Updated May 13, 2026

Privacy Policy

Plain-language summary first, full detail below. Written for collectors who want to know what happens to account, wishlist, contribution, bias, favorite group, and marketplace data.

Your controls Create an account to choose what appears on your collector profile.

Create account

What we collect and why

We collect the information needed to run WhosYourPoca, personalize collector features, moderate contribution workflows, and keep the service reliable.

Information we collect

Email address, collected at registration to identify your account and send notifications.
Account credentials such as username and a one-way hashed password digest — your password itself is never stored in readable form.
Collection content you create — wishlists, biases, favorite groups, and contribution submissions.
Content you choose to provide, including profile details, avatars, collection and wishlist names, descriptions, covers, photocard contribution images, report details and scanned images, redemption links, and shipping information when needed for prize or redemption fulfillment.
IP address and the User-Agent header sent by your browser (which identifies the browser and operating system), used for abuse prevention and service reliability. Some of this data is also processed by our sub-processors below.
Shipping data — recipient name and address — collected only when needed for prize or redemption fulfillment, used solely for that fulfillment, and deleted after delivery is confirmed plus 30 days.

How we use it

We use this data to personalize collection views, remember collector preferences, prevent abuse, maintain service reliability, and communicate important account or product updates.

Provide access to website features and your account.
Send updates or informational communications when you have opted in.
Improve website functionality and user experience based on aggregated usage.

Cookies and browser storage

We use cookies and browser storage to keep WhosYourPoca working reliably and to remember small product preferences. Cookies are small files saved by your browser, while local storage and session storage are browser storage areas used by websites. We use them for login, security, referral attribution, feature state, and user experience.

Required cookies — session cookies keep you signed in. CSRF cookies help confirm that forms and account actions really come from your browser. Blocking these cookies may prevent login, uploads, settings changes, or other core actions from working.
Referral cookie — when you arrive through a referral link, we store a short-lived referral cookie for up to 24 hours so a signup can be credited to the collector who invited you.
Local storage — used to remember preferences and feature state on your device, such as gacha sound settings and gacha binder progress. We may also use local storage as a fallback to remember that you dismissed a contribution raffle popup if the account-level dismissal cannot be saved. Local storage data stays in your browser until you clear it, it is overwritten, or WhosYourPoca removes it.
Session storage — used for temporary page state during a browser session, such as restoring your scroll position when you go back to a list or keeping a temporary report/scanner image reference while you finish a report. Session storage is usually cleared when the browser session ends.
No third-party behavioral advertising — we do not use cookies or browser storage for third-party behavioral advertising.

Legal basis and age limits

Where applicable data protection laws require a lawful basis, we rely on the basis that matches the feature being used. Some features also have minimum age requirements.

Legal basis

Your consent — for example, when subscribing to updates.
Our legitimate interest in maintaining, securing, and improving the service.
Contractual necessity to provide the account features you request and to fulfill prizes you have won through the referral raffle.

Age limits and minors

WhosYourPoca is intended for collectors who are at least 16 years old. We do not knowingly collect personal information from anyone under 16. Raffles, wallet redemptions, prize fulfillment, and any feature that requires a shipping address are limited to collectors who are at least 18 years old. If you believe someone under 16 has provided personal information to WhosYourPoca, contact us so we can review and delete it where appropriate.

Data storage and retention

Data is stored securely using industry-standard measures, including encryption in transit and access controls on the backend. Personal data is retained only as long as needed for the purpose it was collected, then deleted or anonymized. Our current retention categories are:

