Privacy Policy

Who we are

GridCollector is a mobile app for Formula 1 trading card collectors, operated by Acacia Labs Ltd, a company registered in England and Wales. When you use the app and create an account, we act as the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any questions about this policy or your data, contact us at hello@gridcollector.app.

What we collect

When you create an account and use the app, we collect:

• Email address — required to sign in and recover your account.
• Handle — a unique identifier you pick during sign-up. Shown on your profile and alongside any photos you share with the community catalogue.
• Card collection data — which cards you log, which parallel, how you acquired it (bought, pulled, or traded), condition, grade, serial number, value paid, currency, personal notes, and any photo you attach.
• Collections, binders, and wanted list — your collection goals, binder layouts, showcase highlights, and wanted-list entries.
• Feedback and catalogue suggestions — anything you submit via the in-app submission forms (general feedback, catalogue corrections, photo submissions), including any photos you choose to attach.
• Pseudonymous behavioural events — which screens you visit, which buttons you tap, whether a search returned results. Events are tied to your account's unique identifier (a UUID) — never to your email, handle, or any free-text you enter. We may also record anonymised screen replays of your sessions to help diagnose issues and improve the app; text inputs and images are automatically masked in these recordings. You can turn all of this off at any time from the Profile screen.
• Device and app metadata — app version, OS version, and device model, shared automatically by the operating system.

If you join our waitlist on this website, we collect your email address and the date you signed up.

What we do not collect

We do not collect your precise location. We do not read your contacts, calendar, messages, or any files outside the photos you explicitly choose to attach to a card. We do not use advertising identifiers or share data with advertising networks.

Why we collect it

Your account data is used to let you sign in, access your collection on any device, and keep it separate from other users' collections. The cards, collections, binders, and wanted-list data are the core of the product — they are the things you are here to catalogue.

The pseudonymous behavioural events help us understand which features are used, diagnose problems, and prioritise improvements; our legal basis for this is legitimate interest, balanced with the right to opt out from the Profile screen. We never sell your data, and we never use it for purposes beyond running and improving GridCollector.

Who we share it with

We use a small number of third-party service providers (“processors”) to run the app. They only process your data on our instructions and under written contracts:

• Supabase (database, authentication, file storage) — hosted in the European Union. Stores your account, card data, and photos.
• PostHog (product analytics) — captures pseudonymous behavioural events and anonymised session replays tied to your account UUID. Text inputs and images are masked in recordings. We never send your email, handle, or any free-text you enter. You can disable this from the Profile screen.

We do not share your data with any other third parties. We do not disclose it to advertisers, data brokers, or marketing services.

Photos you upload

When you attach a photo to a card, it is uploaded to our private storage bucket. By default, your card photos are only accessible to you.

You can choose to opt in to sharing your card photos with the wider community catalogue to help other collectors identify the same cards. This is off by default. If you opt in (either via the first-time prompt after logging a photo, or from the Profile screen), all of your card photos — past and future — will be eligible to appear in the public catalogue, but only after we have manually reviewed each photo. You can change this preference at any time in your profile, and you can opt individual photos out without changing your overall preference.

Photos attached to feedback submissions are uploaded to the same private bucket and are accessible only to us, for the purpose of investigating your report.

If you share a binder page or wanted list from the app, a rendered image is generated and shared via your device's normal share dialog (e.g. Messages, email). Your original card photos remain private to your account.

Where your data is stored

Your data is stored securely in Supabase, hosted in the European Union. Appropriate safeguards are in place in accordance with UK data protection law.

How long we keep it

We keep your data for as long as your account exists. If you delete your account from the Profile screen, all of your personal data — account, cards, collections, binders, wanted list, showcase, feedback, and the photos on your own cards — is removed from our systems within 30 days. Anonymous behavioural events that cannot be linked back to an identifiable individual may be retained in aggregated form.

Photos you opted to share with the community catalogue and that have been verified and published may remain in the public catalogue after your account is deleted, with no link back to you — your username, profile, and original card data are gone. If you want a published community photo removed before deleting your account, email us at hello@gridcollector.app.

Cookies and tracking

This website does not set any cookies or use any analytics or tracking tools. Our hosting provider (Vercel) may collect basic server logs (IP address, browser type, pages visited) for operational purposes.

Your rights

Under UK GDPR, you have the right to:

• Access— request a copy of the data we hold about you.
• Rectification — correct inaccurate data (you can edit your handle and card details in the app directly).
• Erasure — delete your account and associated data (available from the Profile screen).
• Restrict processing — ask us to limit how we use your data.
• Data portability — receive a copy of your data in a structured format.
• Object— object to our processing of your data.

To exercise any of these rights, email hello@gridcollector.app. We will respond within one month.

Children

GridCollector is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact us and we will delete it.

Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Changes to this policy

We may update this policy as the app evolves. The “Last updated” date at the top of this page tells you when it was last changed. Significant changes will be highlighted in the app.