We respect your privacy. This policy explains how we collect, use, and protect your personal data.
CollectHolo ("we", "us") operates the CollectHolo platform. For questions about this Privacy Policy or your personal data, please contact us.
Account data: When you sign up, we collect your email address and password (stored in hashed form). We may also store your display name if you provide one.
Collection and portfolio data: You voluntarily add cards, sealed products, purchase details, notes, and related information. This data is stored to provide the portfolio and wishlist features.
Usage data: We may collect technical information such as IP address, browser type, device type, and pages visited to improve the Service and prevent abuse. We use Cloudflare Turnstile for bot protection on authentication forms.
Cookies and local storage: We use cookies and local storage for authentication, preferences (e.g. theme, currency), and session management.
We use your data to: provide and improve the Service; authenticate you; store and display your collection and wishlist; process contact form submissions; send notifications (e.g. feature request updates) if you have opted in; comply with legal obligations; and prevent fraud or abuse.
If you are in the European Economic Area: we process your data based on your consent (where applicable), the performance of our contract with you, our legitimate interests (e.g. security, improving the Service), and legal obligations.
We rely on the following third-party providers to operate the Service. Each maintains its own privacy policy, and we engage them under written Data Processing Agreements where the GDPR requires one.
Hosted in the European Union
*.eu.r2.cloudflarestorage.com).Global infrastructure and United States
Optional integrations (only active if you enable them)
We retain your data only as long as necessary for the purposes described above:
Depending on your jurisdiction, you may have the right to: access your personal data; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; data portability; withdraw consent; and lodge a complaint with a supervisory authority. To exercise these rights, please contact us.
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), secure authentication, and access controls. No system is completely secure; please use a strong password and do not share your credentials.
The Service is not intended for users under 13 (or 16 in the EU without parental consent). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it.
Several processors listed in Section 5 are based in the United States (Stripe, Google Analytics 4, Google Tag Manager, Meta Pixel, Reddit Pixel, Google Gemini, RevenueCat, Discord) or operate globally (Vercel, Cloudflare). When we transfer personal data to those processors, we rely on the following safeguards under Articles 44–49 GDPR:
Data that does not need to leave the EU (Supabase database, Amazon SES email delivery, Cloudflare R2 image storage) is hosted in EU regions and does not rely on these transfer mechanisms.
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we may notify you via email or a notice on the Service.
For privacy-related requests or questions, please contact us.
Last updated: 21 May 2026