Privacy Policy

ParkBound Apps LLC is the controller of ParkBound Collections ("we", "our", "us"). This policy explains how we collect, use, retain, and safeguard your information.

We take children's privacy seriously:

• Users under 13 use Explorer Mode, which does not require account creation.
• In guardian-consent regions, users aged 13-15 remain in local-only Explorer Mode unless and until ParkBound Collections offers an independently verified parent or guardian consent channel. A same-device attestation does not enable an account.
• Website account sign-in and account creation are restricted to users age 13 or older, and is unavailable to restricted users aged 13-15 in guardian-consent regions.
• We do not knowingly collect personal information from children under 13.
• Explorer Mode stores data locally on the device only and does not send personal data to our servers.
• AI pin scanning is disabled in Explorer Mode.
• No advertising is shown to users in Explorer Mode.
• No analytics or tracking is performed for users in Explorer Mode.

If you believe we have inadvertently collected information from a child under 13, please contact us at support@parkboundapps.com.

For users who are eligible for account access under the age screen shown in the app, we collect:

• Account information: Email address, display name, profile picture (optional).
• Collection data: Pins you mark as owned, wanted, or traded.
• Optional account-linked product analytics: features used, scan counts, and app activity, collected only after you opt in.
• Device token: If you enable push notifications, we may store an Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) token to deliver them.
• User-generated content: Images you upload and contributions to pin data.
• Other user content: Card text, messages, trade details, reports, and other free-form information you choose to save or send.
• Gameplay content: Saved game state, scores, challenges, and achievements.
• Search and recommendation signals: Search terms and account activity used to return results and personalize the For You experience.
• Explorer discovery activity: Pins revealed, skipped, saved, or opened; selected discovery themes; session identifiers; and interaction timing used to operate discovery, XP, streaks, and achievements. This is account-linked service data, separate from optional product analytics.
• Import data: CSV files you upload for collection tracking. This data is stored privately in your account and is not used for public database features, search indexing, recommendations, AI training, or analytics.
• Website essential storage: we store basic local settings (such as theme and consent choices) required for core website behavior and security.
• Service-region check: our hosting provider derives a coarse country code from the request IP address. We use the request-time result to decide whether new account registration or web checkout is available. We do not request precise location for this check or add the country result to your account.
• Optional website heatmap data: masked page views, clicks, pointer movement, and scroll depth collected only after you opt in. Session recording is disabled, and page text, inputs, and element attributes are masked.

We use your information to:

• Provide, maintain, and secure our services.
• Sync your collection across devices.
• Enable social features (friend requests, friends lists, and activity feed).
• Process AI scan requests.
• Moderate content for safety.
• Send push notifications if you enable them.
• Communicate important updates.
• Personalize recommendations using your collection and activity signals.
• Improve the service using optional analytics only when you have opted in.

We do not sell your personal information. We may share information with:

• Service providers who help operate our app, limited to the information needed for the feature or service involved (such as cloud hosting, AI processing, billing, notifications, and advertising).
• Law enforcement when required by law.
• Other users: Your public profile, collection (if public), and activity, based on your privacy settings.

We implement security measures intended to protect your information, including:

• Encrypted data transmission (HTTPS/TLS).
• Secure cloud infrastructure (Supabase).
• Image moderation to help prevent harmful content.
• Row-level security policies on our database.

ParkBound Collections uses the following third-party services:

• Supabase: database, authentication, and cloud storage.
• Vercel: website hosting and the request-time coarse country code used for service availability and abuse prevention.
• Google Gemini: AI pin identification. Pin images you scan are sent to Google's servers for processing and may be retained per Google's API terms.
• AWS Rekognition: content safety moderation for uploaded images.
• Google AdMob: advertising for eligible standard-age free-tier accounts. Child, teen, unresolved-age, and ParkBound+ accounts do not receive ads.
• Firebase: Android push delivery (Cloud Messaging and Installations), plus optional Analytics and Crashlytics only after you opt in.
• Meta App Events: optional app analytics only after you opt in; it is disabled again when you withdraw that choice.
• PostHog: optional website interaction heatmaps from masked click, pointer, and scroll data after you opt in. Session recording is disabled.
• Google Ads: a website conversion tag that loads only after ad consent and an age-eligible signed-in account are confirmed.
• Meta and TikTok: website advertising pixels that load only after ad consent and an age-eligible signed-in account are confirmed. Meta App Events on Android remains a separate optional app-analytics choice.
• Discord: optional sign-in, linked trading identity, private trade and Trade Night room coordination, and outbound community links. ParkBound does not read or store the messages people send in Discord rooms.
• RevenueCat: ParkBound+ subscription status and purchase history.
• Apple StoreKit and Google Play Billing: subscription and in-app purchase processing.
• eBay and marketplace search providers: price lookups. We send the item search query needed for the lookup, but do not intentionally send your ParkBound account identifier. Search text can itself contain personal information, so do not put personal information in a marketplace search. Some marketplace links may be affiliate links.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): delivering push notifications if you enable them.

Each service has its own privacy policy governing data use.

The app shows an in-product AI disclosure before first scan use and recurring scan-specific warnings in scan results.

For eligible account users on the free tier:

• We display ads through Google AdMob in the apps.
• The ParkBound Collections website does not display Google AdSense ads. The main ParkBound Apps website may display ads on editorial articles only after explicit ad consent and account eligibility are confirmed.
• On iOS, we first resolve Google's regional consent flow and only request ads if that consent state permits it. We then use Apple's one-time App Tracking Transparency (ATT) prompt before any cross-company tracking.
• If you decline tracking, ads may be less personalized or limited. If regional consent is unresolved, no ad request is made.
• For users in the EEA, UK, or Switzerland, ad serving is disabled unless consent is obtained.
• Google's ads SDK may process device identifiers, ad interactions, diagnostics, IP-derived coarse location, and advertising data.
• ParkBound+ subscribers do not see ads.
• Users in Explorer Mode never see ads.

