Last updated: September 2, 2026
This Privacy Policy explains what information PopArchive collects when you use the app, how it's used, and the choices you have. It's part of our Terms of Service — using PopArchive means you agree to both.
| What | Why |
|---|---|
| Email address & password (stored as a bcrypt hash, never in plain text) | To create and secure your account, and to log you in |
| Two-factor authentication secret (optional) | If you enable it, to verify login codes from your authenticator app |
| Your collection data — item names, groups, prices paid, quantities, notes, dates, and any photos you attach or pull from eBay search | To run the core features of the app: your shelf, tickers, Sold Pops, Trash, and Wishlist |
| Session cookie | To keep you logged in between visits |
We don't currently use third-party advertising or analytics trackers, and we don't collect your physical address, phone number, or payment card details (a future paid tier would hand card details directly to a payment processor like Stripe — PopArchive itself would never see or store them).
To operate, maintain, and improve the Service; to send you account-related email (password resets, and in the future, a welcome email); to enforce our Terms and keep the Service secure; and to look up eBay listing data on your behalf when you search or request a price estimate.
| Service | What it's used for |
|---|---|
| eBay APIs | Powers box-art search, Buy Now links, Wishlist search, and Estimated Value. Your search terms are sent to eBay to retrieve listings; we don't send eBay your email, password, or other account details. |
| Resend | Sends transactional email (password reset links, and future account emails) to the email address you provide. |
| DigitalOcean | Hosts the app and database on servers located in the United States. |
| Backblaze B2 | Stores encrypted nightly database backups. |
| Stripe (planned, not live yet) | Will process payment for any future paid plan directly — PopArchive will not store your card details. |
We use a single session cookie to keep you logged in. It's required for the app to function and isn't used for advertising or cross-site tracking.
We keep your account and collection data for as long as your account is active. Items you remove go to Trash and are kept until you permanently delete them yourself or request full account deletion. Backups are retained for a limited period (currently 30 days) for disaster-recovery purposes only.
You can export your full collection at any time from inside the app (Export Excel). To request that your account and data be deleted entirely, contact us at [your contact email] — there's no self-serve delete-account button yet, so we handle these requests manually for now.
Passwords are hashed with bcrypt and never stored in plain text. Two-factor authentication (TOTP) is available and optional. The app is served over HTTPS. No method of storage or transmission is 100% secure, but we take reasonable, industry-standard measures to protect your data.
PopArchive is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, contact us and we'll delete it.
PopArchive's servers are located in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US.
We may update this Privacy Policy from time to time. If we make a material change, we'll make a reasonable effort to let you know before it takes effect.
Questions about this policy, or want to request your data be deleted? Reach us at [your contact email].