Privacy Policy

1. Introduction

Welcome to Castle of Crystals. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect information about you when you use our web application, including our collection management tools, marketplace, and related services (collectively, the "Service").

By using Castle of Crystals, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, display name, password (encrypted), and profile details.
• Collection Data: Details about your diamond painting kits, including titles, brands, artists, dimensions, drill types, colors, purchase information, photos you upload, sticker sheet images, progress logs, session notes, and treasure card data.
• Marketplace Data: Listings you create, asking prices, shipping preferences, item conditions, and transaction details.
• Payment Information: Processed securely by Stripe (our payment processor). We do not store full credit card numbers on our servers. We receive limited payment metadata (last 4 digits, card brand, expiration) from Stripe for subscription management.
• Communications: Messages you send to our support team and feedback you provide.

2.2 Information We Collect Automatically

• Usage Data: Pages you visit, features you use, time spent on the Service, and interaction patterns.
• Device & Browser Information: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Cookies & Local Storage: We use cookies and local storage to maintain your session, remember preferences (e.g., live timer state), and improve your experience. You can control cookies through your browser settings.

2.3 Information from Third Parties

• Stripe: Payment and subscription status, card metadata, and transaction records.
• OpenAI: We use OpenAI's API to process sticker sheet images you upload for drill inventory extraction. Images are sent to OpenAI solely for OCR processing and are not stored by OpenAI beyond processing.
• Shippo: Shipping tracking information for marketplace transactions.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account, including subscription tier assignment and billing
• Enable you to track your diamond painting collection, log sessions, and manage inventory
• Facilitate marketplace transactions between buyers and sellers
• Process payments and manage subscriptions (via Stripe)
• Process sticker sheet images for drill inventory extraction (via OpenAI)
• Send you service-related emails (account confirmations, billing notices, security alerts)
• Respond to your support requests and communications
• Monitor and analyze usage patterns to improve the Service
• Detect, prevent, and address technical issues, fraud, and abuse
• Comply with legal obligations and enforce our Terms of Service

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers

• Supabase: Database and authentication hosting
• Vercel: Application hosting and delivery
• Stripe: Payment processing and subscription management
• OpenAI: Sticker sheet image analysis (OCR)
• Shippo: Shipping label generation and tracking

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

4.2 Marketplace Anonymization

Important: Castle of Crystals operates as an anonymous marketplace. Buyers cannot see seller identities, and sellers cannot see buyer identities. All communication is routed through our support team at support@castleofcrystals.com. We do not share names, email addresses, or other identifying information between transaction parties.

4.3 Legal Requirements

We may disclose your information if required by law, court order, subpoena, or government request, or to protect our rights, property, or safety, or that of our users.

4.4 Business Transfers

If Castle of Crystals is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. You may delete your account at any time by contacting support@castleofcrystals.com. Upon account deletion, we will delete or anonymize your personal data within 30 days, except where we must retain it for legal, regulatory, or legitimate business purposes (e.g., fraud prevention, dispute resolution, financial record-keeping).

6. Your Rights & Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Update or correct inaccurate information in your profile settings.
• Deletion: Request deletion of your account and personal data.
• Portability: Request a machine-readable export of your collection data.
• Objection: Object to certain processing activities (e.g., marketing communications).
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us at support@castleofcrystals.com. We will respond within 30 days.

Your Rights Under GDPR (EU & UK Users)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Ask us to correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Delete your account and personal data at any time via Settings → Profile → Delete My Account, or by contacting us.
• Right to Restriction: Request that we limit how we process your data.
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable (portable) format.
• Right to Object: Object to our processing of your personal data.

To exercise any of these rights, contact us at leopards@leopardlw.com. We will respond within one month as required by law.

UK users also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

International Data Transfers

Your data is stored and processed in the United States by Supabase (our database provider) and Vercel (our hosting provider). Both providers are covered by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, ensuring your data is protected to GDPR standards. Supabase's Transfer Impact Assessment is available upon request.

14-Day Right of Withdrawal (EU & UK Consumers)

If you are an EU or UK consumer, you have the right to withdraw from your subscription within 14 days of signing up without giving any reason. To exercise this right, contact us at leopards@leopardlw.com. Refunds will be processed within 14 days of your cancellation request.

7. Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest (Supabase encryption)
• Password hashing (bcrypt)
• Row-level security (RLS) policies in our database
• Secure payment processing (Stripe PCI-DSS Level 1 certified)
• Regular security audits and updates

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Children's Privacy

Castle of Crystals is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately, and we will delete it.

9. International Users

Castle of Crystals is operated in the United States. If you are located outside the U.S., please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

For users in the European Economic Area (EEA), UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms to safeguard your data.

10. Cookies & Tracking Technologies

We use the following:

• Essential Cookies: Required for authentication and session management (Supabase).
• Local Storage: Used to persist live timer state and user preferences.
• Analytics (if enabled): We may use privacy-focused analytics tools (e.g., Plausible or Vercel Analytics) to understand Service usage. These do not track individual users.

You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.

11. Third-Party Links

The Service may contain links to third-party websites (e.g., brand websites you add to your kits). We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Effective Date" at the top. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: support@castleofcrystals.com

Subject Line: Privacy Inquiry