Privacy Policy

1. Who we are

Comicmodity (“we”, “us”) runs comicmodity.com — a collection tracker, P2P exchange, and mystery-pack store. Contact us at privacy@comicmodity.com for anything privacy-related.

2. Data we collect

• Account data: display name, email address, and password (stored as a one-way hash, never plaintext). If you sign in with Google or Discord we receive your name, email, and avatar from them.
• Collection data: comics you add, including series, issue, variant, condition, purchase price, and currency.
• Catalog searches: series names and issue numbers you search for. Searches run through our server so your browser never sees our Metron API token.
• Technical data: IP address, browser user-agent, login history, and audit events (e.g. trades, pack opens, FMV changes) for fraud prevention and debugging.
• Payments (when enabled): processed by Stripe. We never see or store full card numbers — Stripe handles them directly.

3. How we use it

• Run your account, sessions, and collection.
• Proxy catalog searches to Metron and cache results to stay within rate limits.
• Prevent abuse, enforce rate limits, and keep the marketplace safe.
• Process pack orders, trades, and payouts via Stripe (when live).
• Send transactional emails (verification, password resets, shipping updates). No marketing spam.

Legal basis (EEA/UK): contract performance, legitimate interests (security, fraud prevention), and consent where required.

4. Third parties

• Metron (metron.cloud) — comic metadata and cover images. We send them your search terms; they don’t receive your account details.
• Google / Discord — only if you use them to sign in, under their own privacy policies.
• Stripe — payments, under Stripe’s privacy policy when packs/trades go live.

We don’t sell your personal data. Ever.

5. Cookies & sessions

We use strictly-necessary session cookies to keep you signed in (30-day expiry, revoked on password change) plus CSRF protection. No advertising trackers. Disabling cookies will sign you out.

6. Retention

We keep account and collection data while your account is active. Delete your account by emailing privacy@comicmodity.com and we’ll delete or anonymize it within 30 days, except where we must keep audit/payment records by law. Cached catalog data contains no personal information.

7. Your rights

Depending on where you live (GDPR/UK GDPR/CCPA), you can request access, correction, export, or deletion of your data, and object to or restrict processing. Email privacy@comicmodity.com from your account email and we’ll respond within 30 days. You can also complain to your local data protection authority.

8. Security

Passwords are hashed (argon2/scrypt via Better Auth), sessions are stored server-side in Postgres, and API tokens stay server-side. No system is 100% secure — use a unique password and tell us immediately if you suspect unauthorized access.

9. Children

Comicmodity is for ages 13+. Mystery packs are 18+ only. We don’t knowingly collect data from children under 13 — contact us and we’ll delete it promptly.

10. Changes

We’ll update this page when our practices change and bump the “Last updated” date. Material changes get an in-app or email notice.