Version 1.0 · Last updated 20 July 2026 · Effective 20 July 2026
Hoardr is a collection manager for hobbyist collectors. This policy explains what we store, where it lives, who else touches it, and what we will never do with it.
Hoardr ("we", "us") is a collection-management application operated by an independent developer based in Australia. Hoardr is the data controller for the personal information described in this policy.
Contact: privacy@hoardrapp.com for privacy matters, support@hoardrapp.com for everything else. We aim to respond to privacy requests within 30 days.
Your email address. If you sign in with Google we also receive your display name and profile picture URL where you have one. Sign-in is handled by Google Firebase Authentication; if you use an email and password, that password is stored and verified by Firebase and is never visible to us.
Everything you choose to enter: item names, descriptions, categories, groups, condition, materials, dimensions, dates, purchase prices, estimated values, sellers, provenance, certificate and serial references, insurance and storage notes, tags, ratings, and photographs.
Some of this can be sensitive — storage locations and valuations especially. We treat all of it as private. It is readable only by your own account.
Your display currency, and whether you have completed onboarding or dismissed the install prompt.
Firebase records operational data including sign-in timestamps and IP address, used for security and abuse prevention. We use Google reCAPTCHA v3 through Firebase App Check to confirm requests come from the genuine Hoardr app rather than an automated script. reCAPTCHA analyses device and interaction signals and is governed by Google's Privacy Policy.
For users in the UK and EEA, the UK GDPR and EU GDPR require us to state a lawful basis for each purpose:
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and securing your account | Email, password hash, display name | Performance of a contract |
| Storing and syncing your collection | Collection content, photographs | Performance of a contract |
| Remembering your preferences | Currency, onboarding state | Performance of a contract |
| Preventing abuse and fraud | IP address, reCAPTCHA signals, sign-in events | Legitimate interests — keeping the service available and secure |
| Responding to your support requests | Your email and message | Legitimate interests — supporting our users |
Hoardr does not use advertising or tracking cookies. It does store data on your own device so the app works offline and remembers your settings:
| Technology | What it holds | Why |
|---|---|---|
| IndexedDB (Firestore offline cache) | A copy of your collection, including photo thumbnails | So the app loads instantly and works without a connection |
localStorage | collectorsVault (local collection data), hoardrCurrency, hoardr_onboarded, hoardr_install_dismissed | Preferences and local-only mode |
| Firebase auth tokens | Your signed-in session | So you are not signed out on every visit |
| Google reCAPTCHA cookies | Set by Google on google.com | Distinguishing genuine users from bots |
You can clear all of this by signing out, deleting your account, or clearing site data in your browser. Doing so removes the offline copy from that device.
Hoardr runs on Google Firebase. Collection records are held in Google Cloud Firestore and
photographs in Google Cloud Storage in the United States (region
us-east1).
If you are outside the United States — including in Australia, the UK or the EEA — your personal information is transferred to and stored in the United States. Google LLC provides these services under its own data-protection terms, which include the European Commission's Standard Contractual Clauses for transfers out of the EEA and UK. See Firebase's privacy and security information.
Hoardr deliberately uses very few external services. We do not use any advertising, analytics or marketing platform.
| Service | Purpose | Data involved |
|---|---|---|
| Google Firebase (Google LLC) | Authentication, database, photo storage | Email, collection content, photos, IP address |
| Google reCAPTCHA v3 / App Check | Blocking automated abuse | Device and interaction signals |
| Cloudflare CDN | Serving three open-source libraries used for Excel and PDF export | IP address, as with any web request |
| GitHub Pages | Hosting the website | IP address, as with any web request |
Hoardr also offers a "Check sold prices" link that opens an eBay search in a new tab. This happens only when you click it and passes only the item name. eBay's own privacy policy applies from that point.
| We do not | Meaning |
|---|---|
| Sell your personal information | We have never sold personal information and do not intend to. For the purposes of the CCPA/CPRA, we do not "sell" or "share" personal information as those terms are defined. |
| Show advertising | There are no ad networks in Hoardr. |
| Run analytics or tracking | No Google Analytics, no tracking pixels, no behavioural SDKs. |
| Read or share your collection | Access is restricted by security rules to your own account. |
| Use your photographs | They are not used for training, promotion, or any purpose other than displaying them back to you. |
| Profile you or make automated decisions | No automated decision-making with legal or similarly significant effects. |
Save to Device produces a complete JSON file of your collections, groups, items and photographs — readable without Hoardr. This satisfies your right to data portability.
Profile → Delete my account & all data permanently removes your account, every collection, group and item, and every photograph in storage. It is immediate and cannot be undone, so export first if you want a copy.
Everything we hold about you is visible and editable in the app. For a copy in another format, or any question about your data, email privacy@hoardrapp.com.
Depending on where you live you may also have the right to object to or restrict processing, withdraw consent, and lodge a complaint with a regulator. We will not discriminate against you for exercising any privacy right.
We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are unhappy with our response to a privacy complaint you may contact the Office of the Australian Information Commissioner at oaic.gov.au.
You have rights of access, rectification, erasure, restriction, portability and objection under the UK and EU GDPR, and the right to lodge a complaint with your local supervisory authority.
Under the CCPA/CPRA you have the right to know what personal information is collected, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. The categories we collect are identifiers (email address), internet activity (security logs), and user content (your collection and photographs), as described in section 2.
Your data is kept for as long as your account exists. When you delete your account it is removed from the live database and storage immediately. Residual copies may persist briefly in Google's routine backups before being overwritten. Support emails are kept while needed to resolve your enquiry.
Access is enforced by owner-only security rules on both the database and photo storage, traffic is encrypted in transit with HTTPS/TLS, and Firebase App Check is enforced to reject requests that do not come from the genuine app. Uploads are limited to images under 5 MB.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected users and the relevant regulator as required by law — including the Notifiable Data Breaches scheme in Australia and Articles 33–34 of the GDPR.
Hoardr is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.
If this policy changes materially we will update the version and date at the top of this page and, where the change is significant, notify you in the app before it takes effect.
Privacy and data requests: privacy@hoardrapp.com
General support: support@hoardrapp.com
This policy is governed by the laws of Australia.