Privacy Policy
Effective August 1, 2026
This policy explains what Shelf Collectibles LLC collects when you use Shelf Collectibles, why, and who else sees it.
1. What we collect
Account
You sign in through Privy, our authentication provider. Depending on how you sign in, Privy passes us a verified email address and, for a linked account such as Google, Apple, Twitch or X, the username or display name on it. We store that along with the username you choose here.
We never receive or store your password for any of those services. If you have an older account that predates Privy, any password we hold is stored only as a salted hash.
Orders
What you bought or sold, the price, and the shipping name and address you supply. Sellers supply their own business and payout details directly to Stripe.
Payments
We do not see, receive or store card numbers. Payment details go directly to Stripe. We keep Stripe's identifiers for a payment so we can match it to an order, issue refunds and handle disputes.
Content
Listings, photos you upload, reviews you write, offers and bids you make.
Technical
IP address, browser and device information, and request logs. We keep these to run the service, diagnose faults, and detect abuse such as bid manipulation or credential stuffing.
2. Why we use it
- To run the marketplace: accounts, listings, auctions, checkout, delivery.
- To take and return payments, including refunds and chargeback evidence.
- To tell you things you asked for: outbid alerts, wins, order updates.
- To keep it safe: fraud, abuse and security investigations.
- To meet our legal obligations, including tax and accounting records.
Where the law requires a lawful basis, ours is performance of our contract with you, our legitimate interest in operating and securing the service, and compliance with legal obligations. We do not sell your personal information.
3. Who else sees it
The seller you buy from receives your shipping name and address, and your order details. They need it to send you the item. They are an independent business and handle it under their own responsibilities.
We also use these processors:
- Privy: authentication and account identity.
- Stripe: payments, payouts, identity verification for sellers, disputes.
- Cloudflare: hosting and delivery of the site.
- An email provider, to send transactional notifications.
Shop pages may embed a seller's live stream from a third-party platform such as Twitch, YouTube, TikTok or Kick. Loading that embed connects your browser to them, and their privacy policy applies to that connection.
We may also disclose information where the law requires it, to enforce our terms, or as part of a merger or sale of the business, in which case we will say so before your data moves.
4. What other people can see
Your username, avatar, shop page, listings and reviews are public. Bids show a bidder's username. Your email address and shipping address are never public.
5. Cookies
We set a session cookie when you sign in. It is httpOnly, so scripts cannot read it, and it
holds a random token rather than anything about you. Privy stores login state in your browser so you are
not asked to sign in on every visit. We do not use advertising or cross-site tracking cookies.
6. How long we keep it
- Account data: while your account is open.
- Order and payment records: typically seven years after the transaction, to meet tax, accounting and chargeback obligations. These survive account deletion.
- Request logs: a short rolling window, then discarded.
- Sessions: expire automatically, and are deleted when you sign out.
7. Your rights
Depending on where you live, including under the New Jersey Data Privacy Act, the CCPA/CPRA in California, and the GDPR in the UK and EEA, you may have the right to access a copy of your data, correct it, delete it, object to or restrict how we use it, and to receive it in a portable form. You may also withdraw consent where we relied on it.
Email support@shelfcollectibles.com and we will respond within the time the applicable law allows. We will ask you to verify your identity first. We will not treat you differently for exercising a right.
Deleting your account does not delete records we are legally required to keep, such as completed transactions.
8. Security
Traffic is encrypted in transit. Session tokens are stored only as hashes, so a copy of our database does not yield a working session. Payment details never reach our servers. No system is perfectly secure, and we will tell you and any regulator that must be told if a breach affects your data.
9. International transfers
Our providers operate internationally, so your data may be processed outside your country, including in the United States. Where required, transfers rely on Standard Contractual Clauses or another approved safeguard.
10. Children
The Service is not for under-18s and we do not knowingly collect their data. If you believe a child has given us information, email us and we will delete it.
11. Changes
We will post any update here and change the effective date above. Material changes will be announced on the Service before they take effect.
12. Contact
Shelf Collectibles LLC, New Jersey, USA
support@shelfcollectibles.com
See also our Terms of Service.