Privacy policy
Last updated: November 2, 2026
This policy explains what personal data CollectionDB collects, why, who receives it, how long it is kept, and how to use your rights under the General Data Protection Regulation (GDPR / RGPD) and the French "Informatique et Libertés" law. Short version: we collect what the site needs to work, we never sell your data, and there is no advertising or tracking.
1. Who is responsible
The data controller is Axordow Studios. For any question or request about your data, write to contact.axordow.studios@gmail.com.
2. Data we collect
Your account
- Username, email address and password (stored only as a secure hash, never in clear).
- If you sign in with Google, Discord or Twitter: the identifier of that account, and the email and name it shares with us. If you use a passkey: its public key (your fingerprint or face never leave your device).
- Account dates (creation, last visit), roles, experience, level and achievements.
- Your settings: date format, theme, currency, adult content filters, home feed and notification preferences, visibility of your profile and lists.
Your profile (optional)
- Location, gender, birthday and occupation, only if you fill them in.
- Profile picture, banner and background.
Your collection
- The items you wish for, ordered, own or owned, with what you add to them: quantity, price, shop, payment, shipping and delivery dates, tracking numbers, condition, score and notes.
- Your lists, favourites, watched items and entities, saved searches, shipments (destination, tracking number, shipping company, costs) and shelves (bookcases and where your items are placed).
Your contributions
- The items, entities, images and tags you add or edit, and the history of these changes, linked to your username.
- The reports you send on items or entities (reason, comment, date), and, if a moderator suspends your account, the date and the reason given.
Notifications
- The notifications sent to you, and, if you allow push notifications in your browser, the subscription your browser gives us (an address at your browser's push service and its keys).
Search by picture
- The photo you submit is compared with the catalogue and, if you are logged in and photo recognition is enabled, sent to an AI service to identify the item. We do not keep the photo after the search.
Technical data
- Your IP address, browser, the pages requested and their date, in the web server logs.
- Session and preference cookies, described on the cookies page.
We do not collect sensitive data (health, religion, political opinions…) and ask you not to put any in your profile or notes.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, your collection, lists, shipments, shelves and notifications | Performance of the contract (the terms of use) |
| Sign-in with Google, Discord or Twitter, push notifications, optional profile fields | Your consent, which you can withdraw at any time |
| Showing who contributed what, keeping the history of the catalogue, moderation | Legitimate interest: the quality and reliability of a shared database |
| Security: anti-spam check at sign-up, logs, limits on photo recognition, fighting abuse | Legitimate interest: protecting the site and its users |
| Service emails (password reset, notifications you enabled) | Performance of the contract |
| Answering requests from authorities | Legal obligation |
We do not use your data for advertising, we do not sell it, and we do not make automated decisions that have legal effects on you.
4. What others can see
- Your username, profile picture, banner, level and achievements are public.
- Your location, gender, birthday, occupation, wishlist, collection, watchlist and orders are shown according to the visibility you choose for each in your settings (public, friends, private or hidden).
- Your contributions to the catalogue and their history are public and show your username.
- Your email address, prices, notes, shipments and shelves are never shown to other users.
- Your reports are only seen by the moderators.
5. Who receives your data
Your data is used by Axordow Studios only, and by moderators and administrators to the extent needed for their role. It is processed on our behalf by these providers, each for its own part only:
| Provider | What for | Data |
|---|---|---|
| Our hosting provider (see the legal notice) | Hosting the site and the database | All the data above |
| Cloudflare, Inc. (Turnstile) | Checking that sign-ups are not robots | IP address, browser data |
| Fonticons, Inc. (Font Awesome) | Icons loaded on every page | IP address, browser data |
| Google LLC (Firebase libraries) | Scripts loaded on every page | IP address, browser data |
| X Corp. (embedded posts) | Showing the latest posts of an entity's X account on its page, loaded only on those pages | IP address, browser data, your X session if you are logged in to X |
| Google, Discord, Twitter / X | Signing in with these accounts, only if you choose to | Account identifier, email, name |
| Anthropic PBC | Identifying the item on a photo (search by picture) | The photo you submit, nothing else |
| Our email service provider | Sending service emails | Email address, message |
| Your browser's push service (Google, Mozilla, Apple…) | Delivering push notifications, only if you allow them | Push subscription, notification content |
We may also disclose data when the law requires it, for instance to a court or the police.
6. Transfers outside the EU
Some of the providers above are based in the United States. Transfers to them rely on the EU-US Data Privacy Framework when the provider is certified, or on the European Commission's standard contractual clauses.
7. How long we keep it
- Account, profile, collection and settings: as long as your account exists. They are deleted at once when you delete your account.
- Contributions to the catalogue (items, entities, images, edit history): kept after your account is deleted, as they are part of the shared database, but credited to "Deleted account" instead of you.
- Accounts unused for 3 years: we may delete them, after warning you by email.
- Password reset links: 15 minutes. Login session: until you log out, at most 6 months.
- Web server logs: at most 12 months.
- Emails you send us: as long as needed to answer, then at most 3 years.
8. Security
The site is only served over HTTPS, passwords are hashed, access to the servers and to the database is restricted, and backups are made before each update. No system is perfectly secure: if a breach puts your data at risk, we will inform you and the CNIL as the law requires.
9. Your rights
You have the right to:
- access your data and get a copy of it;
- correct it: most of it can be changed directly in your settings;
- delete it, by deleting your account yourself in your settings ("Delete my account");
- take it with you (portability): "Download my data" in your settings gives you all of it as a JSON file;
- object to processing based on our legitimate interest, or restrict it;
- withdraw your consent at any time (stop signing in with Google, Discord or Twitter, disable push notifications, clear optional profile fields);
- give instructions about your data after your death (French law).
For any other request, or if you can no longer log in, write to contact.axordow.studios@gmail.com from the email address of your account. We answer within one month. If you think your rights are not respected, you can file a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
10. Minors
CollectionDB is not meant for children under 15 without the consent of a parent or guardian. If you believe a child gave us data without that consent, contact us and we will delete it.
11. Changes
We will update this policy when the site changes how it uses data. The date at the top shows the latest version; important changes will be announced on the site or by email.