FoilStash
Sign in

Privacy Policy

Draft — pending legal review. Effective Date: [DATE]. For the rules governing use of the marketplace, see the Terms & Conditions.

Privacy Policy

1. Data We Collect

Account data you provide directly:

  • First name, last name, email, phone number, and password (Section 2 explains why phone is required and how it's shared).
  • Optional profile photo, or a selected reward avatar unlocked through Quests.
  • Currency display preference (ILS/USD/EUR) and language preference.

Content you create:

  • Listings (including photos/descriptions), Wanted Posts, Deck Builder decks, and My Collection entries (Pro Users/admins).
  • Ratings and Reports you file or receive.
  • Messages/data you send us through the Contact form.

Billing data:

If you subscribe to Pro User or a Seller Plan, PayPal processes your payment. We store only your PayPal subscription ID and status — we never see or store your card number, bank details, or PayPal login.

Automatically collected data:

Session cookies (to keep you signed in), a sidebar-preference cookie (a UI setting, not tracking), and basic technical data (IP address, browser) used for account security and to rate-limit abuse of features like Contact Reveal.

We do not collect government ID, proof-of-address documents, or payment card details ourselves — none of that is part of how the platform works.

2. Phone Number & Contact Reveal

  • Required at registration and kept unique per account — this is how we detect duplicate/multi-accounts.
  • Shown to another signed-in user only when they use "Show Details" / Contact Reveal on your Listing, seller profile, or Wanted Post. Reveals are rate-limited, but once revealed to a specific user we can't retract it from them.
  • Never sold, rented, or given to advertisers.

3. How We Use Your Data

  • To operate your account, your Listings/Wanted Posts/Deck Builder/My Collection, and the Contact Reveal connection between users.
  • To process your Pro User or Seller Plan subscription through PayPal, and gate seller-only features on an active, admin-approved Seller Plan.
  • To send transactional email (verification, password reset, account notifications, quest/badge unlocks, seller approval decisions).
  • To prevent abuse — duplicate accounts, spam, fraud, or Contact Reveal scraping.
  • To respond to Reports and enforce our Terms & Conditions.

4. Legal Bases

Where GDPR or similar law applies to you, we rely on: performance of a contract (running your account and Listings), legitimate interest (fraud prevention, rate-limiting), and consent (marketing communications, if any — withdrawable at any time).

5. Who We Share Data With

  • PayPal — processes subscription payments.
  • Cloudflare R2 — hosts re-hosted catalog and listing images.
  • YGOPRODeck / CardTrader / TCGPlayer — sources of catalog data and reference pricing; we send them card/catalog lookups only, never your personal data.
  • [Email delivery provider] — sends transactional email on our behalf.
  • Other users, via Contact Reveal and public Ratings/Reviews.
  • Law enforcement, only where legally required, or to investigate fraud, counterfeit-goods reports, or safety threats.

6. Cookies

We use strictly necessary cookies (session/authentication) and one preference cookie (sidebar expanded/collapsed state) — no third-party advertising or cross-site tracking cookies beyond what's disclosed here.

7. Data Retention

We retain account data for as long as your account is active. If you delete your account, we remove or anonymize personal data within [X days], except where we must retain records for legal, tax, or fraud-prevention purposes.

8. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us to exercise these rights.

9. International Data Transfers

FoilStash is operated from [JURISDICTION]. If you access the platform from another country, your data may be transferred to and processed in [JURISDICTION].

10. Children's Privacy

FoilStash is not directed at children under 18. We do not knowingly collect data from anyone below that age. If you believe a child has created an account, contact us and we'll remove it.

11. Security

We use industry-standard measures (password hashing, HTTPS, access controls) to protect your data, but no system is 100% secure and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time; material changes will be notified in-app or by email before they take effect.

13. Contact

Questions about this policy or your data: contact us.