Privacy policy

1. What data and why

• Account. When you sign in with Google we receive an identifier, email and, if Google sends it, a name or photo. This is used to authenticate you and store the album. Basis: performing the service (GDPR art. 6.1.b) and, for the email, contact.
• Album. Cromos, dust, credits, pity, the free pack date and age confirmation. Basis: performing the contract.
• Payments. Stripe processes pack purchases (when open) and voluntary contributions. We receive amount, status, session IDs and, if you are signed in, your user. We do not store card numbers. Basis: contract and accounting duties.
• Ideas / feedback. The text you send and, if there is a session, your user. Basis: legitimate interest in improving the album, or consent when you send it.
• Public album. If you have a username, others can see which cromos you have, not secret lore or the art of cards you do not own.

2. Processors and recipients

Google (sign-in), Supabase (database and authentication), Stripe (payments) and the front/API host (e.g. Netlify and Render). They may be outside the EEA with standard clauses or adequacy decisions. We do not sell your data.

3. Retention

For as long as the account exists and, for payments, the tax and accounting periods. Feedback is kept so it can be read. If you ask for deletion, we delete or anonymise what we are not required to keep by law.

4. Cookies

We use cookies or storage strictly needed for the session (Supabase / authentication) and to remember language. We do not use advertising cookies. There is no marketing banner because there is no ad tracking.

5. Your rights

Access, rectification, erasure, objection, restriction and portability. Write to pixelartgallery7@gmail.com. You can also complain to the Spanish Data Protection Agency (aepd.es).

6. Minors

Pack purchases are limited to people 18 or older. If you are a parent or guardian and a minor has created an account, contact us to close it.