Privacy policy

What members give us

• Your account. Your email address. There are no passwords: you sign in with a one-time link we email you, or with a passkey you add in your settings (we keep the passkey’s public key and a name for it, never anything that could unlock your device). When you join we give you a random display name, which you can change.
• Your profile. Display name, and if you add them, a country, a short bio and a profile picture. Your display name and profile page are public. We remove the location and camera data embedded in a profile picture.
• Your collection, wishlist and lists. The pieces you add, and anything you record with them: what you paid, where you bought it, serial numbers, notes and photos. Each collection and list is public, members-only or private, as you set it. When you upload a collection photo, we remove its embedded location and camera data (such as where and with what it was taken) before we store it. Your likes, and any spreadsheet you import, are kept too.
• Catalogue contributions. Submissions, corrections and photos you send for the catalogue, with any note. A photo you contribute is shown with a credit, which is your display name unless you type another. We remove a contributed photo’s embedded location and camera data before we store it.
• Alerts and email. The alerts you set (wishlist, sale, drop and Reddit alerts) and how you want them delivered. We record which alerts and digests we’ve sent you, and whether a message bounced.
• The forum. Joining collect.golf creates your account on our forum, and you sign in to it with your collect.golf account. The forum receives your email address, display name and profile picture, and again whenever you change them. What you post on the forum is public there.

What we collect automatically

• Page views. For each page you view: its address (search terms included, but sign-in tokens removed), the page you came from, the time, your browser’s language, your device type, browser and operating system and the full browser identification string, and any campaign tags in the link. If you’re signed in, we record your account with the view.
• Location, roughly. We look up a country, region and city from your IP address in a database that runs on our own server (MaxMind’s GeoLite2), so your address isn’t sent anywhere for this. We store the place, not the address.
• A daily visitor code. To count visitors without storing IP addresses, we combine your IP address and browser identification with a code that changes every day and store only the scrambled result. It stays the same for a day and changes the next. This is a pseudonym, not anonymity: someone holding our server’s secret key and an IP address could check whether they match.
• Visits. We group page views into visits: when a visit started and ended, how many pages it took in, where it entered and left, where it came from, and the same location and device details. A visit is linked to your session cookie.
• Clicks out. When you follow one of our links to eBay or another shop, we record the piece, the shop’s address, the page you clicked from, your browser identification, the daily visitor code, and your account if you’re signed in. We also record which eBay listings you look up in the eBay analyzer, and each press of a live market listing’s Get alerts button: the piece, the daily visitor code, your account if you’re signed in, and, if it took you to sign in, whether the link turned the alert on and made your account.
• Email activity. Our email provider tells us when an alert email is opened or a link in it is clicked. We store these events with a scrambled version of the address and your account.
• Sign-in requests. When you ask for a sign-in link, we keep the email address, the IP address the request came from and the time, to stop people from flooding addresses with sign-in emails. To limit abuse we also count requests per IP address in short-lived counters (up to about an hour).

We don’t use any third-party analytics. We show ads served by Google AdSense, which uses its own cookies (see below). Our host, like any web host, keeps its own server logs of requests, including IP addresses.

Cookies

• collect-golf-session keeps your session going, signed in or not. It lasts 2 hours from your last visit.
• XSRF-TOKEN protects forms from being submitted by other sites. It lasts as long as the session.
• A “remember me” cookie (its name starts remember_web_) is set when you sign in, so you stay signed in. It lasts about 400 days, or until you sign out.

Advertising cookies. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site or other websites. Google’s advertising cookies let it and its partners serve ads to you based on your visits to this site and others on the internet. You can opt out of personalised advertising in Google’s Ads Settings, or opt out of other vendors’ personalised ads at aboutads.info. Visitors in the European Economic Area, the UK and Switzerland are asked for their consent through Google’s consent message before personalised ads are shown. How Google uses this data is set out in How Google uses information from sites or apps that use its services.

Apart from Google’s advertising cookies, we set no other cookies, and our pages store nothing else in your browser. Some pages show images straight from eBay, Shopify and dealers’ sites, so your browser fetches those from them.

How we use it

• To run your account: sign-in, your collection, lists and wishlist, and the forum.
• To send the alerts and digests you asked for, and the sign-in links you request.
• To build and correct the catalogue from what members contribute, and to credit them.
• To understand which pages people use and where they come from, to tell people from bots, and to count clicks out to shops (some earn us a commission).
• To keep the site safe: rate limits, spam checks and sign-in abuse.

We don’t sell your data. The ads we show come from Google AdSense; we send Google nothing about you beyond what its own script reads in your browser.

