Privacy Policy

OP-Atlas (the "Service", "we") is currently operated by:

Once the Thai entity is registered we'll update this section with the company name, registration number, registered address, and (if applicable) the Data Protection Officer's contact.

Account data (when you sign in)

• Email address (always)
• Display name (if you set one)
• Google account identifier + profile-image URL (if you sign in via Google OAuth)
• A session refresh token stored as a browser cookie

Contribution data

• Card-data flags / swap proposals / trust verdicts you submit, linked to your user ID
• Points balance and contribution stats derived from your activity
• Optional shipping address if you claim a physical reward (only collected when you fill the form)

Technical data (every visit)

• IP address (transient — used for rate-limiting; held in memory for ~60s per request)
• Browser user-agent and language preference
• The page you're viewing and the time

Analytics data (only if you consent)

• Aggregated page views, scroll depth, and outbound-link clicks via Google Analytics 4
• Aggregated visit counts via Vercel Analytics
• Anonymised Core Web Vitals via Vercel Speed Insights

Analytics cookies are not set until you accept them via the cookie banner. If you decline or ignore the banner, no analytics cookies are stored and Google Analytics runs in "consent mode v2" — meaning Google receives only aggregated, cookieless signals.

We don't sell data. Operating the service requires sharing some of it with infrastructure providers ("processors") under contractual restrictions on what they can do with it. The full list:

• Vercel Inc. (USA) — hosting + edge network + analytics. Vercel is certified under the EU-US Data Privacy Framework. privacy policy
• Supabase Inc. (USA, AWS us-east-1) — database + authentication. Operates under Standard Contractual Clauses for EU data transfers. privacy policy
• Google LLC (USA) — Analytics + OAuth (only if you sign in with Google). Certified under the EU-US Data Privacy Framework. privacy policy
• Resend (USA) — transactional email delivery (reward notifications). Only used when you claim a reward. privacy policy

Card-price data is fetched from public sources (Cardmarket, TCGplayer, CardTrader, PriceCharting, yuyu-tei, eBay). No user data is shared with those sources — the requests are made server-side from our infrastructure and do not include identifiers tying back to you.

All listed processors are based in the United States. EU/EEA/UK personal data transfers rely on:

• EU-US Data Privacy Framework certifications (Vercel, Google)
• Standard Contractual Clauses (Supabase, Resend)

Once OP-Atlas is incorporated in Thailand, the same processors continue to apply; Thai PDPA transfer requirements will be addressed in the next revision.

• Account + display name: until you request deletion
• Session refresh token: rotated every ~60 min; revoked on sign-out
• Contribution data (flags, swaps, points): retained for audit + reward calculation. Anonymisable on request — we can disassociate it from your user ID while keeping the data-quality signal.
• Shipping address: deleted 30 days after the reward is shipped
• IP rate-limit data: in-memory only, ~60 second window
• Analytics: Google Analytics defaults to 14 months; can be configured shorter on request

Under GDPR (EU/EEA/UK), PDPA (Thailand) and equivalent regimes, you have the right to:

• Access the data we hold about you
• Rectify incorrect data (display name on /me, or by email request)
• Delete your account and associated personal data
• Export a portable copy of your data
• Object to specific processing (e.g. analytics — handled via the cookie banner)
• Withdraw consent for analytics at any time via the cookie banner
• Lodge a complaint with your local supervisory authority (e.g. the Thai PDPC, or your EU country's DPA)

To exercise any of these, email privacy@op-atlas.app. We aim to respond within 30 days.

We use a small number of cookies. Essentials cannot be disabled (the site wouldn't work); analytics cookies are loaded only after explicit consent.

We use HTTPS everywhere, strict Content-Security-Policy headers, per-IP rate limiting on public endpoints, row-level security on all user-data tables in Supabase, and require admin role for any data-modification surface. No system is perfectly secure; we don't store payment information, but we still encourage you to use a unique password if you sign in via email (magic-link only — there is no password to steal).

OP-Atlas is not directed at children under 13 (under 16 in the EU, under 20 in Thailand). We don't knowingly collect data from minors. If you believe a minor has created an account, please contact us and we'll delete it.

We'll update the "Last updated" date at the top of this page and, for material changes, surface a notice on first visit after the change. The big revision pending is the move from this draft to the finalised version when the Thai company is registered.

For privacy questions or to exercise your rights: privacy@op-atlas.app

See also our Imprint for operator details.