Privacy Policy

PixCollection · Last updated: 29 October 2026

In short. PixCollection keeps an inventory of a collection of physical video games and consoles. We sell no data, show no ads and have added no analytics or tracking tool. Only the scanning libraries supplied by Google, on Android, send Google technical usage statistics (see section 5). Your collection stays private until you open it yourself, and its amounts are never visible to other users.

1. Who is responsible for your data

The data controller is Aurélien Bailly, who publishes the PixCollection app under the name Pixelosaure. For any question about your data: pixcollection@pixelosaure.fr.

2. The data we process

Data	Why	Legal basis
Account: email address, password (stored hashed, never readable by us), username	Create and protect your account, identify you	Performance of the service
Collection: items owned, condition, completeness, purchase price, estimated value, serial number, notes, region, “for trade” and “wanted” flags, storage boxes	Provide the inventory, valuation and insurance file	Performance of the service
Photos and invoices you attach to an item	Attach them to the item (proof of purchase, condition)	Performance of the service
Progress: completed quests, points, rank	Gamification and leaderboard	Performance of the service; leaderboard: your choice
Catalog contributions: proposed entries or versions, learned barcodes, entered prices, error reports (the message, the entry concerned, and the team's answer)	Enrich the shared catalog after review	Legitimate interest; your initiative
Technical data sent to our servers (IP address, error logs)	Security, diagnostics	Legitimate interest

We do not collect your location, your contacts or your advertising ID.

3. Device permissions

Camera: read a barcode, or photograph an item to identify or illustrate it. Photos taken to identify an item are analysed on your phone (barcode reading and text recognition built into the app — Google ML Kit on Android, Apple Vision on iPhone —, which work offline) and are not uploaded. Only photos you save to an item are sent to your private storage.
NFC: read a tag you placed on a box or cartridge. The tag only holds a link to the item in your collection.
Photos / files: pick an image from your gallery, only when you choose to.

4. What other users can see

Leaderboard: your username, points and number of items, if you appear on it. You can leave it at any time from your profile.
Public collection: closed by default. If you open it (and only if you appear on the leaderboard), others see the entries you own, their platform, region, edition, completeness and whether they are for trade. Never any purchase price or estimated value, photo, serial number, note or invoice.
Trading board: items you mark “for trade” and games you are looking for appear under your username, without prices. There is no messaging: nobody can contact you through the app.

5. Who the data is shared with

We neither sell nor rent your data. It only passes through the following technical providers:

Supabase: the app's database, authentication and file storage (hosting processor). Photos and invoices are kept in a private space tied to your account.
Resend (email delivery service): it delivers the messages tied to your account — sign-up confirmation code, password reset code. To do so it receives your email address, your username and the message content, nothing from your collection. Resend being a US company, this data may be processed in the United States.
UPCitemdb (barcode product lookup service): when you scan a code the catalog does not know, the barcode is sent to this service, which also receives your device's IP address. No account data is sent. In the web version, the request goes through a function on our server that keeps nothing.
Google (ML Kit), on Android: barcode reading and text recognition use Google's ML Kit libraries. Images and the text read stay on the phone. ML Kit does however send Google technical information: device model and operating system, app identifier and version, a per-installation identifier (used to count devices), performance measurements and error codes for these features. None of it includes account or collection data. Google uses it to operate and improve ML Kit.
Catalog images: covers and console photos are loaded from our server (covers.pixcollection.fr) and, for some of them, from public databases (TheGamesDB, LaunchBox, Wikimedia Commons). As with any image on a web page, these servers receive your device's IP address, and nothing else.

We may also disclose data where a competent authority legally requires it.

6. Where the data is stored, and for how long

Your account and collection data are kept as long as your account exists, then deleted with it (see section 8).
Server technical logs are kept for a limited period set by the host.
Data is hosted by Supabase in the European Union, in its Paris region. As Supabase is a US company, its data processing agreement includes the European Commission's standard contractual clauses.

7. Your rights

Under the GDPR, you may access, correct, delete or export your data, object to processing or ask for it to be restricted. The app already lets you change your username, your collection and your profile visibility, and export your collection. For any other right, write to pixcollection@pixelosaure.fr; we reply within one month. If you believe your rights are not respected, you may lodge a complaint with the CNIL (French data protection authority) or the authority of your country.

8. Deleting your account and your data

In the app: My space → Account → Delete my account. You are asked to confirm three times, including typing the word “DELETE”. Deletion is immediate and irreversible; it erases:

your account, profile and username;
your whole collection, boxes, “for trade” and “wanted” items;
your saved photos and invoices;
your progress, points and leaderboard position.

Without access to the app: write from the account's email address to pixcollection@pixelosaure.fr with the subject “Account deletion”; we process it within 30 days.

What is kept: contributions already merged into the shared catalog (an entered market price, an approved entry, a learned barcode) carry no account identifier and cannot be traced back to you; they therefore stay in place. An error report you sent also stays in the team's queue, detached from your account: do not write personal information in it.

9. Security

Traffic is encrypted (HTTPS). Each account can only reach its own data, which is enforced by the database itself and not only by the app. No administration key is shipped in the distributed app. As no system is infallible, we encourage you to use a unique password.

10. Children

PixCollection is not intended for children under 15. We do not knowingly collect their data; if you believe a child has created an account, write to us and we will delete it.

11. Changes

This policy may change. The date of the last update is shown at the top of this page; in case of a significant change, we will inform you in the app.