Privacy Policy

1. Scope and Relationship to the Terms

This Policy applies to ColLock websites, applications, accounts, communications, support channels, advertising-supported features, and integrations that link to this Policy. It does not govern a third party's independent practices. The Terms of Service govern use of the Services and incorporate this Policy by reference.

ColLock is the business or controller responsible for personal information described in this Policy unless another notice states otherwise.

Capitalized terms used but not defined in this Policy (including "Services," "Account," "Content," and "Terms") have the meaning given to them in the Terms of Service.

2. Information We Collect

We collect information you provide, information generated through use of the Services, information received from integrations and service providers, and information collected automatically. The precise information depends on the features you use, and generally falls into these categories:

Account and identifiers (email address, username, Account ID, profile details, age or eligibility confirmation) -- collected from you, used for account creation, authentication, support, and communications.

Authentication and security (password hash, multifactor status, login history, fraud signals) -- collected from you, your devices, and security providers, used for security and abuse prevention.

Collection and inventory data (cards, sets, teams, players, quantities, ownership status, grades, values, wish lists, checklists) -- collected from you and through imports and integrations, used to provide features, search, matching, analytics, and rankings.

Content and communications (photos and metadata, listings, profile content, messages, reports, support communications) -- collected from you and other users, used to display content, enable messaging, moderation, and support.

Transactions and subscriptions (plan, billing status, payment token, transaction identifiers, chargebacks, subscription history) -- collected from you, Stripe, or app stores, used for billing, accounting, fraud prevention, and customer service.

Device and network data (IP address, browser, operating system, device identifiers, cookie IDs, approximate location derived from IP, crash and error diagnostic data such as stack traces) -- collected from your browser, device, cookies, and SDKs, including crash-reporting tools like Sentry, used for authentication, analytics, security, localization, advertising, and identifying and fixing technical problems.

Usage and analytics data (pages and features used, clicks, searches, session duration, referral information, performance logs) -- collected through your use and tools like Google Analytics, used to operate, measure, debug, improve, and personalize the Services.

Advertising data (ad impressions, clicks, cookie or advertising identifiers, consent and opt-out status) -- collected by Google AdSense (on the ColLock website), Google AdMob (within the ColLock mobile app), and advertising partners, used to serve, measure, limit, and personalize ads as permitted. On iOS, ad personalization within the mobile app is additionally gated by your App Tracking Transparency permission choice.

Integration data (OAuth tokens, linked-account identifiers, imported records, provider responses) -- collected from PSA, Dropbox, OneDrive, or other linked services you actively connect, used to enable requested integrations and synchronize data. An eBay integration is planned but not yet active; no information is currently exchanged with eBay.

Legal and compliance data (privacy requests, consents, legal notices, disputes, records necessary for compliance) -- collected from you, authorities, and internal records, used for compliance, claims, enforcement, and audit.

3. How We Use Information

We use information to create and administer Accounts; provide collection, checklist, messaging, trade-finder, search, storage, subscription, and integration features; authenticate users; process subscriptions; communicate about the Services; provide support; personalize experiences; maintain and improve databases; perform analytics and research; prevent fraud, abuse, security incidents, and unlawful activity; moderate Content; enforce agreements; comply with law; protect rights and safety; and establish, exercise, or defend legal claims.

We may create and use aggregated or de-identified information for any lawful purpose. We maintain measures intended to prevent such information from reasonably identifying an individual and do not attempt to re-identify it except to test de-identification or as permitted by law.

We use Collection Data to provide collection-management features and to create analytics, statistics, rankings, recommendations, trends, benchmarks, and other insights. Collection Data may include which cards or collectibles a user owns, quantities owned, card condition, grade, grading company, ownership status, reported or estimated value, wish-list status, acquisition or disposition activity, and related information.

4. Legal Bases for Processing Where Applicable

Where a law requires a legal basis, we process information as necessary to perform a contract with you; pursue legitimate interests such as operating, securing, improving, and protecting the Services; comply with legal obligations; protect vital interests; or based on consent. You may withdraw consent where processing depends on consent, without affecting prior lawful processing.

