Privacy Policy

ParkBound Collections ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, retain, and safeguard your information.

We take children's privacy seriously:

• Users under 13 use Explorer Mode, which does not require account creation.
• In guardian-consent regions, users aged 13-15 remain in local-only Explorer Mode unless and until ParkBound Collections offers an independently verified parent or guardian consent channel. A same-device attestation does not enable an account.
• Website account sign-in and account creation are restricted to users age 13 or older, and is unavailable to restricted users aged 13-15 in guardian-consent regions.
• We do not knowingly collect personal information from children under 13.
• Explorer Mode stores data locally on the device only and does not send personal data to our servers.
• AI pin scanning is disabled in Explorer Mode.
• No advertising is shown to users in Explorer Mode.
• No analytics or tracking is performed for users in Explorer Mode.

If you believe we have inadvertently collected information from a child under 13, please contact us at support@parkboundapps.com.

For users with account access (13+ in most regions and 16+ in configured guardian-consent regions), we collect:

• Account information: Email address, display name, profile picture (optional).
• Collection data: Pins you mark as owned, wanted, or traded.
• Optional account-linked product analytics: features used, scan counts, and app activity, collected only after you opt in.
• Device token: If you enable push notifications, we may store an Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) token to deliver them.
• User-generated content: Images you upload and contributions to pin data.
• Other user content: Card text, messages, trade details, reports, and other free-form information you choose to save or send.
• Gameplay content: Saved game state, scores, challenges, and achievements.
• Search and recommendation signals: Search terms and account activity used to return results and personalize the For You experience.
• Import data: CSV files you upload for collection tracking. This data is stored privately in your account and is not used for public database features, search indexing, recommendations, AI training, or analytics.
• Website essential storage: we store basic local settings (such as theme and consent choices) required for core website behavior and security.
• Optional website heatmap data: masked page views, clicks, pointer movement, and scroll depth collected only after you opt in. Session recording is disabled, and page text, inputs, and element attributes are masked.

We use your information to:

• Provide and improve our services.
• Sync your collection across devices.
• Enable social features (friend requests, friends lists, and activity feed).
• Process AI scan requests.
• Moderate content for safety.
• Send push notifications if you enable them.
• Communicate important updates.
• Personalize recommendations using your collection and activity signals.

We do not sell your personal information. We may share information with:

• Service providers who help operate our app (cloud hosting, AI services, ads).
• Law enforcement when required by law.
• Other users: Your public profile, collection (if public), and activity, based on your privacy settings.

We implement security measures intended to protect your information, including:

• Encrypted data transmission (HTTPS/TLS).
• Secure cloud infrastructure (Supabase).
• Image moderation to help prevent harmful content.
• Row-level security policies on our database.

ParkBound Collections uses the following third-party services:

• Supabase: database, authentication, and cloud storage.
• Google Gemini: AI pin identification. Pin images you scan are sent to Google's servers for processing and may be retained per Google's API terms.
• AWS Rekognition: content safety moderation for uploaded images.
• Google AdMob: advertising for eligible free-tier users aged 13+.
• Firebase: Android push delivery (Cloud Messaging and Installations), plus optional Analytics and Crashlytics only after you opt in.
• Meta App Events: optional app analytics only after you opt in; it is disabled again when you withdraw that choice.
• PostHog: optional website interaction heatmaps from masked click, pointer, and scroll data after you opt in. Session recording is disabled.
• RevenueCat: ParkBound+ subscription status and purchase history.
• Apple StoreKit and Google Play Billing: subscription and in-app purchase processing.
• eBay Partner Network: price lookups. Only search terms are sent; no personal data is shared with eBay. Some marketplace links may be affiliate links.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): delivering push notifications if you enable them.

Each service has its own privacy policy governing data use.

The app shows an in-product AI disclosure before first scan use and recurring scan-specific warnings in scan results.

