Privacy Policy.

Private by default

Every vault item, photo, and note you add is visible to you alone. Community posts and profile visibility are separate choices and do not expose vault items.

We store what you give us, nothing more

We store your account email, your collector profile, and the collection data you create. We do not buy outside data about you or your collection.

No data sales

Your personal data is never sold or rented. Sponsored placements you see in the feed are labeled, and advertisers never receive your identity or vault contents.

Deletion means deletion

Ask us to delete your account and your profile, items, and photos are removed from our systems, with only short-lived backup copies purged on a routine cycle.

Security is structural

Public pages never expose private identifiers, and access to your vault is enforced at the database layer with row-level security, not just in the interface.

1. Who we are and what this covers

This policy explains how CollectorVault (“we”, “us”), operated from the United States, handles personal data when you use collectorvault.social. It works together with our Terms of Service.

2. Information we collect

• Account data: your email address and a securely hashed password, managed by our authentication provider. We never see or store your plain-text password.
• Profile data: the display name, collector identity, themes, and visibility setting you choose during onboarding.
• Collection content: the items, photos, stories, collections, and shelves you create, plus actions you take on community content.
• AI scan data: when you choose to run an AI scan, we send the first selected photo to Anthropic for image analysis. The returned catalog suggestions remain editable and are not an authentication or appraisal.
• Usage data: aggregated, privacy-focused page analytics (via Vercel Web Analytics) that do not use advertising cookies or track you across other sites.
• Technical logs: our infrastructure providers process IP addresses and request metadata transiently for security, rate limiting, and abuse prevention.

3. Cookies

We use essential cookies only: the session cookies required to keep you signed in. We do not set advertising or cross-site tracking cookies, which is why you do not see a cookie banner.

4. How we use your data

To provide and secure the service (authentication, storing your vault, enforcing access rules), to send service emails such as sign-up confirmations, to understand aggregate usage so we can improve the product, and to comply with legal obligations. Where GDPR-style laws apply, we rely on performance of our contract with you, our legitimate interest in running a secure service, and your consent where required.

5. Who we share data with

We share personal data only with the processors that run the service, under their own contractual data protections:

• Supabase — database, authentication, and storage (United States).
• Vercel — hosting, content delivery, and privacy-focused analytics (United States).
• Anthropic - AI image analysis when you explicitly run an item scan (United States).

Beyond that, we disclose data only if the law requires it, to protect the safety and rights of users or the public, or as part of a merger or acquisition — in which case this policy continues to apply to your data. Sponsors and advertisers never receive your personal data.

6. How long we keep data

Your account and collection data are kept while your account exists. When you delete content, it is removed immediately from the live service; when you ask us to delete your account, we remove your data from our systems, and residual copies in encrypted backups are purged on the backup rotation cycle (approximately 30 days).

7. Your rights

You can access and correct your profile inside the product, and you may ask us at any time to access, correct, export, or delete the personal data we hold about you — email support@collectorvault.social from your account address. If you are in the EEA/UK you may also lodge a complaint with your supervisory authority. If you are a California resident: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not discriminate against anyone who exercises their privacy rights.

8. Security

Data is encrypted in transit, access to your vault is enforced with database row-level security, and administrative credentials are restricted. No online service can promise perfect security; if a breach affects your personal data we will notify you and the relevant authorities as required by law.

9. Children

CollectorVault is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. International users

The service is operated from the United States and your data is processed there. By using the service you understand your data will be transferred to and processed in the United States.

11. Changes to this policy

If we make material changes we will update the date below and take reasonable steps to notify you, such as a notice on the site.

12. Contact

Privacy questions or requests: support@collectorvault.social.