Privacy policy
1. Data controller
The data controller is the publisher of the CapyDex service, an individual registered in France. Their full identity is provided on request.
Contact: contact@capydex.com.
2. Data we collect
When you create an account — display name, email address, password (stored hashed, never in plain text) and, optionally, a username used for referrals and sharing.
Each time you sign in — IP address and user agent, for account security and to detect suspicious sign-ins.
As you use the service — your collection data (cards and sealed products owned, purchase prices, notes, receipt photos), your wishlist and your notification preferences.
If you subscribe — a Stripe customer ID, or an Apple transaction ID for a subscription purchased on iOS. Payment details never pass through our servers.
If you sign in with a third party — when you sign in with Google, Apple or Discord, we receive your ID and email address with that provider. Linking Discord also gives us your username, which is used to assign roles on the CapyDex server.
3. Why we process your data
- Provide the service: catalogue, collection, prices, binders, wishlist
- Authenticate users and keep accounts secure
- Manage subscriptions and billing
- Send transactional emails and price alerts
- Measure traffic anonymously to improve the service
4. Legal basis
- Performance of a contract (Art. 6.1.b GDPR) — to provide the service you signed up for
- Consent (Art. 6.1.a GDPR) — for optional processing: Discord linking, price alerts, newsletter
- Legal obligation (Art. 6.1.c GDPR) — for retaining billing records
- Legitimate interest (Art. 6.1.f GDPR) — for account security and fraud prevention
5. Retention periods
| Data | Retention | Justification |
|---|---|---|
| Account and profile | As long as the account is active | Performance of a contract |
| Collection, wishlist, binders | As long as the account is active | Performance of a contract |
| Notifications | 90 days | Ease of use |
| Sign-in sessions | 7 days of inactivity | Security |
| Sign-in logs (IP, user agent) | 12 months | CNIL recommendation |
| Collection value snapshots | As long as the account is active | Performance of a contract |
| Billing records | 10 years after the last transaction | Legal obligation (Code de commerce, Art. L123-22 — French Commercial Code) |
| Receipt photos | As long as the account is active | Performance of a contract |
| Newsletter sign-up | Until you unsubscribe | Consent (double opt-in) |
If you delete your account, all data is erased immediately, except billing records, which are anonymised and kept for the legally required period.
6. Processors
Your data may be shared with the following processors:
- Stripe (United States) — payment processing on the web
- Apple (United States) — processing subscriptions purchased on iOS
- Resend (United States) — sending transactional emails and the newsletter
- PostHog (European Union, Frankfurt) — anonymous traffic measurement and error tracking, without cookies
- Cloudflare (United States) — DNS, image delivery and service protection
- OVH (France) — server and database hosting
- Discord Inc. (United States) — OAuth2 authentication and roles on the CapyDex server, only if you enable the link
- Google (United States) — OAuth2 authentication, only if you sign in with Google
These providers comply with the GDPR and, where applicable, are certified under the EU-US Data Privacy Framework.
7. Transfers outside the European Union
Some processors are based in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
8. Cookies
CapyDex uses only strictly necessary technical cookies. No advertising cookies and no third-party trackers. Full details are in our cookie policy.
9. Your rights
Under the GDPR, you have the following rights:
- Access (Art. 15) — find out what data we hold about you
- Rectification (Art. 16) — correct inaccurate data
- Erasure (Art. 17) — delete your account and your data
- Portability (Art. 20) — export your collection to CSV or PDF
- Objection (Art. 21) — object to processing based on legitimate interest
- Restriction (Art. 18) — ask us to suspend a processing activity
Export and account deletion are available directly in your account settings. For any other request, write to contact@capydex.com: we reply within 30 days.
10. Security
Passwords are stored hashed. All traffic is encrypted over HTTPS. Database access is restricted and backups are encrypted.
11. Minors
The service is not intended for children under 15 without the consent of a parent or legal guardian. If you become aware that a minor has created an account without that consent, please write to us and the account will be deleted.
12. Complaints
If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
13. Contact
For any question about your personal data: contact@capydex.com.
Last updated: 4 August 2026