For eligible account users on the free tier:

• We display ads through Google AdMob in the apps.
• On this website, Google AdSense is disabled for every visitor unless explicit ad consent is obtained and a signed-in, age-eligible account is confirmed (manage your choice any time from the "Privacy preferences" link in the footer).
• On iOS, we first resolve Google's regional consent flow and only request ads if that consent state permits it. We then use Apple's one-time App Tracking Transparency (ATT) prompt before any cross-company tracking.
• If you decline tracking, ads may be less personalized or limited. If regional consent is unresolved, no ad request is made.
• For users in the EEA, UK, or Switzerland, ad serving is disabled unless consent is obtained.
• Google's ads SDK may process device identifiers, ad interactions, diagnostics, IP-derived coarse location, and advertising data.
• ParkBound+ subscribers do not see ads.
• Users in Explorer Mode never see ads.

You have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your collection data (CSV) and create a file-backed personal-data export containing the server bundle and documented device-local categories.
• Opt out of analytics tracking via Settings.
• Update or withdraw website consent choices at any time via Cookie Preferences in the footer.
• Opt out of marketing communications.
• Object to data processing based on legitimate interest.

To exercise these rights, use the in-app settings or contact support@parkboundapps.com.

We retain your data as long as your account is active. Upon account deletion, personal data is removed or anonymized per system design and legal requirements.

• Account data is retained while your account is active.
• Upon account deletion, personal data is removed or anonymized.
• Operational logs are retained only as needed for security and reliability purposes.
• Public catalog contributions that other collectors rely on may remain only in de-identified form after account attribution is removed.
• Account deletion also removes local scan drafts, preferences, notification identity, and recreatable caches from that device. Temporary export files are kept only in app cache until replaced or cleared by you, the app, or the operating system.

We use essential local storage on the website for core functionality (for example, authentication, theme preference, and saved consent choices). Optional analytics and ads are disabled by default. They load only after opt-in and sign-in with an age-eligible account.

• You can change or withdraw consent any time using Cookie Preferences in the site footer.
• No optional vendor request is made until consent and age eligibility are both confirmed.
• You can disable analytics tracking in app Settings at any time.
• Explorer Mode (under 13) never collects analytics.
• When ads are enabled and the applicable Google consent flow and, on iOS, Apple ATT choice permit it, advertising partners may use device identifiers to personalize ads and measure performance.
• PostHog heatmaps are enabled only after analytics consent. Session recording is disabled, and page text, inputs, and element attributes are masked.

ParkBound Collections is operated from the United States. If you are located in the European Economic Area (EEA), UK, Switzerland, or Brazil:

• Your data may be transferred to and processed in the United States.
• For EEA/UK/Switzerland transfers, we rely on Standard Contractual Clauses and service provider agreements as the legal basis for these transfers where appropriate.
• For Brazil (LGPD Art. 33), international transfers are based on your consent to use the service and data processing agreements with our infrastructure providers (Supabase, Google, AWS).
• You have the right to lodge a complaint with your local data protection supervisory authority.
• Brazil users may exercise rights under LGPD, including confirmation of processing, access, correction, portability, and deletion or anonymization where applicable.
• Brazil users may also file complaints with the ANPD.

• Account data: Performance of contract (providing the service).
• Users aged 13-15 in configured guardian-consent regions: local-only Explorer Mode unless independently verified adult consent becomes available.
• Brazil (LGPD): Processing relies on applicable legal bases including contract performance, legal obligations, legitimate interests, and consent where required.
• Essential website storage: Legitimate interest (security and core functionality).
• Optional website analytics and ad personalization: Consent.
• App analytics: Consent — analytics is off by default and only collected if you opt in. You can withdraw consent anytime in Settings, which also deletes your previously collected analytics data.
• Image moderation: Legitimate interest (content safety).
• AI pin identification: Consent (you initiate each scan).
• Advertising: Consent (via ATT prompt).

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and, where required, notify affected individuals (GDPR Art. 34, LGPD Art. 48). Notification will be made via email and/or in-app alert.

Our designated data protection contact (Encarregado under LGPD Art. 41; point of contact for GDPR inquiries) is:

Tyler — support@parkboundapps.com

You may contact them regarding any privacy rights request, data processing inquiry, or complaint under GDPR, LGPD, or other applicable data protection law.

We may update this policy periodically. We will notify you of significant changes through the app. Continued use after changes constitutes acceptance.

For general questions or concerns:

support@parkboundapps.com