Privacy Policy

This Privacy Policy explains what personal data the ColleX platform (“we”, the “Platform”, available at collexstash.com) processes, for what purposes and on what legal bases, who receives it and what rights you have over your data. Processing is carried out in accordance with the Law of Ukraine “On Personal Data Protection” and, for users in the European Union and the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

ColleX is a collection tracker. We do not sell anything: prices shown on the site are reference values for an item, and users’ money never passes through the Platform, so we do not collect payment data.

By using the Platform you confirm that you have read this Policy.

The controller of your personal data is Volodymyr Konoval, Ukraine. For any question about how your data is processed, write to collexstash@gmail.com.

We process only what is needed to run the service. An email address is the only thing required to sign up; everything else is provided at your own choice.

• Account: email address, password (stored only as a hash — we cannot see it), the date you signed up and the date of your last sign-in.
• Sign-in with Google: if you choose this method, Google gives us your name, email address and profile picture (the picture is loaded into your browser directly from Google’s servers). We never receive your Google password.
• Profile: name or nickname, profile address (handle), city, short bio, contacts for trades — Telegram, Instagram, phone number — preferred delivery methods and privacy level.
• Country and language: the country you chose at sign-up (or the one we assumed from the page language until you confirm it), interface language and selected catalogues. Your country determines which sets, prices and listings you see.
• Collection: “Have” and “Want” marks, quantity and condition of items, your own lists (names, descriptions, notes), sets you follow, achievements, and a daily total of the reference value of your collection.
• Listings and trades: your listings (items, prices, delivery methods), requests to trade, buy or exchange contacts, the messages attached to them, offered prices, statuses and trust rating.
• Comments you leave under news articles.
• Telegram notifications (if you have connected the bot): the identifier of your chat with the bot, the date it was connected, your notification settings and a log of notifications sent — type, time sent and a mark showing that you opened the site from the notification.
• Sign-up source: the category of the channel through which you first reached the site (search, social network, direct visit, shared link and so on) — without page addresses or search queries.
• Technical data: IP address, device and browser type. These appear in the sign-in session log, hosting logs and technical error reports.
• Last visit time: while you are signed in, we store the time of your last visit to the site, rounded to five minutes. You can turn this off in your profile settings — the time is then no longer recorded and the stored one is deleted immediately.
• Reports and blocks: reports you file or that are filed about you (reason, text, a snapshot of the listing or profile at the time), moderator decisions and appeals; the list of people you have blocked.
• Chats: messages you send and receive, their time, trade proposal cards; your WhatsApp number, if you added it — the other side sees it only after an accepted proposal. If you report someone from a chat, a copy of the last 30 messages of that chat is attached to the report: only the moderator sees it, and it is kept together with the report.

Anonymous statistics. We count how many times a day a certain action happens: a guest makes a first mark, someone shares a link or opens a menu item. These are daily totals tied only to the page language and the set — with no user identifier or IP address. Such counters are not personal data.

Guests. Marks you make without an account are kept only in your browser and reach us only when you create an account and carry them over.

Sign-in log. Each time you sign in or register, we record your IP address, browser and device type, browser language, approximate location (country and city, derived from the IP address) and the exact time. We do this to keep accounts secure and to prevent fraud, on the basis of our legitimate interest. The log is kept for 180 days, including after the account is deleted, and only the administrator can see it. We may hand entries from this log to law enforcement authorities in response to a lawful request.

