Privacy Policy

Last updated: 1 August 2026 · Effective date: 1 August 2026

Kit Stack ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, why, and your rights under UK GDPR and the UK Data Protection Act 2018.

1. What data we collect

Account data (when you sign up)

• Email address and password (managed securely by Supabase Auth)
• Display name and username (your public profile URL)

Profile data (what you choose to add)

• Bio, favourite team, favourite player
• Currency preference
• Profile avatar (if uploaded)

Collection data (the content of your collection)

• Shirt details you enter: team, season, kit type, condition, value, notes, etc.
• Photos you upload of your shirts (stored on Cloudinary)
• Chase list entries

Technical data (collected automatically)

• IP address (via Vercel/Supabase hosting infrastructure)
• Browser type and approximate location (for currency defaults)
• Session tokens (to keep you logged in)

We do not collect payment information. We do not run advertising cookies. We do not sell your data to third parties.

2. Why we collect it and our lawful basis

We will never use your data for automated decision-making or profiling that produces legal or significant effects.

3. Who we share your data with

We use the following trusted third-party services to operate Kit Stack. Each is a data processor acting on our instructions:

We do not sell, rent, or share your personal data with advertisers or data brokers.

When you use eBay affiliate links on Kit Stack, clicking through means you are interacting with eBay directly, subject to eBay's own Privacy Policy.

4. Your public profile

Your username, display name, shirt collection, and any photos you upload are public by default. Anyone can view your profile at kitstack.app/[username] without an account. This is a core part of how Kit Stack works — please don't upload photos or add notes you wouldn't want to be publicly visible.

5. How long we keep your data

• Account and collection data: Kept for as long as your account is active. Deleting your account removes your personal data from our live database within 30 days, subject to any backups cycling out within 90 days.
• Photos: Deleted from Cloudinary within 30 days of account deletion or manual removal.
• Server logs: Retained by Vercel/Supabase for up to 30 days for security purposes.

6. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data (most profile data you can edit yourself)
• Erasure— request deletion of your account and data ("right to be forgotten")
• Portability — receive your collection data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — ask us to limit how we use your data while a complaint is resolved

To exercise any right, email: privacy@kitstack.app. We'll respond within 30 days.

You also have the right to lodge a complaint with the ICO (ico.org.uk) if you believe we've handled your data unlawfully.

7. Children

Kit Stack is not intended for children under the age of 13. We do not knowingly collect data from children under 13. If you believe a child has created an account, please contact privacy@kitstack.app and we will delete the account promptly.

8. Changes to this policy

We may update this policy from time to time. We'll note the "Last updated" date at the top. For significant changes, we'll notify registered users by email.

Questions? Get in touch at hello@kitstack.app.