Privacy

Last updated 11 October 2026.

The short version

The tools work without an account: your ticks are saved in your own browser. If you choose to sign in, we keep your collection in your account so it's on all your devices. Accounts never store your name; if you sign in with Google, we keep your Google email address, only to show which account you used. We use no advertising cookies. While you're signed out, Google Analytics shows us how the site is used, except for connections from the EU, the UK and the other places listed under Visitor statistics. You can turn it off in Cookie settings.

Without an account

What you tick off, a history of your recent changes and your settings are saved in your browser's local storage on your device, and aren't sent to us. A backup link carries your collection in the part of the address after the “#”, and the link itself never sends it to our server. A backup file is saved wherever you choose.

With an account (optional, ages 13 and over)

Accounts are for people aged 13 and over; by signing in, you confirm you are (see our Terms).

You sign in with Google or Apple. We keep only what the account needs to work:

• a random account ID;
• which sign-in you used (Google or Apple) and the ID that service gives us for you;
• if you sign in with Google, your Google email address, so you can see which Google account you used;
• your collections: which Pokémon and cards you've ticked;
• dates: when the account was created and last used, when each sign-in happened, when your collection last changed, and the date it's due for deletion if it's due;
• your sign-ins, stored only as a scrambled code that can't be turned back into the real one.

We never ask for your name, and Apple sign-ins don't share an email address with us. Google or Apple will know you signed in to Collector Kits; their own privacy policies apply to that (Google, Apple). Your browser also keeps a copy of what's in your account, so changes from your devices can be combined, and your account ID. The IDs we keep are used only to keep you signed in and sync your collection — never for advertising or profiling. Signed in, your account page (collectorkits.com/account) shows how you signed in (with your email address for Google) and your account ID, and the checklists show your collections.

Visitor statistics

We count visits in two ways.

• Cloudflare Web Analytics runs in every country, whether or not you're signed in. It sets no cookies and doesn't identify or follow individual visitors; it tells us totals, such as how many people opened a page and which countries they came from.
• Google Analytics shows us how the site is used. It runs only while you're signed out, and it recognises the same browser on later visits with two cookies (see Cookies).

Google Analytics doesn't run for connections that appear to be in the EU, Iceland, Liechtenstein, Norway, the UK, Switzerland, the Channel Islands, the Isle of Man or Gibraltar, or whose location is unknown.

Where it runs, it records:

• which pages are opened, how long people stay, and whether they scroll to the bottom of a page;
• which site or link brought them here;
• which files are downloaded, and which links to other sites (such as shops) are clicked, including the card a shop link looks for;
• roughly where visitors are, and what device, browser and language they use.

We never send Google Analytics your name, email address, account or collection. The page addresses we send leave out what you typed or saved in them, such as searches and backup links (everything after a “?” or “#”). The one exception is a campaign tag such as utm_source, which shows which link brought you here. Google receives your IP address when Google Analytics runs, uses it to work out your approximate location, and then discards it.

We've turned off Google signals, which uses data from visitors signed in to their Google accounts, and Google's advertising features. We've also turned off the settings that let Google use this data for its own products. Google explains how it handles data from sites like ours at policies.google.com/technologies/partner-sites.

Card pictures

The card lists and the home page show card pictures. We keep our own copies of them at Cloudflare (at cards.collectorkits.com), so they load straight from this site: no one else is involved, and no cookies are set or sent with them. The pictures come originally from TCGdex, a free, community-run card database, but your browser never contacts TCGdex.

Cookies

Signing in sets a cookie that keeps you signed in on this browser for up to 13 months, or until you sign out; it ends sooner if you don't use your account for 180 days. A second cookie, lasting as long, only tells the page that you're signed in and holds no personal information. While you sign in, a cookie that lasts 10 minutes keeps the sign-in secure. Two more cookies, lasting 30 days, are set only in our own team's browsers, to try out features before they're released.

