Last updated: August 26, 2026
This Privacy Policy explains how Collectiary ("we", "us", "our") collects, uses, and protects your personal data when you use the Service. Collectiary is operated by Laestrygon, an independent project based in Estonia. For any privacy question or request, contact us at support@collectiary.com - for the purposes of the General Data Protection Regulation (GDPR), we act as the data controller for this information.
1. What We Collect
Account data. Depending on how you sign up, we store your email address and a securely hashed password (we never store your password in plain text); or, if you sign in with Google, the name, email, and profile picture Google shares with us; or, if you register a passkey, the public key credential your device generates (your biometric data never leaves your device and is never sent to us).
Your content. The items, collections, places, and contacts you add to catalogue your collection, including any photos or notes you attach to them.
Technical data. Standard web request data (such as IP address) needed to operate and secure the Service.
2. Cookies
We use a small number of first-party cookies that are strictly necessary to run the Service:
- Session cookie - keeps you signed in during a visit
- "Remember me" cookie - keeps you signed in between visits, if you choose it
- Theme preference - remembers your light/dark mode choice
We do not use third-party advertising or analytics cookies, and we do not sell or share your data with data brokers or ad networks.
3. Why We Process Your Data, and Our Legal Basis
- Creating and maintaining your account - performance of a contract
- Storing and displaying your collection data - performance of a contract
- Keeping you signed in (session / "remember me") - performance of a contract, or consent for the optional "remember me" cookie
- Securing the Service against abuse - legitimate interest
4. Sharing Your Data
We don't sell your personal data. We share it only:
- with a Contact you explicitly choose to lend, gift, or record a sale to - solely the information relevant to that action;
- with Google, if you choose to sign in with Google, to the extent needed for authentication;
- with service providers who host or run the Service on our behalf, under obligations to protect your data;
- if required to by law.
5. Data Retention
We keep your data for as long as your account is active. If you ask us to delete your account (support@collectiary.com), we delete your personal data and content, except where we're required to keep limited records for legal or security reasons.
6. Your Rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- request erasure of your data;
- restrict or object to certain processing;
- receive your data in a portable format;
- lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact support@collectiary.com.
7. Children
The Service is not directed at children under 16, and we do not knowingly collect data from them.
8. Security
We use industry-standard measures to protect your data, including password hashing (PBKDF2) and encrypted, signed session cookies. No system is perfectly secure, and we can't guarantee absolute security.
9. Changes to This Policy
If we make material changes to this Policy, we'll update the "Last updated" date above and, where appropriate, notify you through the Service.
10. Contact
Questions about this Policy or your data? Email support@collectiary.com.