Privacy Policy

This explains what Collectwall collects, why, and the choices you have. It is part of our Terms of Service. Collectwall is the controller of the personal data described here.

What we collect

• Account: your email address and password (stored only as a secure hash by our login provider), or your Google account email if you sign in with Google.
• Profile: username, display name, bio, location, profile link, profile photo, cover, theme and badge choices, if you add them.
• Instagram username: if you add it, with your choice on whether we may tag you when we repost your photos on Collectwall's Instagram. Only our team sees it; it's never shown on your profile or given to Partners. You can change or remove it in Settings at any time.
• Photos and details: the photos you upload and the aircraft details you add. We remove the photo's hidden metadata (EXIF), including GPS location, when we process it, and add your @username to the published copy.
• Activity: follows, likes, comments, photo views, collections and reports.
• Payments: if you buy a paid plan, our payment provider handles your card details. We receive only your plan, billing status and country, never your full card number.
• Technical: logs such as IP address, browser, device and pages requested, kept for security, abuse prevention and fixing problems.
• Emails: the emails we send you and whether they were delivered, kept to run the Service and fix delivery problems.
• Shares: when someone shares a photo or page, which one, how (for example the link or Instagram) and, if they are signed in, who shared it.

How we use it, and why

• To provide the Service you asked for: your account, photos, stats, collections and paid plans (to perform our contract with you).
• To keep the Service safe and lawful: automatic content checks on uploads, duplicate-photo detection, fraud and abuse prevention, handling reports and legal requests (legitimate interests and legal obligations).
• To improve the Service using aggregate usage information (legitimate interests).
• To send account and service emails and notices, such as sign-up, password reset, plan changes, important changes to our terms, and activity on your photos (for example when one of your photos is shared). We send marketing emails only with your consent.
• To credit you when your photos are used by us or our Partners, as described in section 3 of the Terms of Service (to perform our contract with you).

We don't sell your email address, account, payment or other private personal data, don't "share" it for cross-context behavioural advertising, and don't show ads based on it. The photos you publish, and the public details shown with them, are used under the licence in our Terms, as described below.

Your photos and our partners

Under section 3 of our Terms of Service, we may share the photos you publish with our Partners, such as airlines, airports, manufacturers and aviation, travel and media businesses, for their editorial, promotional and social media use. With each photo we may share the details shown with it on the Service (registration, aircraft type, operator, airport, date) and your username or display name, so you can be credited. Partners use them under their own privacy policies, as separate controllers.

• We don't give Partners your email address, password, payment details, IP address or anything from a private account, unless you agree.
• We may share statistics with Partners that don't identify you, such as the most photographed aircraft, airlines and airports, or traffic by country.
• Photos uploaded before 26 October 2026 are included from 26 November 2026, as explained in section 3.9 of the Terms. You can ask us to remove a photo before then, or delete your account.

Who processes it for us

• Supabase (database, login and file storage).
• Resend (sending emails such as notices about your photos).
• Vercel (website hosting).
• OpenAI (automatic content checks: a small copy of each uploaded photo and its caption may be sent for checking; under their API terms it is not used to train their models).
• Polar (payments and subscriptions, as merchant of record), when you buy a paid plan.
• Google, only if you choose to sign in with Google, and Google Ads measurement only if you allow its cookies (see Cookies).

We may also disclose information if required by law, to respond to valid legal process, to protect the rights, safety or property of Collectwall, our users or others, or as part of a merger, acquisition or sale of the Service.

International transfers

Collectwall operates globally and our providers store and process data in the United States and other countries, which may have different data protection laws from yours. Where required, we rely on appropriate safeguards such as standard contractual clauses. By using the Service you understand that your data will be processed in these countries.

Public and private

Public accounts' photos, stats, collections, followers and comments can be seen by anyone, and may be copied or shared by others. With a private account, only approved followers see your photos, stats and collections; your username, name, profile photo and bio stay visible so people can find you.

Cookies

We use our own cookies: to keep you signed in, to remember the "Remember me" choice, and to remember how you first found Collectwall (when you first visited, the first page you opened, the site that linked to it, whose invite link you used, and when you last arrived from one of our Google ads) so that it can be saved with your account if you sign up.

Google Ads, only if you allow it. We advertise Collectwall on Google. The first time you visit we ask whether Google Ads may set its cookies. If you allow it, Google learns whether you came from one of our ads and whether you then created an account, so we can see which ads work. We don't use it to show you personalised ads, and we don't give Google your email, your photos or anything from your account. If you choose "No thanks", nothing is loaded from Google Ads. You can change your choice at any time with "Cookie choices" at the bottom of every page.

We count page visits to see how the site is used: the page, the site that linked to it, the country and the type of device. This uses no cookie and we don't store IP addresses; a visit is matched to others from the same day only through a code that changes every day.

Your choices and rights

• Edit your profile, photos and collections at any time.
• Delete your account in Settings: your profile, photos, likes, comments and collections are deleted permanently.
• Depending on where you live (for example the EU, UK or California), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict certain uses, and to withdraw consent. Where we rely on legitimate interests you can object to a use of your data. Send requests through the contact form on our copyright page (choose "Privacy, legal or other request"). We may need to verify your identity. You can also complain to your local data protection authority.
• We won't treat you differently for using these rights.

Children

The Service is not for anyone under 13. Users under 18 (or under the age of majority where they live) need a parent or guardian's permission, and in countries that set a higher age for agreeing to data use online, a parent or guardian must agree for them. We don't knowingly collect data from children under 13; if we learn we have, we delete the account.

Security and retention

We use reasonable technical and organisational measures to protect your data, but no system is completely secure. We keep your data while your account exists. After deletion, backups expire within a limited period. Reports, copyright notices and records needed for legal or repeat-infringer purposes may be kept for up to 3 years.

Changes

If we change this policy in a significant way, we'll tell you on the site or by email before the change applies.