Privacy Policy

Collecti.bio lets you build a public profile page for the things you collect. This policy explains what we collect, why we hold it, who else sees it, and how to get it back or have it deleted.

The short version: your profile is public by design, your email and payment details are not, and we do not sell anything about you to anybody.

1. Who we are

Collecti.bio is the data controller for the information described here. You can reach us at hello@collecti.bio about anything in this policy, including a request to see or delete your data.

2. What we collect

Information you give us

• Your email address and password, when you create an account. Passwords are handled by Firebase Authentication and are never visible to us. If you sign in with Google, we receive your email address and basic profile details from Google instead.
• Your profile — username, display name, bio, avatar, and any social media handles you add.
• Everything you put on your page — links, collections, items, photos, videos, notes and ratings.

Information we generate

• Page views and link clicks on your profile, so we can show you how it is performing. We record the event type and the time it happened. We do not store the visitor's IP address, and we do not build a profile of anyone who visits your page.
• How you found us — if you arrived through someone else's profile or an invite link, we record which one, so we know what brings people here.

Information from paying

• Your subscription status and the identifiers Stripe gives us for your customer and subscription records.
• Card details never reach us. Payment is handled entirely by Stripe. We never see or store your card number.

Information collected automatically

• Standard server logs kept by our hosting provider, including IP addresses, for security and diagnosing faults.
• Google Analytics for Firebase, which sets identifiers to measure general usage of the site.

3. What is public

Your profile page at collecti.bio/yourname is public. Anyone with the link can see it, and so can search engines — we actively encourage Google to index profiles, because being findable is the point of the product. Your username, display name, bio, avatar, social links, and everything you add to your collections are all visible to anyone.

Your email address is never shown on your profile, and neither is anything to do with your payments. If you would rather something was not public, do not put it on your page.

4. Why we are allowed to hold it

Under UK GDPR we rely on three grounds:

• Performing our contract with you — we cannot run your account, show your page or take payment without your account details.
• Our legitimate interests — keeping the service secure, preventing abuse, and understanding how it is used so we can improve it.
• Your consent — where required, such as non-essential cookies. You may withdraw it at any time.

5. Who we share it with

We do not sell your data, and we do not share it for anyone else's marketing. We use these providers to run the service, and they only receive what they need to do their job:

• Google Firebase — accounts, database and file storage.
• Netlify — hosting and content delivery.
• Stripe — subscription payments.
• Resend — sending service emails, such as receipts and account notices.
• Google AdSense — advertising shown on free profiles. Advertising cookies are set by Google, not by us, and are governed by Google's own policies.

We will also disclose information if we are legally required to, or where it is necessary to protect our rights or someone's safety.

6. Where your data is held

Our providers operate globally, so your information may be processed outside the UK and the European Economic Area, including in the United States. Where that happens, transfers are covered by the safeguards those providers put in place, such as Standard Contractual Clauses.

7. Cookies and similar technology

We use browser storage to keep you signed in and to remember things like where you came from during signup. That is essential to the service working.

Analytics and advertising set their own identifiers. You can block or clear cookies in your browser settings; signing in will stop working if you block the essential ones.

8. How long we keep it

We keep your account and everything on your profile for as long as your account exists. Delete your account and we remove your profile and its content.

Some records outlive the account where the law requires it — payment and tax records in particular, which are kept for six years. Backups and server logs are cleared on the ordinary schedules our providers run.

9. Your rights

Under UK and EU data protection law you can ask us to:

• Give you a copy of the information we hold about you.
• Correct anything that is wrong.
• Delete your data — the right to be forgotten.
• Hand your data over in a portable format.
• Stop or limit how we use it, including objecting to processing based on legitimate interests.

Email hello@collecti.bio and we will respond within one month. There is no charge.

If you are not happy with how we have handled something, you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you gave us the chance to put it right first.

10. Security

Traffic is encrypted in transit. Access to account data is restricted to the account holder, and anything that decides what you have paid for is changed only by our servers, never by the browser. Two-factor authentication is available in your settings and we recommend turning it on.

No service can promise perfect security. If a breach ever affects your rights, we will tell you and the ICO as the law requires.

11. Children

Collecti.bio is not for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

12. Changes to this policy

We will update this page when what we do changes, and revise the date at the top. If a change materially affects your rights, we will tell you by email or a notice on the site.

13. Contact

Questions, requests, or complaints: hello@collecti.bio.