Topps Now Collector Hub (the "Service", accessible at https://topps-now.pages.dev) is an information-lookup and personal collection-management platform for Topps Now baseball cards. This Service is not affiliated with Topps Company, Inc. Card images and related metadata are sourced from publicly-accessible Topps product pages; all intellectual property remains with the respective rights holders.

When you sign in via a third-party provider (Google or LINE), we receive:

• A provider-issued unique identifier (Google sub, LINE user ID)
• Public display name and avatar URL
• Email address, if the provider authorizes it

While using the Service we store:

• Cards you mark as "owned" or "wanted"
• Your in-app task completion records
• A session cookie issued by Supabase to keep you signed in

We do not collect images beyond card thumbnails, location data, contact lists, or any other non-essential personal information.

• Authenticating you and maintaining your login session
• Displaying your collection list, task progress, and personalized pages
• Aggregated, non-identifying analysis for debugging and quality of service

We do not sell personal data to third parties and do not use it for marketing without your consent.

• Supabase — database, authentication, session management. Data is stored in the ap-northeast-1 (Tokyo) region.
• Google Identity / LINE Login— used solely for login; subject to each provider's privacy policy.
• Cloudflare Pages— static hosting and CDN; may log standard server telemetry (IP, User-Agent) per Cloudflare's policy.
• Topps / Shopify CDN — image source; requests for card images are routed to their servers.

The Service uses only session cookies required for authentication (managed by Supabase). No advertising, tracking, or analytics cookies are set. Sessions are invalidated when you log out or close the browser.

Account data is retained until you actively delete or disable your account. You may request deletion at any time by:

• Emailing shenglun.wei@gmail.com
• Upon request we erase your user profile, collections, and task records within 30 days.

All traffic is encrypted via HTTPS. Database access is gated by Supabase Row Level Security (RLS) — your collection/task records are accessible only to your own account. We apply commercially reasonable measures but cannot guarantee absolute security of data transmission over the internet.

The Service is not directed to children under 13. If we become aware of unintentional collection of a minor's data, we will delete it promptly.

We may revise this Policy. Material changes will be announced on this page with an updated "Last updated" date. Continued use of the Service constitutes acceptance of the revised Policy.

Questions about this Policy? Email us at shenglun.wei@gmail.com.