Privacy policy

1. Scope

This policy applies to the collect.ceo web service and the official collect.ceo Android app. The service helps people maintain personal catalogs, store item records, and optionally publish selected collections.

Before the app is published, the operator's privacy contact will be included in its Google Play listing; currently available data controls are in Account settings.

2. Data we process

• Account data: email address, display name, public handle, optional profile description, and a protected password hash.
• User content: collections, item records, photos, notes, tags, condition, storage location, provenance, documents, purchase value, valuation, and activity history.
• Technical data: sessions, activity timestamps, request information, security logs, and limited data needed to prevent abuse and process reports.
• Visibility settings and any profile or storefront information the owner chooses to publish.

3. Why we use data

• Create accounts, sign users in, protect sessions, and restore account context.
• Store, search, edit, import, export, and display collections and items.
• Upload and optimize photos, retry user-initiated uploads, and enforce private media access.
• Run public storefronts, moderate reports, diagnose failures, protect the service, and improve the product.

4. Android app and device

The Android app stores its session and read-only cache in encrypted form using keys held by Android Keystore. The cache makes previously loaded data viewable without a network connection; writes require a connection to the server.

• Camera and media access are used only after the user chooses to add a photo.
• The operating system handles biometric templates: collect.ceo never receives or sends fingerprint or face data to the server.
• A background task may retry a photo upload selected by the user after connectivity returns.
• The Android app contains no advertising identifier, advertising SDK, or product analytics SDK.

5. Collection privacy

A collection can be private, unlisted, or public. Private is available only to its owner; unlisted is accessible through its direct link; public may appear in the public catalog and search engines. The owner controls this setting.

Public item cards exclude private storage, value, provenance, and owner details unless a field is deliberately included in the bounded public projection.

6. Website analytics

The public production website uses Google Analytics, Yandex Metrica, and Microsoft Clarity. Under their respective policies, these services may receive browser network and technical data, device information, visited pages, and interaction data. The native Android app does not load these systems.

7. Sharing and protection

Data may be processed by infrastructure providers that deliver hosting, networking, content delivery, backup, and technical protection for the service. collect.ceo does not sell personal data or share it with advertising brokers.

Connections to the production service use HTTPS. Private APIs and media require a valid session, and state-changing requests receive additional CSRF protection.

8. Retention and deletion

Core data is kept while the account exists or for as long as it is needed for the chosen feature. Confirmed account deletion removes the account, collections, items, photos, and sessions from active storage.

Backups and limited security logs age out under their retention cycles. A minimal record may be kept longer only where necessary for security, abuse prevention, or a legal obligation.

9. Your controls

• Change the profile, password, collection visibility, and active sessions in Account settings.
• Download a complete account JSON export and a per-collection JSON/CSV export.
• Permanently delete the account in the web service or Android app after re-entering the password.

10. Policy changes

If collect.ceo materially changes how it processes data, this page and its publication date will be updated. Unless stated otherwise, a revised policy applies when it is posted.