Fraud prevention and moderation. To make deals between collectors safer, we also process the following data, on the basis of our legitimate interest and the interest of other users in being protected from fraud:

• Risk signals: when you sign in, register or create a listing, a hash (an irreversible digital fingerprint) of your IP address combined with your browser; the IP address and browser name themselves are not stored here. Kept for 90 days.
• Automatic checks of chat messages: if a message contains a bank card number, an IBAN or a request for advance payment, both sides of the chat see a warning under it. A card or phone number in a message is compared with hashes of the numbers of people a moderator has previously sanctioned; a match is only a signal to the moderator, not a restriction.
• Numbers of sanctioned people: when a moderator restricts someone’s market access, blocks their sign-in or deletes their account, the card and phone numbers from that person’s messages over the last 90 days and the phone number in their profile are stored as a keyed hash, so that they can be recognised on other accounts.
• Identifiers of blocked people: when a moderator restricts market access, blocks sign-in or deletes an account, we store hashes of the email address and phone number, the Google account identifier and the Telegram chat identifier — separately from the account, so they remain after it is deleted. New accounts are checked against them at sign-up and when Telegram is connected.
• Reviewing chats: a moderator reads a chat only when a report, a risk signal or an active restriction concerns that chat or one of its participants. Moderation may post in such a chat as “ColleX moderation” and warn the other party about the risk — without accusations and without disclosing more about the other person than necessary.

Public sources. If an account has been reported for possible fraud, a moderator may check public sources: public profiles and listings with the same nickname, phone number or contact, publicly available databases of numbers linked to fraud, and the approximate location of the IP address. We take only what is relevant to the report, keep the review material outside the site’s database for no longer than one year after the case is closed, and never show it to other users.

Your name, handle, city, bio, collection and listings may be visible to other visitors, depending on the privacy level you choose in settings: “Public”, “Hidden collection” or “Private profile”.

Your contacts (Telegram, Instagram, phone) are visible only to a user with whom you have an accepted trade or contact request. The exception is where you yourself switch on showing your Telegram in your own listings. Your email address is not visible to other users.

Last visit time. Next to your name in listings and on your profile, other users can see whether you are on the site now or when you were last here. If you turned this off in your profile settings, nothing is shown.

• Providing the service — sign-up, collection tracking, lists, listings, trades, showing sets and prices for your country and in your language — performance of a contract (the Terms of Use).
• Connecting collectors — showing your contacts to the other party of an accepted request — your consent: you decide which contacts to provide and whether to accept a request.
• Telegram notifications — your consent: you connect the bot yourself and may mute notifications or disconnect it at any time.
• Traffic analytics (Google Analytics) — your consent to analytics cookies.
• Advertising by Journey by Mediavine, which we show only to visitors who are not signed in: personalised ads — only on the basis of your consent; non-personalised ads — on the basis of our legitimate interest, as advertising helps cover the cost of running a free service. In the EEA, the United Kingdom and Switzerland, advertising cookies may be set only with your consent (see section 8).
• Understanding where users come from (sign-up source), measuring the effectiveness of notifications and anonymous statistics — our legitimate interest in developing the service.
• Security and stability — preventing abuse and fraud, risk signals, checks of chat messages, keeping track of blocked people, rate limiting, finding and fixing technical errors — our legitimate interest and the interest of other users in not losing money or items.
• Showing whether you are on the site now — our legitimate interest: collectors find it easier to agree with someone who is around. You can object at any time by turning the indicator off in your profile settings.
• Handling requests and notices about illegal content — compliance with legal obligations and our legitimate interest.

Automated means. The trust rating and achievements are calculated automatically from your activity on the site. Chat warnings and risk signals do not restrict anyone by themselves — a person decides on any restriction. There is one exception: if, at sign-up, the email address, Google account or phone number matches the identifiers of someone a moderator previously blocked for a serious breach, sign-in to the new account is blocked automatically. If you think this is a mistake, write to collexstash@gmail.com: a person will review the block within 14 days and lift it if the match is false.

