Collector's BOX — Privacy Policy

Collector’s BOX is operated by boxYOUpop ("Collector’s BOX," "boxYOUpop," "we," "us," or "our").

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Collector’s BOX website, application, database, community tools, and related services (collectively, the "Service").

By using the Service, you acknowledge the practices described in this Privacy Policy.

This Privacy Policy should be read together with the Collector’s BOX Terms of Use.

1. Account Information

When you create or use an account, we may collect:

• email address;
• account identifiers;
• username or profile name;
• authentication information handled through Supabase Auth;
• account creation date;
• account status;
• legal-policy acceptance records;
• profile information you choose to provide.

We do not intentionally collect account passwords in readable form. Authentication credentials are handled through the authentication provider.

2. Collection and Preference Data

When you use collection-management features, we may collect information such as:

• collectibles added to My Box;
• collectibles added to Hunt;
• collectibles added to Grails;
• collection status;
• collection-management activity;
• preferences and saved-item relationships.

This information helps provide your personal collection experience.

3. Contributions and Community Content

If you contribute to Collector’s BOX, we may collect:

• collectible submissions;
• corrections;
• images;
• references;
• descriptions;
• artist/manufacturer information;
• missing-item reports;
• community submissions;
• contributor activity;
• moderation history;
• related account identifiers.

Content submitted for inclusion in the public catalog may become publicly visible.

Do not submit personal information that you do not want associated with a public contribution.

4. Feedback and Support

If you use Report an Issue, contact support, or otherwise communicate with us, we may collect:

• your message;
• issue category;
• email address if provided;
• page/path associated with the issue;
• date/time of submission;
• information you voluntarily include.

5. Technical and Usage Information

We and our service providers may automatically collect technical information including:

• IP address;
• browser type;
• device type;
• operating system;
• referring page;
• requested pages/routes;
• timestamps;
• diagnostic data;
• application errors;
• performance information;
• security logs;
• network/request metadata;
• approximate location derived from IP where provided by infrastructure services.

6. Cookies, Local Storage, and Similar Technologies

Collector’s BOX may use cookies, browser storage, session storage, local storage, or similar technologies where necessary to:

• maintain authentication sessions;
• preserve navigation/application state;
• remember user preferences;
• support collection functionality;
• protect security;
• improve application performance.

We may add analytics technologies in the future. If materially different tracking is introduced, this Privacy Policy should be updated as appropriate.

We may use information to:

• provide and operate Collector’s BOX;
• authenticate users;
• maintain accounts;
• provide My Box, Hunt, Grails, and related functionality;
• personalize user experience;
• process catalog contributions;
• prevent duplicates;
• moderate submissions;
• improve catalog accuracy;
• respond to feedback and support;
• investigate bugs;
• maintain security;
• prevent fraud, abuse, and unauthorized access;
• diagnose technical problems;
• improve performance;
• enforce Terms of Use;
• comply with legal obligations;
• protect the rights, safety, and integrity of users, Collector’s BOX, boxYOUpop, and third parties;
• develop and improve features.

We do not sell personal information in exchange for money.

We may disclose personal information as follows:

Service Providers

We use third-party providers that help operate Collector’s BOX.

These may include:

• Supabase for database, authentication, and backend infrastructure;
• Vercel for application hosting, deployment, networking, logging, and performance infrastructure;
• GitHub and development tooling where applicable to application development and deployment;
• other infrastructure, security, email, or operational service providers added in the future.

These providers may process information on our behalf subject to their own contractual and privacy obligations.

Public Contributions

Information intentionally submitted for public catalog/community use may be publicly displayed.

Do not submit private or sensitive personal information as part of a public contribution.

Legal and Safety Disclosures

We may disclose information when reasonably necessary to:

• comply with law, regulation, subpoena, court order, or legal process;
• enforce our Terms;
• investigate fraud or abuse;
• protect security;
• prevent harm;
• protect Collector’s BOX, boxYOUpop, users, or third parties.

Business Transfers

If Collector’s BOX or boxYOUpop is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction subject to applicable law.

No Sale of Personal Information

Collector’s BOX does not currently sell personal information for monetary consideration.

If this practice changes, this Privacy Policy will be updated and legally required choices will be provided.

We retain information for as long as reasonably necessary to:

• provide the Service;
• maintain accounts;
• preserve collection functionality;
• maintain catalog integrity;
• resolve disputes;
• enforce agreements;
• investigate security incidents;
• comply with legal obligations;
• support legitimate business purposes.

Retention periods vary depending on the type of information.

Public catalog contributions may remain in the catalog after account deletion where reasonably necessary to preserve database integrity, subject to applicable law.

We use reasonable administrative, technical, and organizational safeguards designed to protect information.

These may include:

• authentication controls;
• row-level security;
• role-based access;
• restricted administrative credentials;
• private backend provenance fields;
• secure infrastructure providers;
• logging and monitoring;
• access controls.

No system is completely secure.

We cannot guarantee that unauthorized access, disclosure, alteration, or loss will never occur.

Depending on the functionality available, users may be able to:

• update profile information;
• remove collectibles from personal lists;
• change account information;
• sign out;
• request assistance regarding account data.

Requests relating to access, correction, deletion, or privacy may be submitted to Support@boxyoupop.com.

We may need to verify identity before processing certain requests.

Users may request account deletion by contacting Support@boxyoupop.com.

Account deletion may remove or de-identify personal account information subject to:

• legal obligations;
• security requirements;
• fraud prevention;
• legitimate recordkeeping needs;
• preservation of public catalog contributions where legally appropriate.

California residents may have rights under applicable California privacy laws depending on whether the law applies to Collector’s BOX at the relevant time.

These rights may include the right to request:

• information regarding categories of personal information collected;
• access to certain personal information;
• correction of inaccurate personal information;
• deletion of certain personal information;
• information regarding disclosures;
• limitations or opt-out rights where legally applicable.

Collector’s BOX does not discriminate against users for exercising applicable privacy rights.

California privacy requests may be submitted to Support@boxyoupop.com.

We may require reasonable identity verification.

Residents of other states may have additional rights under applicable state privacy law.

Where legally required, Collector’s BOX will honor applicable rights after reasonable verification.

Collector’s BOX is operated from the United States.

If you access the Service from outside the United States, information may be processed and stored in the United States and other locations where our service providers operate.

Data protection laws in these locations may differ from those in your jurisdiction.

The controlled beta is intended only for users 18 years of age or older.

Collector’s BOX is not directed to children under 13 and does not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13 without legally valid authorization, we will take reasonable steps to delete it.

Parents or guardians with concerns may contact Support@boxyoupop.com.

Collector’s BOX may link to or interact with third-party websites or services.

Their privacy practices are governed by their own privacy policies.

Collector’s BOX is not responsible for third-party privacy or security practices.

Collector’s BOX may maintain private backend information concerning catalog ingestion, source provenance, imports, administrative review, or internal database operations.

These backend records are not intended to be publicly exposed through the Service.

We may update this Privacy Policy as Collector’s BOX evolves.

Material changes may be communicated through:

• the Service;
• account notices;
• email;
• another reasonable method.

The Last Updated date identifies the current version.

Where legally required, renewed consent or acknowledgment may be requested.

Privacy questions or requests may be sent to:

Collector’s BOX / boxYOUpop
California, United States

Email: Support@boxyoupop.com