Privacy Policy

The controller responsible for CREW ATLAS is:

• Account data: email address, internal user ID, authentication records and password-reset information. Passwords are handled by Supabase Auth; CREW ATLAS does not receive or store your readable password.
• Service email data: email address, message type and content, send time, delivery status, bounce or error information and related technical metadata when we send account-confirmation, password-recovery or other necessary service and security messages.
• Collector profile: display name, up to four Crew Rose characters, region, preferred card language, collecting style and trade-status preference.
• MY ATLAS data: exact card printing IDs marked Have, Want or Watch, related state and update timestamps. Route progress is calculated from these states.
• Device-only data: local Passport details, card states and sync metadata may be stored in your browser's local storage. Account profile and card states are synced after sign-in. Obsolete local digest previews and analytics test logs are removed during normal use and are not treated as email consent.
• Technical and usage data:request time, page path, referrer, filtered query parameters, approximate country or city, device type, operating system and browser version. Hosting and security logs may also include IP address, user agent and request details.
• Communications: any information you send when you contact us or submit a privacy request.

If you join the optional Digest, we also process your email address, consent version and timestamps, confirmation status and delivery status. A subscription becomes active only after you use the email confirmation link. The Digest works without a collector account.

• create, secure and recover collector accounts;
• sync MY ATLAS, your Collector Passport, Crew Rose and card states across devices;
• provide collection, wishlist, watchlist and route-progress tools;
• send the optional Digest;
• operate, troubleshoot, protect and improve the service;
• respond to messages and privacy requests;
• comply with legal obligations and establish or defend legal claims.

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Contract: processing needed to create and operate the account and provide features you request.
• Legitimate interests:securing the service, preventing abuse, understanding aggregated usage and improving CREW ATLAS, balanced against your rights.
• Legal obligation: where records or disclosures are required by law.
• Consent: for the optional Digest. Consent is recorded when you submit the form and the address is activated through double opt-in. You may withdraw consent at any time through the management link in a Digest email.

Under the Swiss Federal Act on Data Protection, we process personal data in accordance with the principles of lawfulness, transparency, proportionality, purpose limitation and security.

• Supabase, Inc. provides authentication, the hosted database and account synchronization. Supabase processes customer data on our instructions. Supabase privacy information
• Vercel Inc. hosts the website, provides delivery infrastructure and supplies privacy-focused Web Analytics. Vercel Web Analytics privacy information
• Brevo (Sendinblue) delivers transactional account emails, Digest confirmation emails and the optional Digest. A Digest address is added to the central Digest list only after email confirmation. Unsubscribing removes that list membership without deleting the contact needed for separate account or security messages. Brevo processes recipient addresses, message content and technical delivery data on our instructions. Brevo privacy information

We may also disclose data where required by law, to protect rights and security, or in connection with a legitimate business transfer. We do not sell personal data and do not use it for cross-site behavioural advertising.

Card artwork is fetched server-side through CREW ATLAS's image delivery layer. Your browser does not directly request those images from the official card-image host.

Providers and their subprocessors may process data in Switzerland, the European Economic Area, the United States and other countries in which they operate. Where a destination does not provide an adequate level of protection, we rely on recognised contractual safeguards, including applicable standard contractual clauses and provider data-processing agreements, together with technical and organisational measures.

• Account, collector-profile and synced card-state data is kept while your account is active and then only as long as reasonably needed to complete deletion, maintain limited backups, meet legal obligations or resolve disputes.
• Browser local-storage data remains until you remove it, clear site data or the application replaces it.
• Vercel Web Analytics does not use cookies. Its temporary visitor identification is automatically discarded after 24 hours; aggregated statistics may remain according to our provider and project settings.
• Digest confirmation links expire after 48 hours. Pending, confirmed and unsubscribed Digest records are kept only as long as needed to operate subscriptions, document consent or withdrawal, prevent accidental sends, troubleshoot delivery and meet legal obligations.
• Transactional email and delivery records are retained according to our Brevo account settings and only as long as needed for delivery, troubleshooting, security and legal obligations.
• Security and operational logs are retained only for a period proportionate to troubleshooting, abuse prevention and legal needs.

Depending on where you live, you may have rights to information and access, correction, deletion, restriction, portability, objection and withdrawal of consent. Digest preferences and withdrawal are available through the management link in each Digest email. You may edit many collector details directly in MY ATLAS. For a copy of your data or account deletion, contact the address above. Signed-in collectors can also start a read-only data-copy request or a verified, manually reviewed deletion request from Account & data. We verify the account email before sharing or deleting account data. A deletion request does not itself delete anything; the exact scope must be confirmed again after we identify the connected account, Digest and Brevo records.

You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where applicable, your local EEA or UK data-protection authority. Swiss data-protection rights

We use access controls, encrypted transport, managed authentication and database row-level access rules designed to protect account data. No internet service can guarantee absolute security. Please use a unique password and tell us promptly if you suspect unauthorised access.

CREW ATLAS accounts are not intended for children under 16. If you believe a child has provided personal data contrary to applicable law, contact us so we can investigate and remove it.

CREW ATLAS does not use personal data to make solely automated decisions that produce legal or similarly significant effects.

We may update this policy when features, providers or legal requirements change. The date above shows the latest revision. Material changes will be highlighted appropriately. Questions and privacy requests can be sent to hello@crewatlas.app.