Privacy Policy

Who we are

GridCollector is a mobile app for Formula 1 trading card collectors, operated by Acacia Labs Ltd, a company registered in England and Wales. When you use the app and create an account, we act as the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

When you create an account and use the app, we collect:

• Your email address (required to sign in and recover your account)
• A handle you pick during sign-up, a unique identifier shown on your profile and alongside any photos you share with the community catalogue
• The cards you log: which card, which variant, how you acquired it (bought, pulled, or traded), condition, grade, serial number, value paid, currency, personal notes, front and back photos you attach, and whether you have marked a copy as a spare
• Your collections and how you view them: collection goals, binder layouts, grails, and the cards you have flagged in Hunt
• A record of the one-time v2 upgrade: if you used GridCollector before version 2, the app converts your binders into collection views the first time you open version 2. We keep a note of what was converted (so we can show you what changed and offer to undo it) and a backup copy of your collection data as it stood before the conversion. The “Your binders and the v2 upgrade” section below explains this
• Feedback and catalogue suggestions: anything you submit via the in-app submission forms (general feedback, catalogue corrections, photo submissions), including any photos you choose to attach
• Pseudonymous behavioural events: which screens you visit, which buttons you tap, whether a search returned results, and when you open or close the app. Events are tied to your account's unique identifier (a UUID), never to your email, handle, or any free-text you enter. We may also record anonymised screen replays of your sessions to help diagnose issues and improve the app; text inputs and images are automatically masked in these recordings. You can turn all of this off at any time from your account settings
• Crash and error reports: when the app crashes or hits an unexpected error, we automatically receive the stack trace, a short trail of the screens visited and controls tapped leading up to the crash, device model, OS version, and app version. Used only to diagnose and fix bugs. We do not send your email, handle, or any free-text content alongside these reports
• A per-device update record: a random identifier the app generates for each of your devices, stored with the app version that device last used and when. We keep this so we can roll out updates and database changes without breaking the app on a device you have not updated yet. It is operational safety data, not analytics: it is never used to profile you or shared with anyone, and because it protects your own collection during updates it stays on even if you turn analytics off. It is stored in our database (Supabase) alongside your account and deleted with it
• Basic device and app metadata that the operating system shares automatically (app version, OS version, device model)

What we do not collect

We do not collect your precise location. We do not read your contacts, calendar, messages, or any files outside the photos you explicitly choose to attach to a card. We do not use advertising identifiers or share data with advertising networks.

Why we collect it

Your account data is used to let you sign in, access your collection on any device, and keep it separate from other users' collections. The cards, collections, hunt and spares lists are the core of the product: they are the things you are here to catalogue. Our legal basis for this is that the processing is necessary to provide the service you signed up for.

The pseudonymous behavioural events help us understand which features are used, diagnose problems, and prioritise improvements; our legal basis for this is legitimate interest, balanced with the right to opt out from your account settings. Sharing a card photo with the community catalogue happens only with your consent, which you can withdraw. We never sell your data, and we never use it for purposes beyond running and improving GridCollector.

Who we share it with

We use a small number of third-party service providers (“processors”) to run the app. They only process your data on our instructions and under written contracts:

• Supabase (database, authentication, file storage): hosted in the United Kingdom. Stores your account, card data, and photos
• PostHog (product analytics): hosted in the European Union. Captures pseudonymous behavioural events and anonymised session replays tied to your account UUID. Text inputs and images are masked in recordings. We never send your email, handle, or any free-text you enter. You can disable this from your account settings
• Sentry (crash and error reporting): captures crash reports and unexpected errors so we can diagnose and fix them. We send stack traces, the most recent screens and taps, device model, OS version, and app version. We do not send your email, handle, or any free-text content. Hosted in the European Union, with a retention of 30 days

We do not share your data with any other third parties. We do not disclose it to advertisers, data brokers, or marketing services.

Photos you upload

When you attach photos to a card (front, back, or both), they are uploaded to our private storage bucket. By default, your card photos are only accessible to you.

Once you have added photos to a few cards, we ask you once whether you want to share your card photos with the wider community catalogue, to help other collectors identify the same cards. Sharing is off unless you say yes. If you opt in, all of your card photos, past and future, become eligible to appear in the public catalogue, but only after we have manually reviewed each photo, and your handle is shown alongside them. At present only the front photo of a card appears in the community catalogue. If you say no, nothing is shared, and you can still choose to share the photos on an individual card from that card's own screen.

You can turn the sharing preference on or off at any time in Preferences. Turning it on also shares the photos already on your cards. Turning it off stops photos being shared from then on, but does not withdraw photos that have already been marked for sharing or published; if you want one taken out of the pool or removed from the catalogue, email us at hello@gridcollector.app and we will remove it. Removing a photo from a card also withdraws it from sharing.

Photos attached to feedback submissions are uploaded to the same private bucket and are accessible only to us, for the purpose of investigating your report.

Sharing from the app

You can share a card you own (as a rendered image or your own photo of it) and your Hunt or spares list (as an image or a text list) from the app. What you share is generated on your device and handed to your device's normal share sheet (for example Messages or email). We do not receive a copy of what you share or a record of who you shared it with. Your original card photos remain private to your account.

Your binders and the v2 upgrade

Version 2 of GridCollector replaces standalone binders: a binder is now a way of viewing a collection. If you used GridCollector before version 2, the first time you open the new version your existing binders are converted automatically. For most binders this simply creates a matching collection. Where a binder tracked the same cards as one of your existing collections, the two may be combined, and the app will show you what happened and ask whether to keep them together or split them apart.

Before converting anything, we take a backup copy of your collection data as it stood, so the conversion can be reversed if something goes wrong, and we keep a note per binder of exactly what was done. Your original binder data is not deleted; it is kept read-only so that older versions of the app on your other devices keep working.

Where your data is stored

Your data is stored securely in Supabase, hosted in the United Kingdom. Appropriate safeguards are in place in accordance with UK data protection law.

How long we keep it

We keep your data for as long as your account exists. If you delete your account, from the Profile screen in the app or by following the steps at gridcollector.app/delete-account, all of your personal data, including your account, cards, collections, hunt and spares lists, feedback, and the photos on your own cards, is removed from our systems within 30 days. This includes the v2 upgrade backup and your legacy binder data. Anonymous behavioural events that cannot be linked back to an identifiable individual may be retained in aggregated form.

Photos you opted to share with the community catalogue and that have been verified and published may remain in the public catalogue after your account is deleted, with no link back to you: your handle, profile, and original card data are gone. If you want a published community photo removed before deleting your account, email us at hello@gridcollector.app.

Cookies and tracking

This website does not set any cookies or use any analytics or tracking tools. Our hosting provider (Vercel) may collect basic server logs (IP address, browser type, pages visited) for operational purposes.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (you can edit your handle and card details in the app directly)
• Delete your account and associated data (available from the Profile screen in the app)
• Object to or restrict certain processing
• Withdraw consent where processing is based on it, such as community photo sharing
• Data portability: receive a copy of your data in a structured format
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at hello@gridcollector.app. We will respond within one month.

Before we act on a request, we may need to verify your identity so that we only release data to the right person. In line with UK GDPR, we may also decline a request, or charge a reasonable fee, where it is manifestly unfounded or excessive, for example where it is repetitive, or designed to extract data that is not your own personal data.

Children

GridCollector is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact us and we will delete it.

Changes to this policy

We may update this policy as the app evolves. The “Last updated” date at the top tells you when it was last changed. Significant changes will be highlighted in the app.

Contact

Questions or requests about your data: hello@gridcollector.app