You have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your account and associated data.
• Ask us to restrict particular processing where that right applies.
• Export your collection data (CSV) and create a file-backed personal-data export containing the server bundle and documented device-local categories.
• Opt out of analytics tracking via Settings.
• Update or withdraw website consent choices at any time via Cookie Preferences in the footer.
• Opt out of marketing communications.
• Object to certain processing where applicable law gives you that right.
• Complain to the privacy regulator that covers you.

To exercise these rights, use the in-app settings or contact support@parkboundapps.com. We may need to verify your identity. Where the GDPR applies, we ordinarily respond within one month, subject to its permitted extensions. Withdrawing consent does not affect processing that was lawful before withdrawal.

We keep personal data only for the purpose and period described below, subject to shorter deletion requests and any legal hold or recordkeeping duty that applies.

• Account data is retained while your account is active.
• Optional first-party analytics and scan logs are designed to expire after the configured analytics retention window, which may be up to 365 days. Certain activity and app-presence records expire after 180 days of inactivity. Withdrawing analytics consent triggers deletion of the optional first-party analytics covered by that control.
• Explorer discovery events used for discovery, XP, streaks, and achievements are currently retained while the account is active and are removed through account deletion.
• Standalone giveaway entry data is deleted automatically 30 days after an administrator records that all winners are confirmed, unless a limited record must be retained for a legal or fraud-prevention duty.
• Operational, security, moderation, and vendor logs are retained only for a defined security, reliability, fraud-prevention, or legal purpose. Provider-side periods may differ and are governed by the applicable provider terms and account configuration.
• Account deletion removes account-owned records and removes or unlinks identifiers from shared records according to their function. Some shared collaboration content may remain for other participants with authorship removed.
• Public catalog contributions that other collectors rely on may remain only in de-identified form after account attribution is removed.
• Account deletion also removes local scan drafts, preferences, notification identity, and recreatable caches from that device. Temporary export files are kept only in app cache until replaced or cleared by you, the app, or the operating system. Deleting an account on one device cannot erase copies you previously exported or content another user independently saved outside ParkBound Collections.

We use essential local storage on the website for core functionality (for example, authentication, theme preference, and saved consent choices). Optional analytics and ads are disabled by default. They load only after opt-in and sign-in with an age-eligible account.

• You can change or withdraw consent any time using Cookie Preferences in the site footer.
• Each choice records the applicable notice and vendor-configuration version. A choice is cleared when the signed-in account changes so one person's decision cannot authorize optional processing for another account.
• No optional vendor request is made until consent and age eligibility are both confirmed.
• You can disable analytics tracking in app Settings at any time.
• Explorer Mode (under 13) never collects analytics.
• When ads are enabled, Google's applicable consent flow controls the requested ad processing. On iOS, Apple ATT separately controls whether cross-company tracking and access to the advertising identifier are permitted. ATT is not a substitute for an advertising or privacy consent choice.
• PostHog heatmaps are enabled only after analytics consent. Session recording is disabled, and page text, inputs, and element attributes are masked.

ParkBound Collections is operated from the United States. New accounts and new web purchases are currently offered only in the United States and Canada. Public pages may remain visible elsewhere. If you use an existing account while located in another country:

• Your data may be transferred to and processed in the United States.
• Privacy and transfer rights depend on the law that applies to the particular use. A privacy policy is not itself a data-transfer mechanism. Before offering new account services in a jurisdiction that requires transfer safeguards, we must complete the required contracts and transfer assessment.
• You may always ask us for access, correction, or deletion. If applicable law gives you additional rights or a right to complain to a regulator, those rights are not limited by this policy.

Where a law requires us to identify a ground for processing, we use the ground that fits the particular purpose rather than treating one choice as permission for every use:

• Core account data: providing the service you requested.
• Users aged 13-15 in configured guardian-consent regions: local-only Explorer Mode unless independently verified adult consent becomes available.
• Essential website storage: core functionality, security, and fraud prevention.
• Optional website analytics and ad personalization: Consent.
• App analytics: Consent — analytics is off by default and only collected if you opt in. You can withdraw consent anytime in Settings, which also deletes your previously collected analytics data.
• Image moderation: content safety and enforcement of our terms.
• AI pin identification: your affirmative, feature-specific request.
• Advertising: the applicable Google/app privacy choice; Apple ATT is a separate iOS tracking permission and is not the advertising consent itself.
• Legal compliance: a legal obligation where one applies.

Canadian commercial processing is also subject to meaningful consent, appropriate purposes, data minimization, and limited retention under applicable Canadian privacy law. You can withdraw consent for optional processing without losing unrelated core features.

We assess suspected privacy and security incidents and make regulator and individual notifications when applicable law requires them. Under Canadian federal law, that includes reporting and notifying as soon as feasible when a breach creates a real risk of significant harm, plus keeping required breach records. If the GDPR applies to a particular incident, its supervisory-authority notice is generally due within 72 hours after awareness when the Article 33 reporting threshold is met. The notice method depends on the incident and legal requirements.

Our contact for privacy requests and questions is:

Tyler — support@parkboundapps.com

You may use this address for any privacy rights request, data-processing question, or complaint. Calling this role a privacy contact does not represent that ParkBound has appointed a statutory data protection officer or local representative where one is not legally required.

We may update this policy periodically. We will post the revised date and give appropriate notice of material changes. If a change requires a new consent, we will ask for it rather than treating continued use as consent.

For general questions or concerns:

support@parkboundapps.com