5. How We Disclose Information

We may disclose information to hosting, cloud, security, analytics, customer-support, communications, payment, advertising, fraud-prevention, professional-adviser, and other service providers that process information for business purposes; to integration providers you direct us to connect; to other users as necessary for public profiles, messaging, listings, or transactions; to authorities or third parties when reasonably necessary for law, safety, enforcement, or claims; and in connection with a merger, financing, acquisition, bankruptcy, reorganization, sale of assets, or similar transaction.

We do not disclose the contents of private messages to other users except the intended participants, but authorized personnel and service providers may access or process messages when necessary for delivery, security, abuse detection, support, legal compliance, or investigation.

6. Advertising, Cookies, and Similar Technologies

ColLock may use cookies, local storage, pixels, software development kits, and similar technologies for authentication, preferences, security, analytics, performance, and advertising. On the ColLock website, ColLock has integrated Google AdSense's advertising technology, including a site-verification script that loads on ColLock pages; free-tier or designated users may see advertisements served through Google AdSense or other partners as those ad placements are activated. Within the ColLock mobile app, ColLock instead uses Google AdMob (a separate Google product built for mobile apps) to serve any advertisements; AdSense is not used inside the mobile app. Those partners may collect or receive device, cookie, browsing, impression, click, and approximate-location information and may use it for measurement or personalized advertising subject to law and your choices.

Where required, nonessential advertising or analytics technologies will not activate until valid consent is obtained. You may manage choices through ColLock's cookie or privacy controls, browser settings, recognized opt-out preference signals, and provider controls. Disabling essential technologies may prevent the Services from functioning.

7. Sale, Sharing, and Targeted Advertising Disclosures

ColLock does not sell personal information for money. Depending on applicable law, allowing advertising partners to collect information for cross-context behavioral or targeted advertising may be considered a "sale," "sharing," or targeted advertising even when no money is exchanged. If ColLock engages in such activity and applicable law grants an opt-out right, ColLock will provide a clear privacy-choice mechanism and honor qualifying browser-based opt-out preference signals.

ColLock does not knowingly sell or share personal information of individuals under 16 and does not permit individuals under 18 to maintain Accounts.

8. Third-Party Integrations and Links

If you connect PSA, Dropbox, OneDrive, or another service, ColLock may receive and transmit information according to the permissions shown during authorization. The provider separately controls its own processing. Disconnecting an integration in ColLock may not revoke the provider's authorization; you may also need to revoke access through the provider. An eBay integration is planned for a future release; ColLock does not currently exchange information with eBay.

Stripe or an app store may process payment information. ColLock generally receives payment tokens and transaction details rather than complete payment-card numbers. Third-party links and advertisements are governed by the third party's privacy practices.

ColLock uses Sentry to process crash and error diagnostic data (such as error messages, stack traces, and device/browser information) so that technical problems can be identified and fixed. This processing happens automatically and is not something you separately connect or authorize.

9. Public and User-Visible Information

Information you place in a public profile, listing, trade post, ranking, comment, or other public feature may be viewed, copied, indexed, or shared by others. You should not post sensitive information. Account and visibility settings will control information where the Services offer such controls. ColLock cannot control information another user copies or retains before you remove it.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining business and tax records, preventing fraud, resolving disputes, enforcing agreements, and complying with law. Retention depends on the information type, sensitivity, volume, legal requirements, risk, and available alternatives.

Account and active-service data generally remains while the Account is open. Billing, tax, dispute, security, moderation, and legal records may be retained for applicable limitation and recordkeeping periods. Deleted information may remain in backups for a limited restoration cycle and will not ordinarily be returned to active systems except for disaster recovery, security, or legal reasons.

We may create aggregated or de-identified information from personal information, Collection Data, Content, and use of the Services. Aggregated or de-identified information is information that cannot reasonably be associated with or linked to a particular individual, household, Account, or device.

We may retain, use, disclose, license, publish, distribute, sell, or otherwise commercially use aggregated or de-identified information indefinitely and without compensation to individual users. For example, we may retain information concerning the number of users reporting ownership of a card, the number of copies reported, the distribution of reported conditions or grades, general acquisition or trading trends, or relationships among collecting interests, provided the information cannot reasonably identify a particular user.

We maintain reasonable measures designed to prevent this information from being reasonably associated with an individual. We do not attempt to re-identify aggregated or de-identified information except to test or improve de-identification controls, investigate fraud or security incidents, comply with law, or as otherwise permitted by applicable law. Where appropriate, we require recipients of this information not to attempt re-identification.

