Privacy Policy

Collector HQ ("we", "us", "our") operates the website at collector-hq.com(the "Service"). This Privacy Policy explains what personal information we collect, how we use it, and your rights.

Information We Collect

Account information. When you create an account, we collect your email address and a securely hashed password. We never store your password in plain text.

eBay account data. If you connect your eBay account, we receive an OAuth access token and refresh token from eBay, which we store encrypted at rest. We also receive your eBay username when you grant the identity scope. We use these tokens to place bids, fetch listings, and import your watchlist on your behalf — only when you explicitly ask us to.

User content. We store the saved searches you create, the snipes you set up, the cards you mark as owned, your portfolio data, your global filter settings, and the folders you organize searches into.

Technical data. We log IP addresses, user agent strings, and basic request metadata to detect abuse, debug errors, and apply rate limits. This data is retained for a limited period and is never sold.

Usage analytics. We collect basic, first-party usage data: the pages you visit on the Service, when you visit them, the page that referred you, and a random identifier stored in a cookie (see below). If you're signed in, this data is associated with your account so we can understand how features are used. We host this data ourselves — no third-party analytics services, no advertising trackers, and no tracking of your activity on other websites.

Cookies.We use essential cookies for authentication (so you stay signed in) and CSRF protection, plus one first-party analytics cookie ("chq_vid") — a random identifier, kept for up to one year, that lets us count unique visitors. It contains no personal information and is never shared with or read by third parties. We use Cloudflare Turnstile on sign-in and sign-up forms to prevent abuse — Turnstile does not track users across the web.

How We Use Your Information

We use your information to:

• Operate and maintain the Service.
• Place bids on eBay on your behalf when you've scheduled a snipe.
• Send transactional emails (account verification, password reset, snipe outcomes).
• Detect and prevent abuse, fraud, and security incidents.
• Improve the Service based on aggregate usage patterns.

We do not sell your personal information. We do not use your data to train AI models.

How We Share Your Information

We share data only with the service providers needed to operate the Service:

• Supabase— database, authentication, and storage. Stores your account, hashed password, profile, and saved content.
• Vercel— web hosting. Serves the website and runs our application code.
• Upstash QStash — receives snipe identifiers so bids fire at their scheduled times. Does not receive credentials.
• eBay— receives the bids we place on your behalf, using the access token you authorized.
• Cloudflare — Turnstile (abuse prevention), DNS, and content delivery.

Each of these processors operates under its own privacy policy and is contractually required to handle your data securely.

Data Retention

• Account data is retained while your account is active and for a short grace period after deletion.
• eBay tokens are deleted immediately when you disconnect your eBay account or delete your Collector HQ account.
• Snipe results and audit logs are retained for compliance and abuse-prevention purposes.
• Usage analytics are automatically disassociated from your account when you delete it — any remaining records are anonymous.

You can request deletion of your account at any time by emailing support@collector-hq.com. We aim to fulfill deletion requests within 30 days.

Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information ("right to be forgotten").
• Object to or restrict certain processing of your data.
• Receive your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@collector-hq.com.

Security

We use industry-standard encryption (TLS in transit, at-rest encryption where supported by our providers), least-privilege access controls, and regular security reviews. No system is perfectly secure, but we work to protect your data and will notify you in the unlikely event of a breach affecting your information, as required by law.

Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, please contact us and we will delete the data.

International Users

The Service is operated from the United States. By using the Service, you consent to the transfer and processing of your data in the United States.

Affiliate Disclosure

We participate in affiliate programs (including the eBay Partner Network). We may earn a commission when you click certain outbound links and make a qualifying purchase. We never affiliate-tag links involved in automated bidding (snipes).

Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the new version here with an updated "Last updated" date. Material changes will also be communicated by email or in-app notice.

Contact

Questions or requests: support@collector-hq.com