Privacy

Privacy policy

Last updated September 24, 2026 · Draft, pending legal review

Hobby Register keeps as little about you as it can. This page says what we collect, who can see it, and how to have it deleted.

Checking a card leaves no trace

Looking up a card doesn't need an account, and we don't record who checked what: lookups aren't logged against you or the card. We keep daily totals only, such as how many checks ran that day.

What we collect

• Your email address, when you sign in to report, dispute, add photos, register a card or watch one. It's the only thing we store about you as a person. There are no passwords or profiles.
• What you submit: reports (type, dates, location, details and evidence such as police reports, claims or receipts), sightings, photos, disputes and reference photos of cards you own. Location data is stripped from every photo before it's stored.
• Your IP address, to limit how often sign-in codes, anonymous sightings and removal requests can be sent. We store only a keyed hash of it, never the address, and delete it after two days.
• Cookies: a sign-in session cookie and a theme cookie (light or dark). No advertising or tracking cookies.

What's public, and what isn't

Card pages show each report's type, status, evidence level and dates, sightings with a thumbnail and date, and outcomes. They never show your name or email. Your evidence files, reference photos, location details and identity are visible only to you and to moderators. A shared report is a copy of the public card page and carries nothing more.

Who else sees it

• Moderators can see everything, including the email behind a report, to review it.
• A thumbnail of your first photo shows on the card page, and a moderator may publish your photos there after review. Your name never appears.
• Valid legal process, such as a subpoena or court order, could require us to disclose the email address behind a report.
• Service providers that run the site for us: Vercel (hosting), Supabase (database, file storage and sign-in), Resend (email), Cloudflare (domain, email routing and the Turnstile spam check, which reads signals from your browser to tell real visitors from bots), and PSA (cert numbers are looked up in PSA's database).

We don't sell your information or use it for advertising.

Emails

We email you about your own reports and disputes, and about cards you watch. You can change or stop watch alerts from any alert email or from your watches. We record whether messages bounce so we stop sending to addresses that don't work.

Keeping and deleting your data

We keep your email while you have open reports, disputes or watches. Once your cases are closed you can ask us to delete your email and personal data: send a removal request for your personal information from the same email address. Reports you filed stay in the card's history without an owner, because the record is only useful if it's complete.

Children

Hobby Register isn't meant for children under 13, and we don't knowingly collect their information.

Changes

If we change this policy, we'll update the date at the top.

Contact

Privacy questions or requests: use the removal request form.

See also: Terms of use · Privacy policy · Request removal