ends as well when a visit starts without that account.

Our payment partner's fraud-prevention script runs on our pages once you open the payment form, and with some payment partners on every page while you are signed in (section 7); it may set its own cookies or storage under its own policies. Apart from that script, Google Analytics and the support chat as described in this section, the website loads no advertising or tracking tools.

You can block or delete cookies and stored values in your browser settings; the site will still work, but you will need to sign in again.

Our servers, databases and file storage run in Google Cloud data centres in the European Union, in the Netherlands and Belgium, and our internal reporting data in Finland. Live streams and recordings are handled by Amazon Web Services in Germany. Mailgun handles our e-mail in its EU region. Pictures, pages and replays are delivered worldwide through Google's and Amazon's content delivery networks.

Our fulfilment partner and its vaults are in the United States, Vercel is a United States company, and our payment and payout partners and some of the other services named in section 7 may process data outside the European Economic Area. When the app queries the public card catalogues, your IP address and the search text go directly from your phone to those services, some of them outside the European Economic Area; no contract with us covers these lookups. Usage measurement data and crash reports (section 3) are processed by Google in the United States and in its other data centres; Google LLC is certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework. AppsFlyer is established in Israel, which the European Commission recognises as providing adequate protection, and may process install attribution data in other countries under the EU Standard Contractual Clauses. Intercom processes the support chat in the United States; Intercom, Inc. is certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework. For transfers from the European Economic Area and the United Kingdom to our service providers we rely on the EU Standard Contractual Clauses (with the UK Addendum) or, where the provider is certified, the EU–US Data Privacy Framework.

• Waitlist details: kept until you ask us to remove them; unsubscribing stops our e-mails and marks the entry as unsubscribed.

• Account and profile: until you delete your account. Deletion immediately replaces your e-mail address, username and login name with a random placeholder, removes your password and two-factor secret, ends every session and clears your app profile; see section 11.

• Date of birth: until you delete your account (section 4).

• Sign-in records: kept without a fixed end date, including after the account is deleted.

• Purchase, balance, sale, order, withdrawal and shipping records, and vendor ledgers: for at least 7 years, to meet tax and accounting record-keeping rules and to deal with chargebacks, fraud and legal claims. Our systems do not delete them automatically after that.

• Pack opening and vault records: kept with the purchase records.

• Saved delivery addresses: until you delete them; deleting your account does not remove them.

• Scan records: kept without a fixed end date. They are linked to your account, and scans made while signed out to your device identifier; deleting your account removes your sign-in details and profile but leaves the scan records and their device identifier in place.

• Uploaded scan pictures: we keep them until we delete them; you can ask us to delete yours at any time.

• Portfolio, collections, likes, reactions, follows and notifications: until you delete them; after account deletion, kept without a fixed end date with the closed account.

• Posts, comments, direct messages and chat-room messages: until you delete them. A post, comment or message you delete is hidden at once; we keep a hidden copy without a fixed end date, including after the account is deleted, so that a report about it can still be investigated. The photo and video files of a deleted or hidden post are not deleted, and stay reachable by anyone who already has their web address.

• Profile pictures: when you change or remove your picture, the earlier picture file is not deleted. When you delete your account, the current picture file is deleted.

• Live recordings: deleted automatically after the retention period set with our video provider (90 days unless we set another period), or earlier if we remove them.

• Reports, blocks and moderation decisions: kept without a fixed end date, including after the accounts involved are deleted, so that repeated abuse can be recognised.

• Partner applications, agreements, kit orders and mission submissions; vendor applications, verification forms and documents: kept without a fixed end date, and at least for as long as the relationship lasts and the period the law requires afterwards (7 years for invoicing and tax records).

• Support correspondence: until you ask us to delete it, unless we need it for a legal claim.

• Support chat: the conversations, and the account details sent with them, are kept in Intercom until you ask us to delete them, unless we need them for a legal claim; deleting your account does not delete them by itself. Intercom deletes the record of a visitor who never signed in and never wrote in the chat once it has not been seen for 9 months.

• Server request logs: deleted automatically by our hosting provider's logging service after its retention period (30 days by default).

• Usage measurement data: Google Analytics keeps the records of individual visits and actions for 14 months and then deletes them automatically; totals that no longer point to a browser, an installation or an account are kept without a fixed end date. The Analytics identifier we keep with your account is replaced whenever your browser or app reports a new one, and is deleted when you switch measurement off, sign out or delete your account.

• Crash reports: deleted automatically by Firebase Crashlytics after 90 days.

