Privacy Policy

1. What we collect

Account data: your email address and a salted scrypt hash of your password (never the password itself), or your Solana wallet address if you sign in with a wallet, and a display name.

Collection data: cards you mark in your binder, cards you mint or list, the photos you upload, and your orders.

Redemption data: the recipient name, phone number and shipping address you enter when you redeem a vault card.

Technical data: a session cookie that keeps you signed in, your IP address for rate limiting, and the country your request comes from, which decides whether mystery packs are offered.

Usage data: which pages are viewed, where visitors came from, and anonymous counts of actions such as listing, bidding, buying and opening packs, with the amount and payment method. These events carry no email, wallet address or shipping address.

2. Public blockchain data

Wallet addresses, NFT ownership, listings and payments are recorded on the Solana blockchain. That record is public and permanent, and Idolca cannot delete it. We never write your email, name or shipping address on-chain.

3. How we use it

To run your account, process trades, escrow and redemptions, authenticate and store cards, prevent fraud and abuse, and comply with legal obligations. We do not send marketing messages.

4. How long we keep it

Shipping addresses are deleted 90 days after the card ships, or immediately if the redemption is cancelled. Expired sessions are deleted daily. Account and order records are kept while your account is open and afterwards as long as tax and anti-money-laundering rules require.

Unwatermarked originals of uploaded photos are kept for authentication; only watermarked versions are shown publicly.

5. Who processes it

Vercel hosts the site and Neon hosts the database; PostHog, in its EU region, processes usage data. All three process data on our behalf under their data processing terms. Shipping carriers receive the recipient name, phone and address for the shipment. We do not share personal data with anyone else unless the law requires it.

6. Your rights

You can ask for a copy of your data, ask us to correct it, or close your account and have your personal data deleted, except what we must keep by law and what is already public on the blockchain.

7. Cookies

Idolca sets one essential cookie for your session. The site remembers a few preferences, such as your last shipping address, in your own browser's storage. Usage analytics run without cookies or browser storage: PostHog recognises a visit by a privacy-preserving hash computed on its servers. We use no advertising or cross-site tracking cookies.