11. Account Deletion and Data Requests

You may request access, correction, deletion, portability, or another available privacy right through support@logomancollects.com. ColLock may verify identity and authority before fulfilling a request. Some information may be retained or a request may be denied where permitted by law, including for security, fraud prevention, legal compliance, transaction records, free expression, or claims.

Account deletion will remove, anonymize, aggregate, or de-identify covered personal information from active systems according to ColLock's retention practices and applicable law. ColLock may retain information when necessary to comply with legal obligations, prevent fraud, maintain security, resolve disputes, enforce agreements, preserve legal claims, or maintain backup and business records.

Deleting an Account does not require ColLock to delete aggregated or de-identified information, analytics, statistics, rankings, compilations, corrections, or other information that cannot reasonably be linked to the requesting user, household, Account, or device. ColLock may retain and commercially use that information indefinitely as described in this Policy.

12. U.S. State Privacy Rights

Residents of states with applicable comprehensive privacy laws may have rights to know or access information; correct inaccuracies; delete information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; appeal a denied request; and receive equal service without unlawful discrimination.

Where required, ColLock will provide at least the legally required request methods and a clear "Your Privacy Choices" or equivalent control. ColLock will process qualifying Global Privacy Control or other recognized opt-out preference signals as required. An authorized agent may submit a request where permitted, subject to verification.

13. California Supplemental Notice

For California residents and to the extent the California Consumer Privacy Act applies, the categories collected during the preceding 12 months are described in Section 2; sources are described in Sections 2, 6, and 8; business and commercial purposes are described in Section 3; and recipient categories are described in Section 5. ColLock may disclose each relevant category to service providers or contractors for the purposes described.

Advertising disclosures are stated in Section 7. California residents may exercise applicable rights through support@logomancollects.com and any additional method legally required based on ColLock's operating model. ColLock will not unlawfully discriminate for exercising privacy rights. ColLock will publish metrics if required.

14. International Users and Transfers

ColLock is operated from the United States. Information may be processed in the United States and other countries where ColLock or its providers operate. Those countries may have different data-protection laws. Where required, ColLock will use recognized transfer mechanisms and supplementary safeguards.

Individuals in the European Economic Area, United Kingdom, or similar jurisdictions may have rights to access, rectify, erase, restrict, object, port data, withdraw consent, and complain to a supervisory authority, subject to legal limits. Contact support@logomancollects.com to exercise rights.

15. Children and Age Assurance

The Services are intended only for adults age 18 or older. ColLock does not knowingly permit Accounts controlled by minors. ColLock may use an age gate or other proportionate age-assurance measures. If we learn that a minor provided personal information in violation of our requirements, we will investigate and delete or otherwise address the information as required. Contact support@logomancollects.com to report a suspected underage Account.

16. Security

ColLock uses reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, which may include encryption in transit, salted cryptographic password hashing, access controls, logging, monitoring, vendor review, backups, and incident-response procedures. No system is completely secure, and ColLock cannot guarantee absolute security.

You are responsible for credential security and for promptly reporting suspected compromise to support@logomancollects.com. Do not send vulnerability details through public channels.

If we become aware of a security incident that compromises personal information in a manner requiring notice under applicable law, we will notify affected individuals and, where required, applicable authorities, consistent with that law's timing and content requirements.

17. Automated Processing and Rankings

ColLock may use automated systems to match cards, rank content, detect fraud or abuse, recommend features, and organize Collection Data. These systems may produce inaccurate results. Unless otherwise disclosed, ColLock does not use automated processing to make decisions that produce legal or similarly significant effects about users.

18. Communications

We send transactional and service communications necessary to operate Accounts, including security, billing, trade, policy, and support messages. You may opt out of marketing communications through the unsubscribe method provided, but not essential service communications while your Account remains open.

19. Changes to This Policy

We may revise this Policy prospectively to reflect changes in law, technology, vendors, or practices. We will post the updated Policy and update the effective date. We will provide additional notice of material changes and obtain consent where required. A material change will not retroactively authorize an incompatible new use of previously collected information without legally sufficient notice or consent.

20. Contact Us

Logoman Collects, LLC d/b/a ColLock. support@logomancollects.com