• Install attribution data: kept by AppsFlyer for up to 24 months.

• Backups: our production database can be restored to any moment in the previous 14 days, so a record we change or delete stays in that recovery window for up to 14 days. A file we delete, such as a profile picture, can be recovered for 7 days and is then gone.

You can delete your account in the app (open your profile, tap the gear icon, then Account → Your data → Delete account) or by writing to support@thecollectibles.io. The full process, what has to happen first and what is kept afterwards is set out on the account deletion page at thecollectibles.io/account-deletion.

Deletion is refused while there is money on your account — your balance, including any amount credited to you but not yet claimed — or while a withdrawal is pending. Withdrawals are not being paid out yet, so spend what is left first. Items in your vault do not stop the deletion, but every item still in the vault is sold for you at its Sell price at that moment, four days after its pack was bought or after it came back to the vault, and the proceeds go to the closed account, where we cannot pay them out to you; ship or sell your items first.

If you are in the European Economic Area or the United Kingdom you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it (including processing based on our legitimate interests), to receive it in a portable format, and to withdraw any consent you gave. There is no self-service export: write to support@thecollectibles.io from the e-mail address on your account and we send you a copy. We answer within one month and may ask you to confirm your identity first.

Some data cannot be erased on request: transaction records we must keep by law, records of items you still hold in the vault, and messages other users have received (a message you sent stays in the other person's conversation).

If you are in the European Economic Area or the United Kingdom you may complain to the supervisory authority of your own country. If you are in the United States you may contact the Federal Trade Commission or your state attorney general.

If you live in California, you have the right to know what personal information we collect and how we use and share it, to have it deleted, to have it corrected, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising. In the last 12 months we collected the categories of personal information described in section 3 — identifiers (such as e-mail address, username, device identifier and IP address), customer records (name, delivery address, phone number), commercial information (purchases, openings, sales and orders), internet activity (request logs, in-app actions, and the usage measurement, crash and install attribution data described in section 3), approximate location from your IP address, the date of birth you give us, photos, videos and scan pictures and, for vendors, professional information and identity documents — from you, your device and the providers in section 7, for the purposes in section 6. We keep each category for the period in section 10 and disclosed them for business purposes to the recipients in section 7. Your account login details and a vendor's identity documents are sensitive personal information; we use them only to provide the service, keep it secure and meet legal obligations, and not to infer anything about you. To make a request, write to support@thecollectibles.io from the e-mail address on your account; we verify it by matching it to your account. An authorised agent may make a request for you with your signed permission. Residents of other US states with privacy laws have similar rights; use the same address.

The service is for adults. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we suspend the account and remove the data, subject to the retention rules above. If you believe a minor has an account, tell us at support@thecollectibles.io.

Data is encrypted in transit. Passwords are stored as salted hashes. Session tokens in the app are held in your phone's secure storage. Card details are entered only in your phone's wallet or in our payment partner's own payment form; we never receive card numbers. Scan pictures and vendor documents are kept in private storage that is never publicly readable. Staff access to our production systems and moderation tools is restricted by role, and request logs mask the text you write and your personal details.

If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant supervisory authority without undue delay, and within 72 hours of becoming aware where the GDPR requires it.

Some decisions are made automatically: deposits are limited per payment and per rolling 24 hours, with lower limits for accounts younger than seven days; our payment partner's fraud screening may decline a payment; and referral rewards are counted by automatic rules (section 18 of the Terms of Service). Decisions that significantly affect you — suspending your account, refusing a withdrawal or removing a reward — are made by a member of staff, and you can contest them by writing to support@thecollectibles.io.

The app is distributed through the Apple App Store and Google Play. Apple and Google are not responsible for this policy or for how we handle your data. The app uses no advertising identifier, and we do not follow what you do in other companies' apps or websites. On Android, AppsFlyer links an installation of the app to the link or campaign that led to it (section 3). Usage measurement and crash reports are not used to show you advertising. On iPhone, the camera, microphone, photos and motion permissions are controlled in the Settings app; on Android, the system's permission prompts control the camera and notifications and, on Android 10 or older, saving pictures to your library; photos are chosen in Android's own photo picker, which needs no permission.

We will announce material changes by e-mail, in the app or on the website before they take effect, and the date at the top will change.

Horde Inc., 2810 N Church St, STE 90840, City of Wilmington, County of New Castle, Delaware 19802, United States.

Website: thecollectibles.io.

Privacy questions and data requests: support@thecollectibles.io.