Privacy Policy

This policy explains how Holostash (“we”, “us”) collects, uses and protects information when you use our Pokémon Trading Card Game collection tracker. Holostash is free and non-commercial. We do not sell personal information or display advertising.

1. Information We Collect

• Account information: your email address and a securely hashed password. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Collection data: the collections and cards you add, and any details you record, such as condition, grading, purchase price, acquisition date and notes.
• Technical data: an essential cookie that keeps you signed in, and standard server logs (such as IP address and browser type) kept by our hosting providers for security and operations.

We do not collect payment information or use analytics or advertising cookies.

2. How We Use Information

We use your information only to provide the service: to authenticate you, store and display your collections, calculate statistics and estimated values, and send account emails such as address confirmation and password reset. We do not send marketing email.

3. Sharing and Service Providers

Your collections are private to your account and are not visible to other users. We share information only with the providers that operate Holostash on our behalf:

• Supabase: database and authentication
• Vercel: website hosting
• Resend: account email delivery
• Google: sign-in, if you choose it, under Google's own privacy policy

Card information and market prices are provided by Scrydex. No information about you or your collection is sent to Scrydex.

4. Data Retention and Your Rights

We retain your information for as long as your account exists. You may request a copy, correction or deletion of your data by emailing holostash@gmail.com from the address associated with your account. Deletion requests are completed within 30 days.

5. Security

All connections are encrypted, passwords are stored only in hashed form, and access to each account's data is restricted at the database level. No method of storage or transmission is completely secure, but we take reasonable measures to protect your information.

6. Children

Holostash is not intended for children under 13, and we do not knowingly collect their information. If you believe a child under 13 has created an account, contact us and we will delete it.

7. Changes and Contact

We will post any changes to this policy on this page and update the date above, and will notify users of material changes. Questions may be sent to holostash@gmail.com.