We do not sell personal data. To run the Platform we rely on service providers (processors) that handle data on our instructions:

• Supabase (Supabase Pte. Ltd., Singapore) — database, authentication and image storage. Our project is hosted in an EU region (Paris, France).
• Vercel (Vercel Inc., USA) — hosting and content delivery network. The site’s server code runs in the Paris region; pages are served from the network node nearest to you.
• Cloudflare (Cloudflare, Inc., USA) — the site’s domain names and delivery of images (Cloudflare R2 storage, img.collexstash.com) and of the site’s static files from the network node nearest to you. When files are loaded, Cloudflare sees your IP address and browser details.
• Google Analytics (Google) — traffic statistics; only if you have consented to analytics cookies.
• Vercel Web Analytics (Vercel Inc., USA) — anonymous traffic statistics without cookies: the page address, where you came from, country, region and city, device type, operating system and browser. A visitor is told apart by a hash of the request that is not kept for longer than 24 hours; we do not send the codes of personal pages or address parameters there.
• Sentry (Functional Software, Inc., USA) — technical error reports. Our project’s data is stored in an EU region (Frankfurt, Germany).
• Upstash (Upstash, Inc., USA) — rate limiting: an account identifier and a request counter.
• Amazon Web Services (Amazon Web Services, Inc., USA) — Amazon SES, through which we send the site’s emails: about proposals and deals, new messages and moderator decisions. It receives your email address, the text of the message and delivery information; our account is hosted in an EU region (Stockholm, Sweden).
• Resend (Plus Five Five, Inc., USA) — sending sign-up confirmation and password-reset emails: your email address and the text of the message.

Some recipients act as independent controllers under their own privacy policies:

• Google — if you sign in with a Google account. Google Search Console shows us only aggregated statistics of search queries and clicks, with no data about individual people.
• Mediavine (Mediavine, Inc., USA) — Journey by Mediavine ads, which we show only to visitors who are not signed in. When an ad is shown, your browser sends Mediavine the page address, your IP address, information about your browser and device and, where present, cookies; Mediavine uses this data under its own privacy notice, reproduced in English at the end of this page (see also section 8).
• Mediavine’s advertising partners (third-party vendors), including Google. Visitors from the EEA, the United Kingdom and Switzerland see the full list of them in the cookie choice window and can give or refuse consent to each one separately.
• Telegram (Telegram Messenger Inc.) — if you have connected the notification bot: the text of a notification (for example, about a new trade proposal) is delivered to your chat through Telegram. If you give Telegram as a contact, further correspondence with another collector takes place in Telegram, outside the Platform.
• Open-Meteo (OpenMeteo GmbH, Switzerland) — weather in your dashboard: if your profile includes a city, your browser sends the name of that city to Open-Meteo, which sees your IP address.
• Other users of the Platform — to the extent described in section 4.

We hand data to public authorities, including the police, only in response to a written request with a legal basis, and only to the extent that request needs. The same applies to the bank or payment service through which a victim sent money: only on a lawful request. If content on the Platform indicates a threat to someone’s life or safety, we inform law enforcement ourselves.

Core data — account, profile, collection, listings and trades — is stored in the European Union (Paris region). However, some of our providers are established outside the EU, and the Platform is operated from Ukraine, so data may be accessed from outside the EU. The providers carry out such transfers on the grounds set out in their data processing agreements:

• Supabase — the standard contractual clauses approved by the European Commission, with the UK addendum.
• Vercel — participation in the EU–U.S. Data Privacy Framework (with the UK Extension) and standard contractual clauses.
• Cloudflare — the Data Privacy Framework and standard contractual clauses with the UK addendum.
• Google — Analytics data from devices in the EU is collected through servers in the EU; Google LLC participates in the Data Privacy Framework, and Google’s data processing terms incorporate standard contractual clauses.
• Sentry — the Data Privacy Framework and, where it does not apply, standard contractual clauses.
• Upstash — the Data Privacy Framework and, where it does not apply, standard contractual clauses.
• Amazon Web Services — emails are processed in an EU region; for any access from outside the EU, Amazon Web Services, Inc. participates in the Data Privacy Framework, and its data processing addendum incorporates standard contractual clauses.
• Resend — participation in the Data Privacy Framework (with the UK Extension) and standard contractual clauses.
• Mediavine — the standard contractual clauses that Mediavine concludes with its vendors and partners (see its notice at the end of this page).
• Open-Meteo — Switzerland, which is covered by a European Commission adequacy decision.