Account data — email address, username, login credentials, profile settings, visibility settings, collection records, wishlists, biases, favorite groups, and related account content are kept while your account is active. After account deletion, they are deleted or anonymized within 30 days unless a specific exception below applies.
Referral data — referral cookies are kept for up to 24 hours. Server-side referral attribution records, if created, are kept only as long as needed to apply referral credit, run the raffle, prevent abuse, and keep a minimal fulfillment record.
Uploaded images and contribution records — private uploads are kept while needed for the feature you used and are deleted or anonymized with your account or when you remove the related content. Contribution images, scanned images, reports, and catalog records may be kept while needed to review submissions, resolve reports, maintain catalog integrity, document moderation decisions, or preserve an anonymized catalog entry.
Shipping data — recipient name and shipping address for prizes or redemptions are kept until delivery is confirmed plus 30 days for incident handling, then the address fields are deleted. A minimal fulfillment record, such as raffle entry, ship date, and tracking number where applicable, may be retained without the delivery address.
Logs and security records — request logs, IP address, User-Agent data, authentication events, and security records are kept for a limited operational and security period, typically up to 90 days, unless needed longer to investigate abuse, fraud, a security incident, or a legal request.
Messages and support content — if you send us personal or sensitive information through comments, support emails, reports, or any other product channel, you may contact us to request deletion or redaction. We will remove or redact it where appropriate, unless we need to keep it temporarily for an active dispute, safety, abuse, legal, fulfillment, or rights request.
Support and data-rights requests — support emails and privacy-rights requests are kept until resolved and then for up to 24 months so we can understand prior issues and show how we handled privacy requests.
Backups — deleted data may remain in encrypted backups for up to 90 days before automatic rotation removes it. Backups are used for disaster recovery, not to restore deleted account content as an active product feature.
Legal, safety, and abuse exceptions — if data is relevant to an active dispute, security incident, abuse investigation, chargeback, legal obligation, or rights request, we may keep the relevant data until that matter is resolved and any required recordkeeping period ends.

Providers and shipments

We use service providers to operate WhosYourPoca. They process personal data only as needed to provide hosting, storage, authentication, email delivery, security, image processing, shipping, and optional seller-sync features. Some providers may process data outside the EEA. Where that happens, we rely on appropriate transfer mechanisms where applicable, such as European Commission adequacy decisions, the EU-U.S. Data Privacy Framework for participating U.S. providers, or Standard Contractual Clauses and data processing terms offered by our service providers.

Sub-processors and data location

Heroku (Salesforce, Inc.) — hosting, request logs, IP address, and User-Agent data.
Supabase, Inc. — database and storage for uploaded images, account data, profile data, collections, wishlists, contributions, reports, and redemption records.
Google LLC — optional sign-in via Google OAuth, used only if you choose to sign in with Google.
Discord, Inc. — optional sign-in via Discord OAuth, used only if you choose to sign in with Discord.
Resend — account emails, password reset emails, contribution emails, and inbound support emails.
Correos (Sociedad Estatal Correos y Telégrafos, S.A.) — recipient name and address, used only for prize or redemption shipping.
Frontend asset and CDN providers, including Google Fonts, Iconify, jsDelivr, cdnjs, and Tailwind CDN — fonts, icons, scripts, and static assets. These providers may receive technical request data such as IP address and User-Agent when your browser loads those assets.

Prize and redemption shipments

If you receive a prize or redemption shipment, we share the recipient name, shipping address, and shipment details with Correos so the letter or package can be delivered.

Shipments within the EEA — Correos uses the shipment data needed to process and deliver the letter or package.
Shipments outside the EEA — Correos may need to share shipment details with customs authorities and the postal operator in the destination country. These transfers are necessary to fulfill the shipment you requested or won.

Visibility and external sources

Some WhosYourPoca features are designed for public collector identity, while marketplace and external-source features point to third-party services with their own rules.

Visibility and sharing

Collections, wishlists, biases, favorite groups, and profile fields may be shown publicly only when a related profile or list visibility setting allows it. Private profiles and lists are treated as private inside the product experience.

Marketplace and external sources

Marketplace listings can include third-party source links and public listing metadata. External marketplaces have their own terms, privacy practices, availability rules, and seller policies.

Your rights and controller

You can update account settings, change profile visibility, and edit or remove collection and wishlist content directly in the product. Where applicable data protection laws apply, you also have rights over your personal data.

Your rights and choices

Access your personal data and request a copy.
Request rectification or deletion of inaccurate or unwanted data.
Withdraw consent at any time, where processing relies on consent.
Request portability of the data you have provided.
Request that we restrict certain processing where applicable.
Object to processing based on legitimate interests where applicable.
Lodge a complaint with your local data protection authority.

Data controller and contact

WhosYourPoca is currently operated by its founder as an individual sole operator, not as a separate incorporated company. The operator acts as the data controller for personal information processed through this service. For privacy questions, account-data requests, or to exercise any of the rights described above, contact us at hello@whosyourpoca.com.

Questions?

Email hello@whosyourpoca.com for policy, account, or data-request questions.