When Google Analytics runs (see Visitor statistics), it sets two cookies, _ga and _ga_2W1212QCN6, which recognise this browser on later visits. They last up to 13 months after your last visit (Safari deletes them after 7 days without a visit). Turning Google Analytics off in Cookie settings deletes them. We use no advertising cookies.

Who handles it

Cloudflare hosts this site and its card pictures, counts visits for us, and stores accounts in its Asia-Pacific region; your data may pass through Cloudflare's servers in other countries on the way. Cloudflare handles it for us under its data processing agreement, which includes the EU Standard Contractual Clauses and the UK Addendum. Google runs Google Analytics for us as our processor, under the Google Ads Data Processing Terms, and may process Google Analytics data in any country where Google or its subprocessors have facilities, including the United States. Google and Apple handle signing in. We briefly use your IP address to protect the site from abuse, such as too many sign-in attempts, and we don't store it.

How long we keep it

Using your account means opening the home page, a checklist, the set lists or your account page while signed in.

• Sign-ins end after 180 days without using your account, and after 13 months at most.
• An account that hasn't been used for 24 months is deleted about 30 days later; using it at any point keeps it.
• An account with nothing saved in it is deleted after about five weeks without use.
• You can delete your account yourself at any time. Deleted data can stay in our database backups for up to 30 days; they're used only to recover from a serious fault.
• Google Analytics deletes its detailed visit records after 14 months; the totals in its reports are kept.
• If you email us, we use your address and message only to reply, and delete them within 12 months.

Your choices

Accounts are optional, the tools work fully without one, and you can turn Google Analytics off in Cookie settings. We make no automated decisions about you.

You can delete your account on your account page, and download your collection as a backup file at any time. Signing out or deleting your account withdraws your consent to us keeping it. You can also ask us for a copy of your data, or ask us to correct it, delete it, or limit or stop how we use it — email hello@collectorkits.com with the account ID shown on your account page. Google Analytics data is tied to a random ID in this browser, not to your name, email address or account, so we can't look it up by any of those. To stop it, turn Google Analytics off in Cookie settings, which also deletes its cookies. After you delete your account, Collector Kits may still be listed among your Google or Apple account's connected apps; you can remove it there. If you're unhappy with how we handle your data, you can complain to Singapore's Personal Data Protection Commission, the UK Information Commissioner's Office, or the data protection authority where you live.

Why we use it

For readers in the EU and UK: we keep account data to provide the account you asked for (a contract; for under-18s, our legitimate interest in providing it). We use IP addresses briefly to protect the site from abuse, and count visits with Cloudflare Web Analytics, because we have a legitimate interest in running the site safely and knowing which pages are used; Cloudflare Web Analytics doesn't identify individual visitors. Google Analytics doesn't run for connections that appear to be in the EU or the UK.

Where Google Analytics runs (including Singapore, under its Personal Data Protection Act), we rely on the legitimate interests exception to use it without asking for consent: we have a legitimate interest in knowing how the site is used, so we can improve it. You can turn it off at any time in Cookie settings. Questions about this go to our data protection officer at hello@collectorkits.com.

Children

Accounts are for ages 13 and over, and anyone can use the tools without one. If we learn that an account belongs to a child under 13, we delete it. The quickest way to remove one is on the child's device: open the account page and choose Delete account. Or email us the account ID shown there, and we'll delete it. We don't ask anyone's age, so where Google Analytics runs, it counts signed-out visitors of every age. We use it only to see how the site is used, not for advertising, and anyone can turn it off in Cookie settings.

Links to shops

The Missing list links to card shops such as TCGplayer and eBay. When you follow one, that shop's own privacy policy applies, and it may use cookies — including, where we're part of its affiliate programme, to credit us for a purchase.

Who is responsible

Collector Kits is run by Summercloude Pte. Ltd., Singapore. Data protection officer and any privacy question: hello@collectorkits.com.

Changes

If this changes — for example if we add advertising — we'll update this page and the date above first.