In short: data is stored in the EU; it reaches countries without a European Commission adequacy decision (including the USA) only under the Data Privacy Framework or standard contractual clauses, and Switzerland under such a decision. The data processing agreements are published on the providers’ websites; on request to collexstash@gmail.com we will send you the links.

Strictly necessary cookies. Sign-in session cookies keep you logged in; signing in does not work without them, so they do not require consent. The technical cookie cx_seen lives for five minutes and holds no data about you: it only stops the time of your visit from being recorded more often than once every five minutes.

Analytics cookies. Google Analytics cookies are set only after you have agreed to analytics in the cookie choice window. If you decline, the Platform works without any limitation.

Advertising cookies. Ads are served by Journey by Mediavine — only to visitors who are not signed in, and only on catalogue pages, news and other pages with text. Signed-in users get no ads and no advertising cookies anywhere; the home page, the market, trades, chat, the dashboard and profiles carry no ads for anyone. Mediavine and its partners, including Google, may use cookies and similar technologies to serve ads based on your visits to this and other sites, to count impressions and to prevent fraud. How Mediavine handles data is described in its notice in English at the end of this page.

Consent to advertising. On every page with ads, before the ad script loads, we set Google Consent Mode v2 to “all denied”: no advertising or analytics cookies are written and personalisation is off until your choice arrives. Visitors from the European Economic Area (EEA), the United Kingdom and Switzerland are shown Mediavine’s cookie choice window, which lists the advertising partners and lets you decide on each one separately: without consent, no advertising cookies are set and no personalised ads are shown. In other countries the default is set by Mediavine according to local rules, and you can opt out of personalised ads in the ways listed below.

Non-personalised ads are chosen by the content of the page and your approximate location (such as country or city), not by your previous visits. Ad systems may still use cookies for them to limit how often the same ad is shown, to count impressions and to prevent fraud; in the EEA, the United Kingdom and Switzerland only if you have agreed to cookies — without that consent, limited ads that use no cookies are shown.

How to opt out of personalised advertising. Apart from your choice on our site, you can:

• turn off personalised Google ads in My Ad Center — https://adssettings.google.com;
• opt out of personalised ads from third-party vendors taking part in the Digital Advertising Alliance self-regulatory programme at https://www.aboutads.info/choices;
• in Europe, do the same on the website of the European Interactive Digital Advertising Alliance (EDAA): https://www.youronlinechoices.eu.

Opting out does not remove ads: you will still see them, but they will not be matched to your interests. Google is one of Mediavine’s advertising partners; how Google uses information from sites and apps that use its services is explained at https://policies.google.com/technologies/partner-sites; the list of Google cookies and how long they last is at https://policies.google.com/technologies/cookies.

Changing your choice. The “Cookie settings” link in the site footer reopens the choice at any time: on pages with ads — Mediavine’s window (for both advertising and analytics), on other pages — our own analytics window. Once consent to analytics is withdrawn, analytics is switched off, its cookies are deleted and its script is no longer loaded on subsequent pages. Once consent to advertising is withdrawn, subsequent pages show only non-personalised or limited ads; advertising cookies that have already been set can be deleted in your browser settings.

Browser storage. Besides cookies, the site keeps functional records in your browser: your cookie choice; guest marks; selected currency and catalogues; a flag that you have signed in on this device and your account country, plus the first letter of your address and your avatar address for the header icon (so that the page and the header render correctly straight away); the time you last viewed notifications; the category of your first-visit channel (up to 180 days) and a mark that you arrived through a shared link (up to 30 days); functional flags that stop the same event being counted twice, including a flag that ads are shown to a guest on this device. These records are not passed to third-party services; you can erase them by clearing the site data in your browser.

