Legal
Privacy policy
What is stored, why, and how to have it removed. Last reviewed with the M7 release.
Who runs this site
Pal Collector is an independent, unofficial fan site operated from Tokyo, Japan by a private individual. It is not affiliated with Pocketpair, Inc. or Bushiroad Inc. Questions about this policy, or any request below, go to [email protected].
What we store
- Your account
- An email address and a password, handled entirely by Supabase Auth. We never see or store the password itself — Supabase stores a hash of it. If you claim a username and a display name, those are public by design: they appear on your profile page and on any binder you publish.
- Your collection and binders
- Which card printings you own and how many, plus any binders you build: title, description, colour, the cards in them and their order. Collection data is private to your account. Binders are private by default; you choose per binder whether to make one unlisted (anyone with the link) or public (listed on your profile and in the sitemap). Public and unlisted binders count views — a total only, never who viewed.
- Newsletter subscribers
- If you subscribe, we store your email address, the date, and two random tokens: one to confirm the subscription and one to unsubscribe. It is double opt-in — the address receives nothing until you open the confirmation link — and every email carries a one-click unsubscribe. Subscribing does not create an account, and having an account does not subscribe you.
- Outbound marketplace clicks
- When you use one of the eBay or Amazon search buttons, we record which merchant, which card, and which page you came from. No identifier of you is stored with it — not your account, not an IP address, not a cookie value.
- Analytics
- Only if you chose “Accept analytics & ads”. We use PostHog on its EU cloud, so the data stays in the European Union. It records pages viewed and rough usage patterns. If you chose “Essential only”, PostHog is never loaded — not loaded-and-disabled, not loaded-in-anonymous-mode; the code is never fetched at all.
Cookies and local storage
Everything this site stores in your browser, in full. “Essential” items are needed for the site to work and are set regardless of your banner choice; everything else waits for consent.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| sb-…-auth-token | Cookie (essential) | Keeps you signed in. Set by Supabase Auth; chunked across several cookies. | Until sign-out or token expiry |
| pc_bv | Cookie (essential) | Remembers which binders this browser has already counted a view for, so a refresh does not inflate someone’s view count. Holds truncated binder ids, nothing about you. | Session — deleted when the browser closes |
| pc-consent-v1 | Local storage (essential) | Stores the choice you made in the privacy banner. | Until you change it or clear site data |
| pal-collector-theme | Local storage (essential) | Remembers dark or light mode. | Until you change it or clear site data |
| pc-counter-v1 | Local storage (essential) | The two-player counter’s current game, so a dropped phone does not lose it. Never leaves your device. | Until reset or you clear site data |
| ph_… (PostHog) | Cookie + local storage (analytics) | Distinguishes one visitor from another for aggregate usage statistics. Only set if you chose “Accept analytics & ads”. | Up to 12 months |
Change your mind at any time: . Clearing the choice also stops anything optional from loading until you answer again.
Advertising
Ad slots on this site show our own promos unless you have accepted ads. If you have, and third-party advertising is enabled on the deployment you are looking at, those slots may load Google AdSense, which sets its own cookies and may personalise what it shows. Declining leaves the slots filled with our own links and loads nothing from Google.
What we never do
- We do not sell or rent personal data. There is no arrangement under which we could.
- We do not share your email address with anyone except the provider that delivers it.
- We do not track you across other websites.
- We do not run analytics or advertising before you have said yes.
Who processes data for us
- Supabase — database, authentication and file storage.
- Cloudflare — hosting and content delivery.
- Resend — sends newsletter and confirmation email. Receives only the addresses on the list.
- PostHog (EU cloud) — analytics, and only with your consent.
- Google AdSense — advertising, and only with your consent, where enabled.
Your choices
You can unsubscribe from the newsletter with the link in any email, or by opening the unsubscribe page with the token from one. You can change or withdraw analytics and advertising consent at any time from the banner. To have your account and everything attached to it deleted — collection, binders, profile — email [email protected] from the address on the account and we will remove it. Deleting the account deletes the rest by cascade; nothing is kept afterwards except aggregate counts that identify nobody.
Depending on where you live you may also have the right to a copy of your data, to have it corrected, or to object to processing. Ask at the same address.
Children
This site is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has given us an email address, write to us and we will remove it.
Changes
If this policy changes materially the date at the top of this page moves. Continuing to use the site after a change means the new version applies.