Privacy Policy

1. Data we collect

• Account: email address, username, full name and password (stored only in encrypted, hashed form).
• Identity and age: first name, last name and date of birth. Your date of birth is never shown to anyone; we use it only to apply our age rules (accounts from 13, messaging from 18). We also record whether you have confirmed your email address.
• Profile: profile picture, banner, bio, city and country, social links — everything you choose to add.
• Collections: the collections you create, the items you own, purchase details you enter (year, price, condition), photos you upload, your favourite items.
• Safety: reports you send about other users, and reports that concern you. A report sent from a conversation includes a copy of the last messages of that conversation, so that we can review it.
• Activity: people you follow, messages you send to other users, notifications, collection requests you send us.
• Payments: if you subscribe to Premium, Stripe processes your payment and gives us your subscription status and a customer reference. We never receive your full card number.
• Technical data: basic logs (such as IP address, browser type, dates and errors) kept by our hosting providers for security and to fix problems, plus the cookies described below.

2. Why we use it

• To provide Kollek and your account (performance of our contract with you): showing your profile and collections, messaging, Premium features, password resets.
• To keep Kollek safe and working, prevent abuse and improve the service (our legitimate interests).
• To protect our users, especially younger ones: checking your age for messaging, confirming your email address, reviewing reports and acting on abuse (our legitimate interests and, where it applies, our legal obligations).
• To handle payments, tax and accounting (legal obligations).
• To send you service emails such as password resets. We do not send marketing emails without your consent, and we do not sell your personal data.

3. What other users can see

Your username, name, profile picture, banner, bio, location, social links, followers, collections, items and the photos you add to them are public on Kollek. Your email address, purchase prices and messages are not shown publicly; messages are visible only to you and the people you exchange them with.

Your date of birth, the reports you send and the identity of who reported you are never shown to other users.

4. Service providers

We use trusted providers to run Kollek, who process data only on our instructions: Vercel (website hosting), Railway (application hosting), MongoDB Atlas (database), Google Cloud Storage (images), Stripe (payments), Resend (emails) and Google ("Continue with Google" sign-in, if you use it: we receive your name and email address). Some of them store or access data outside the UK, for example in the United States or the European Union; when they do, transfers are protected by the safeguards required by UK law, such as UK adequacy regulations or the International Data Transfer Agreement / Addendum.

We may also share data if required by law or to protect the rights and safety of our users or of Kollek.

5. How long we keep it

We keep your data while your account is open. When you delete your account (account menu > "Delete account") or ask us to, we delete your profile, collections, photos and messages within 30 days, except data we must keep by law (for example payment records, kept for 6 years) and copies in backups, which are overwritten within a limited time.

Reports, and the messages copied into them, are kept for up to 2 years after they are handled, or longer if needed for a legal claim or a request from the authorities.

6. Cookies and local storage

Kollek only uses cookies and browser storage that are needed for the site to work: a sign-in cookie that keeps you logged in, and preference settings for your language, currency and light/dark theme. We do not use advertising or third-party tracking cookies, so no consent banner is needed. If this changes, we will ask for your consent first.

7. Your rights

Under UK data protection law you can ask to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its use. Most profile information can be edited directly on Kollek; for anything else, write to kollek.app@gmail.com and we will answer within one month.

If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to sort it out with you first.

8. Children

You must be at least 13 years old to use Kollek. We ask for your date of birth when you sign up and refuse accounts under 13. If you believe a child under 13 has an account, contact us and we will delete it.

Private messaging is only available to users aged 18 and over who have confirmed their email address: users under 18 cannot send or receive messages.

Anyone can report a user from their profile or a conversation. We review reports, and we may suspend accounts and pass child-safety concerns to the police or other competent authorities.

9. Changes

We may update this policy. The date at the top shows the latest version; if the changes are significant we will let you know on the site or by email.