Privacy policy.

HobbyTrack is a fan-made sticker album tracker, not affiliated with Panini or FIFA. This page explains, in plain language, what data we store when you use it, why we store it, and the rights you have over it under the EU General Data Protection Regulation (GDPR).

Who is responsible

HobbyTrack is operated as a personal project. For anything related to your data, contact macoveifelix@gmail.com.

What we store

• Account: your username, email address, and a bcrypt hash of your password. We never store the password itself.
• Collection: which stickers you own, in which parallel colors, and how many of each.
• Social: your friend connections and friend requests, trade offers you send or receive, and the messages you exchange with friends.

That is the whole list. There are no analytics, no advertising identifiers, no tracking pixels, and no profiling.

Why we store it (legal basis)

• To provide the service you signed up for — tracking your album, showing your public doubles page, trading and messaging with friends (Art. 6(1)(b) GDPR, performance of a contract).
• To keep the service safe — preventing abuse and securing accounts (Art. 6(1)(f) GDPR, legitimate interest).

What is public

Your username and your doubles page at /u/<username> (spare stickers available for swapping, and your collection progress) are visible to anyone with the link. Your email, exact collection, trades, and messages are never public. Messages are visible only to you and the friend you exchange them with.

Where it is stored

Data lives in a MongoDB Atlas database. We share it with no one — no third-party analytics, ads, or marketing services. Messages are stored so both participants can read the conversation; they are not end-to-end encrypted, so don't share sensitive personal information in them.

Cookies & local storage

HobbyTrack uses exactly one cookie: ht_session, an essential httpOnly cookie that keeps you signed in for up to 30 days. It is strictly necessary for the service to work, so it does not require consent. We also keep small device-local preferences (like dismissing the cookie notice) in your browser's localStorage — these never leave your device. There are no tracking or advertising cookies.

How long we keep it

Everything is kept until you delete your account. Deletion is a hard delete: your account, collection, friendships, trades, and every conversation you are part of are permanently removed — there is no recovery. If you were friends with someone, your conversations disappear for them too.

Your rights

• Access & portability — use Download my data on your profile page to get everything we store about you as a JSON file, any time.
• Erasure — use Delete account on the same page for immediate, permanent deletion.
• Rectification, restriction, objection — email us and we will sort it out. You also have the right to lodge a complaint with your local data protection authority.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for significant changes, let you know in the app.