Last updated: October 22, 2026
This Privacy Policy explains what information PopArchive collects when you use the app and our public pages (including Value Check), how it's used, and the choices you have. It's part of our Terms of Service — using PopArchive means you agree to both.
| What | Why |
|---|---|
| Email address & password (stored as a bcrypt hash, never in plain text) | To create and secure your account, and to log you in |
| First name (optional) | To greet you by name in emails |
| Two-factor authentication secret (optional) | If you enable it, to verify login codes from your authenticator app |
| Your collection data — item names, groups, prices paid, quantities, notes, dates, UPCs, and any photos you take, upload, or pull from eBay search | To run the core features of the app: your shelf, tickers, Sold Pops, Trash, and Wishlist |
| How you found us — your optional answer to "How did you hear about us?" and, once at signup, the campaign link or website you arrived from (for example "facebook.com") | To learn which of our posts and outreach actually help collectors find PopArchive |
| Email preferences | To remember whether you opted in to collecting tips and value updates |
| Subscription details — your plan, subscription and trial status, and a Stripe customer reference (never your card number) | To give you the right features and let you manage billing |
| Support requests — your messages and any files you attach | To answer your questions and fix problems |
| Value Check alerts — your email address and the Pop you asked about (no account needed) | To email you when new eBay listings for that Pop show up, only after you confirm your email |
| Basic activity, such as when you log in | To keep accounts secure and understand overall usage |
| Server access logs — your IP address, the date and time, the page you requested and your browser type, when you visit the app or our public pages | To keep the Service secure, investigate abuse and fix problems. Deleted automatically after 30 days. |
| Session cookie | To keep you logged in between visits |
We don't use third-party advertising trackers. On our public pages (the marketing site, Value Check, signup and pricing) we use Umami, a privacy-friendly analytics service that counts page visits without cookies and without collecting personal information, so we can see which pages people find useful. We don't collect your physical address or phone number, and PopArchive never sees or stores your full payment card details — those go directly to Stripe.
To operate, maintain, and improve the Service; to manage your subscription and billing; to send you account-related email (email verification, password resets, a welcome email, trial and billing notices, and support replies); to send collecting tips and collection-value updates, only if you tick the optional box at signup (you can unsubscribe from any of these emails at any time using the link at the bottom); to send new-listing emails for a specific Pop if you request them on our free Value Check page, only after you confirm your email address; to understand which outreach brings new collectors to PopArchive; to enforce our Terms and keep the Service secure; and to look up eBay listing data on your behalf when you search or request a price estimate.
Some features share limited information with other users, as described in Section 6 of our Terms of Service: Pop product details (name, number, series, variants, UPC — never your prices, notes, or account details) can help build our shared Pop database; box photos are shared as Box Art only if you turn on Photo Sharing; and your collection is visible to others only through a share link you create.
Our free public Pop pages (Value Check) show Pop product details only — name, box number, series, category, and variants — plus current eBay listings. A Pop appears there only once its details are confirmed through the shared Pop database, or at least two collectors have added it, or it's in PopArchive's own reference collection. These pages never show who owns a Pop, how many people own it, or any of your personal or account information, and the box photos on them are PopArchive's own.
We don't sell or rent your personal information.
| Service | What it's used for |
|---|---|
| eBay APIs | Powers box-art search, Buy Now links, Wishlist search, the current listings on Value Check pages, and Estimated Value in the app. Your search terms are sent to eBay to retrieve listings; we don't send eBay your email, password, or other account details. |
| Stripe | Processes Curator Account subscription payments and runs the Manage billing portal. Your card details go directly to Stripe; we receive only your plan, subscription status, and a customer reference. For some purchases Stripe or an affiliate acts as the seller of record and handles sales tax. |
| Anthropic (Claude) | Reads the details printed on a box photo when you use "Autofill from Box Photo." Only the photo you choose is sent, and under Anthropic's commercial terms it isn't used to train their models. |
| Resend | Sends account email (verification, password resets, welcome, trial and billing notices, support replies) and, only if you opted in, collecting tips and value-update emails to the email address you provide. |
| Cloudflare | Delivers and protects our websites. All traffic to poparchive.club and the app passes through Cloudflare, which sees your IP address and blocks automated abuse. It also forwards email sent to [email protected]. |
| Umami | Counts visits to our public pages (which pages, referring site, device type and country) without cookies or personal information. |
| DigitalOcean | Hosts the app and database on servers located in the United States. |
| Backblaze B2 | Stores encrypted nightly database backups, box photos you take or upload, and files attached to support requests, which are stored privately and can only be opened by our staff and the person who sent them. Box photos are served from web addresses that are hard to guess but aren't password-protected, so please don't include personal information in them. |
We use a single session cookie to keep you logged in. It's required for the app to function and isn't used for advertising or cross-site tracking.
We keep your account and collection data for as long as your account is active. Items you remove go to Trash and are permanently deleted automatically after 7 days, unless you restore them first. Completed support requests are deleted 14 days after they're resolved. Value Check alerts are kept until you unsubscribe. Backups are retained for a limited period (currently 30 days) for disaster-recovery purposes only. Server access logs are deleted automatically after 30 days. Pop product details in the shared database, and box photos you chose to share, may remain after your account is deleted, but they aren't shown with your name. Stripe keeps billing records as required for tax and accounting.
Passwords are hashed with bcrypt and never stored in plain text. Two-factor authentication (TOTP) is available and optional. The app is served over HTTPS. No method of storage or transmission is 100% secure, but we take reasonable, industry-standard measures to protect your data. We'll never ask for your password or full card number by email — if you get a message like that claiming to be from PopArchive, please forward it to support.
PopArchive is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, contact us and we'll delete it.
PopArchive's servers are located in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US.
We may update this Privacy Policy from time to time. If we make a material change, we'll make a reasonable effort to let you know before it takes effect.
Questions about this policy, or want to request your data be deleted? Reach us at [email protected].