Who else handles it

• DreamHost hosts the site and its database in the United States.
• AhaSend delivers our email. It receives your email address and the message, and reports back deliveries, bounces, opens and clicks.
• Our forum (Flarum, at forum.collect.golf) receives your email address, display name and profile picture, as described above.
• Cloudflare runs the “confirm you’re a person” check that the sign-in page sometimes shows, and the one the listing check runs before it reads a listing from eBay for a signed-out visitor (usually without asking you anything). When it runs, Cloudflare receives your IP address and browser details.
• Affiliate networks. When you click out to buy, the link may go through eBay Partner Network, Amazon Associates, Awin or CJ. The link carries the piece’s catalogue ID, never who you are. These networks and the shops may set their own cookies on their own sites, under their own policies.
• Anthropic provides the AI model we use to read public listings (eBay listing titles and photos, Reddit and GolfWRX posts, dealers’ photos) and to identify and classify them. It may also see public catalogue photos, which can include photos members contributed. Catalogue submissions and suggestions may also be reviewed with the help of AI agents before they’re applied.
• Google AdSense serves the ads on our pages (not on our internal tools). Its script runs in your browser, reads and sets Google’s advertising cookies, and receives your IP address, browser details and the page you are on, under Google’s privacy policy (see Advertising cookies above).
• Google Search Console gives us totals of the Google searches that led to the site. We send Search Console nothing about visitors.

eBay and community listings

We show public eBay listing data, including sellers’ usernames, which we get through eBay’s APIs. Most pages abbreviate a seller’s username (for example “g***7”). When eBay notifies us that an eBay account has been deleted, we delete that user’s data. eBay’s own handling of your data is described in its User Privacy Notice.

We also show public listings from Reddit and the GolfWRX forums. For Reddit posts we keep the author’s username, and show it abbreviated.

How long we keep it

• Your account and what you add to it: until you delete it, or delete the account (see below).
• Sessions: they expire 2 hours after your last visit.
• Records of incoming notifications from our email provider, eBay and others: 30 days once processed (dealer stock updates, 3 days). One that fails to process is kept until we deal with it.
• Sign-in requests (the email address, IP address and time): 30 days, and straight away if you delete your account.
• Email sent to our own addresses: the sender, recipients and subject for 90 days; the full message for 30 days.
• Kept with no set end date: page views, visits, clicks out and Get alerts presses, listing check look-ups, email open and click events, eBay’s account-deletion notices, catalogue contributions, and public listing data. We’ll update this page when we set limits on them. If you delete your account, the first five are no longer linked to you (see below).

Your choices

• See and correct. Your settings page lets you change your display name, country, bio and picture, your alerts and your passkeys. To change your email address, write to us.
• Download. You can export your collection (CSV or JSON) and your wishlist (CSV) from your settings. Lists aren’t in the export yet.
• Stop emails. Every alert email has an unsubscribe link, and your settings control which alerts you get.
• Delete your account. From your settings. What happens is set out below.

What we delete. Your collections and everything in them (photos included), your lists, your wishlist, your likes, your profile picture, your passkeys, your forum sign-in tokens, your sign-in requests, your alert settings and the record of alerts we sent you and of bounced email, the history of your collection’s value, and your imports with the spreadsheets you uploaded. A submission still waiting for review is withdrawn, and the photos you uploaded with it, and with any submission that didn’t make it into the catalogue, are deleted.

What we anonymise. Your email address, display name, country, bio and picture are removed from your account, and it can’t be signed in to again. Catalogue contributions stay in the catalogue: the photos you contributed, your catalogue edits and corrections, and sales you reported. Every credit that named you becomes “Former member”; a credit you gave someone else (such as the photographer) stays as published. Your forum account is renamed “Former member”, loses your email address and picture, and your forum posts stay under that name. A username on another site that you linked to your account is unlinked. A report of a suspected fake you sent stays with our marshals, no longer linked to you and without your note. Page views, visits, clicks out, Get alerts presses, analyzer look-ups and email open and click events stay in our counts, no longer linked to you.

What we keep. A closed account record with a number and a placeholder name (“former-member-” and that number) and no personal details, so the catalogue’s history still adds up; and the records of what you contributed: your submissions (their notes included) and the decisions on them.

For anything else, email hello@collect.golf.

Children

collect.golf is not directed to children under 13, and we don’t knowingly collect their information. If you think a child has given us information, write to us and we’ll delete it.

Changes

When we change this policy we’ll update it here and change the “Last updated” date at the top. If a change affects what we do with members’ data, we’ll also say so on the site.

Contact

Email hello@collect.golf.