We respect your privacy. This policy explains how we collect, use, and protect your personal data.
CollectHolo ("we", "us") operates the CollectHolo platform. For questions about this Privacy Policy or your personal data, please contact us.
Account data: When you sign up, we collect your email address and password (stored in hashed form). We may also store your display name if you provide one.
Collection and portfolio data: You voluntarily add cards, sealed products, purchase details, notes, and related information. This data is stored to provide the portfolio and wishlist features.
Usage data: We may collect technical information such as IP address, browser type, device type, and pages visited to improve the Service and prevent abuse. We use Cloudflare Turnstile for bot protection on authentication forms.
Support and cancellation requests: If you contact us or submit a contract cancellation declaration, we process the details you provide, such as name, email address, subscription provider, contract details, requested end timing, message content, and internal processing notes.
Cookies and local storage: We use cookies and local storage for authentication, session management, necessary interface preferences (e.g. theme, currency), and optional preferences such as saved Explore filters/search when you enable Preferences in Cookie Settings.
iOS app privacy choices: In the iOS app, optional Preferences, Analytics, and Advertising choices are shown separately. Google Tag Manager and Google Analytics start only after you allow Analytics. No advertising or targeting tag is currently active in the iOS app. You can withdraw or change a choice at any time in More → Cookie Settings.
We use your data to: provide and improve the Service; authenticate you; store and display your collection and wishlist; process contact form submissions and cancellation declarations; send notifications (e.g. feature request updates) if you have opted in; comply with legal obligations; and prevent fraud or abuse.
If you are in the European Economic Area: we process your data based on your consent (where applicable), the performance of our contract with you, our legitimate interests (e.g. security, improving the Service), and legal obligations.
We rely on the following third-party providers to operate the Service. Each maintains its own privacy policy, and we engage them under written Data Processing Agreements where the GDPR requires one.
Hosted in the European Union
*.eu.r2.cloudflarestorage.com).Global infrastructure and United States
Optional integrations (only active if you enable them)
We retain your data only as long as necessary for the purposes described above:
Depending on your jurisdiction, you may have the right to: access your personal data; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; data portability; withdraw consent; and lodge a complaint with a supervisory authority. To exercise these rights, please contact us.
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), secure authentication, and access controls. No system is completely secure; please use a strong password and do not share your credentials.
The Service is not intended for users under 13 (or 16 in the EU without parental consent). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it.
Several processors listed in Section 5 are based in the United States (Stripe, Google Analytics 4, Google Tag Manager, Meta Pixel, Reddit Pixel, Google Gemini, RevenueCat, Discord) or operate globally (Vercel, Cloudflare). When we transfer personal data to those processors, we rely on the following safeguards under Articles 44–49 GDPR:
Data that does not need to leave the EU (Supabase database, Amazon SES email delivery, Cloudflare R2 image storage) is hosted in EU regions and does not rely on these transfer mechanisms.
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we may notify you via email or a notice on the Service.
For privacy-related requests or questions, please contact us.
Last updated: 11 July 2026