Privacy Policy
What we collect, why, how long we keep it, and how to delete it. GDPR and CCPA rights.
Most of this document is published below, including our Florida registration numbers in full. The sections marked “with counsel” are the ones a lawyer has to write — liability and jurisdiction — and we would rather name the gap than dress up placeholder text as a legal clause.
1 · What we collect
Your name, your email address and a one-way cryptographic hash of your password. We never store the password itself and cannot recover it — a reset replaces it, it does not reveal it.
The addresses you enter at checkout, frozen onto each order. Your cart, whether or not you are signed in. Your orders, with what you paid for each item and what the market said that day.
Your cookie choices. Each sign-in attempt, whether it worked or not: the email it named, the IP address it came from and when, used to slow down password guessing and to look into a break-in afterwards. Each session you are signed in on: the browser or app it is, and the IP address it signed in from.
If you give us a mobile number: the number, and whether you have verified it. Our text-message provider sends the verification code and checks it, so we never see the code.
If you turn on notifications in the app: a device token, which lets Apple deliver them to that phone. When a line in the community room names you by your @handle or answers one of yours, the notification carries the writer's public name and the line as the room shows it; you can turn these off in the app, under Notifications and texts.
In the app: which tabs, packs, card pages and listings you open and for how long, when you start a checkout and leave it unpaid, and whether you take or close an offer of ours it shows you. It is tied to your account when you are signed in, and otherwise to a random number made by the app on your phone. No location, no contacts and no advertising identifier.
Before your first payout, an identity check: a photo ID and a selfie, checked by our payment processor. We keep whether it passed, never the document or the photo.
Once your payouts in a calendar year reach the federal reporting threshold, a W-9: your legal name, address and taxpayer identification number. The number is stored encrypted, and only its last four digits can be read without a step we log.
Photographs you send of a card you are selling us, with the location and camera details taken out before they are stored.
If you use the community room in the app: what you write there, shown under your given name and the initial of your family name, and the reactions you add to its lines, shown under each line as counts and never with your name. While you have the room open, the people in it can see that you are there. A profile picture only if you choose one: one of our own designs. The app does not accept profile photos.
Your profile in the app, which other collectors signed in to the app can open by your @handle, for example from the community room: your given name and the initial of your family name, your @handle, your picture, the month you joined, and the cards held in your Harmony vault, each as its photograph, its name and its grade. Never a price, a balance or what you paid. Your collection is shown unless you make it private in Account, under Profile, and between you and somebody either of you blocked in the room, neither sees the other's.
We do not collect card numbers. Payment runs through a hosted processor page, so a card number never reaches this site or our servers. If you tick the processor's box on that page to save a card, the processor keeps it and offers it on your next purchase there, where you can also remove it.
2 · Why we collect it
To sell you something and get it to you: an order needs an address, and a receipt needs an account to belong to.
To honour the promises attached to what you bought — the buyback runs 12 months off your order history, and without that history there is nothing to claim against.
To keep the account yours: sessions and the sign-in throttle exist for that and nothing else.
To keep accounts to real people: we may ask for your mobile number and a texted code when your account is opened, before anything can be bought.
What the app records of what you open is used to improve the app and to decide which of our own offers it shows you, such as a price on a pack you looked at. It stays with us.
Our offers and the protection of a first pack go to a person, not to an account: once per verified mobile number, so we check whether another account has verified the same number and count what we offered across those accounts.
We do not build advertising profiles for anyone else, and we do not sell or rent your data to anyone. Analytics and marketing cookies are off until you turn them on.
3 · Who we share it with
The payment processor, which needs the order total and your email to take payment and to handle a dispute, which keeps a customer record tied to your account from the first time you go to pay by card, so that a card you chose to save can be offered again, and which runs the identity check before a first payout.
Our text-message provider, which needs your mobile number to send a verification code.
Apple, which needs the device token to deliver a notification from the app, and what the notification says.
The carrier, which needs the delivery address and your name.
The email provider that delivers your receipt.
Nobody else. There is no data broker, no advertising network and no affiliate in this list.
4 · How long we keep it
Orders and their receipts: seven years, because tax authorities require it and a buyback window can be open for the first of them.
Your account: until you delete it.
Sessions: 30 days, or until you sign out. Sign-in records: 90 days.
What the app records of what you open: 180 days.
A device token: until you turn notifications off or delete your account, or Apple tells us it no longer works.
A W-9 and the outcome of an identity check: as long as tax law requires us to keep them, including after you delete your account.
A profile photo added before the app stopped accepting photos: until you remove it, replace it or delete your account. A removed photo stays in our backups for up to 30 days. Community messages you take back, or that we take down, stop being shown and are kept as a record of what was said and who removed it.
Deleting your account removes your name, email, addresses, phone number, devices, sign-in links with Google or Apple and profile picture, and takes what you wrote in the community room out of it. We also ask the payment processor to delete its customer record of you, and any card you saved there with it, unless a membership is still billed to it. It does not remove the orders themselves — those are financial records we are required to keep — and it cannot run while an order is open or a lease is active.
5 · Your rights
You can ask for a copy of everything tied to your account, in a machine-readable format, and we send it within 30 days.
You can ask us to correct anything that is wrong, and to delete your account subject to the retention above.
You can change your cookie choices at any time from the Cookie Policy, and withdrawing consent is as easy as giving it.
If you are in California, the CCPA rights to know, delete and opt out of sale apply — and we do not sell personal information, so there is nothing to opt out of. If you are in the EEA or the UK, the GDPR rights of access, rectification, erasure, restriction, portability and objection apply.
Write to customerservice@harmonyeshops.com. We do not charge for any of this and we do not require an account to make the request.
6 · Contact the DPO
With counsel. Whether we are required to appoint a data protection officer, and who that would be.