Privacy, plainly stated.
The information needed to run a trustworthy collector marketplace, how it is used, and the choices available to you.
1. Who this notice covers
This notice explains how the operator of Hot Wheels Market handles information when you browse, create an account, list or seek an item, communicate through marketplace workflows, or use the private beta. The operator's legal name and privacy contact will be published with the public launch materials.
2. Information we collect
We collect account information such as email address, display name, password hash, verification status, profile text, city/state, and avatar; catalogue and marketplace activity such as listings, photos, offers, bids, auctions, ISO posts, price checks, ratings, notifications, orders, returns, disputes, and audit history; fulfilment information such as recipient name, delivery address, phone number when supplied, carrier, tracking number, and shipment events; and security/session information needed to authenticate, revoke sessions, rate-limit abuse, and protect the service.
3. Images and automated moderation
Uploaded listing, avatar, and catalogue images are stored through the configured object-storage provider and processed for type, size, dimensions, and safety. In production, image bytes may be sent to Sightengine for content-moderation and AI-detection checks. The service stores the processing outcome and related metadata needed to enforce the upload policy; do not upload identity documents, private documents, or another person's data.
4. How we use information
We use information to provide accounts and marketplace features; connect buyers and sellers; validate catalogue identity and state transitions; coordinate fulfilment, returns, disputes, ratings, and moderation; send verification, password-reset, and in-app notifications; prevent abuse and secure the service; maintain audit and price-history records; measure bounded product usage; and comply with applicable legal or safety obligations.
5. Addresses and visibility
Delivery addresses are transmitted over HTTPS and snapshotted to the relevant order so fulfilment history remains consistent. An address is visible to the buyer, seller, and authorised operators who need it for fulfilment or dispute handling. Public profile and listing information is visible according to the product surface; private credentials, password hashes, and session tokens are not displayed to other users.
6. Analytics and local storage
We collect bounded page-view and marketplace interaction events using an anonymous browser identifier. Analytics events are designed not to contain passwords, auth tokens, email addresses, full addresses, or message bodies. Necessary cookies and browser storage support authentication, session behaviour, accessibility, and anonymous analytics; production authentication is intended to use secure HttpOnly cookies.
7. Service providers and sharing
We share information only as needed to operate the service with infrastructure and processing providers, which may include Vercel hosting and Blob storage, Neon PostgreSQL, Sightengine image moderation, and the configured transactional email provider. Order participants receive the information needed to complete fulfilment. We do not sell personal information as a business. We may disclose information to protect users, investigate abuse, comply with law, or respond to a valid legal process.
8. Retention and deletion
We retain account, transaction, moderation, audit, and price-observation records for as long as needed to operate the marketplace, preserve provenance, resolve disputes, prevent abuse, or meet legal obligations. Account deletion revokes active sessions and removes or anonymises direct profile credentials, but associated marketplace history may remain as a de-identified record such as Deleted collector. Temporary uploads and expired tokens are cleaned up by maintenance workflows where applicable.
9. Your choices and security
You may update profile information, revoke access by signing out, request account deletion, and request access or correction subject to applicable law and records that must be retained. Passwords are hashed; verification and password-reset tokens are single-use, time-limited, and stored as hashes; and sessions can be revoked when an account is suspended or its password is reset. No online service can promise absolute security, so protect your credentials and report suspected compromise promptly.
10. Children and changes
The private beta is intended for adults who can legally use the service; do not create an account for a child. We may update this notice as the service changes. The effective date identifies the current version, and material changes will be reflected on this page.