You have the right:

• to know what data about you we process and to receive a copy — we reply within 30 calendar days;
• to have inaccurate data corrected — most of it you can change yourself in profile settings;
• to delete your account and the data linked to it — in profile settings (“Account → Delete account”) or by writing to us; while a report about you is open, the account can be deleted only after it has been decided, and what remains after deletion is set out in section 10;
• to withdraw consent: to analytics cookies, advertising cookies and personalised ads — through “Cookie settings” in the footer; to Telegram notifications — with the /stop command in the bot or by disconnecting it in settings; to showing your contacts — by removing them from your profile. Withdrawal does not affect the lawfulness of processing carried out before it;
• to object to processing based on our legitimate interest, or to request its restriction;
• to receive your data in a commonly used machine-readable format (data portability);
• to lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU — the data protection authority of the country where you live; in the United Kingdom — the Information Commissioner’s Office (ICO).

To exercise any of these rights — to get a copy of your data, have it corrected or deleted, object to processing or contest an automatic block — write to collexstash@gmail.com from the address your account is registered to. We reply within 30 days; if a request is complex, we may extend this by up to two more months and will tell you so. To avoid handing your data to someone else, we may ask you to confirm that the account is yours.

• Account, profile, collection, listing and trade data, the sign-in session log and the notification log — for as long as your account exists.
• A listing you delete disappears from the site’s pages immediately, but its record is kept until the account is deleted, so that the history of trades opened from that listing stays intact.
• Rate-limiting counters — a few hours.
• Sign-in log (IP address, browser and device, approximate location) — 180 days from each sign-in, including after the account is deleted.
• Technical error reports and hosting logs — for the retention periods set by the respective providers.
• Google Analytics — data about individual visits is kept for no longer than 14 months; aggregated statistics not tied to a visitor are kept longer.
• Google advertising cookies — their lifetime is set by Google (listed at https://policies.google.com/technologies/cookies); data received while serving ads is kept by Google under its own privacy policy.
• Anonymous statistics — indefinitely: they contain no personal data.
• Reports, moderator decisions and appeals — 3 years after the decision, including after the account is deleted: this is needed to support the decision in case of an appeal or a request from an authority. The link to the deleted account is removed. The report snapshot keeps the name and nickname as they were at the time.
• Risk signals (a hash of the IP address combined with the browser) — 90 days, including after the account is deleted, but then without any link to it.
• Hashes of the email address and phone number and the Google and Telegram identifiers of people whose market access a moderator restricted, whose sign-in was blocked or whose account was deleted, as well as hashes of such people’s card and phone numbers — 3 years after the decision, including after the account is deleted: as long as the decision itself is kept, so that the restriction cannot be dodged with a new account.
• Material from reviewing a report in public sources — no longer than one year after the case is closed.
• Blocks — as long as both accounts exist.
• Chat messages — as long as both accounts exist; when one of them is deleted, the conversation disappears for both. If a report is filed about the other person, a moderator may review your conversation with them to make a decision.

When you delete your account, your profile, collection, lists, listings, trades, comments, session log and notification log are removed from the database immediately and irreversibly. The trades also disappear from the other party’s history. Notifications the bot has already sent you in Telegram remain in your Telegram chat — you can delete them there.

After deletion, only the following remains: the log of reports and moderator decisions — 3 years, without a link to the deleted account; the sign-in log — up to 180 days from each sign-in, together with the account identifier; risk signals — up to 90 days, with no link to the account; and, if a moderator imposed a sanction on you, the hashed identifiers and numbers — 3 years after the decision (see above).

Connections to the site are encrypted (HTTPS). Passwords are stored only as a hash. Direct requests to the database that bypass the site cannot read or change another person’s profile, collection, listings or trades: only the catalogue of sets and items is openly readable, and only the site’s server side can change data. No safeguard offers an absolute guarantee.

You can create an account from the age of 13; people aged 13 to 15 do so with the knowledge of a parent or guardian, and where the law of their country requires parental consent for online services, with that consent. We do not knowingly process data of children under 13: if we learn that an account belongs to such a child, we will delete it. If you are a parent or guardian and know of such an account, write to collexstash@gmail.com.

We run accounts on the basis of a contract — the Terms of Use — not consent. Signed-in users never see ads or advertising cookies; ads appear only for guests (see section 8).

We may update this Policy. The current version is always available on this page with the date of the last update. We will additionally announce material changes on the Platform.