This page is maintained by CollectIQ to answer common security questions about the platform. It describes the controls we have actually implemented. It is not an independent audit or certification, and we make no compliance claims.
Account protection
- Email and password authentication, plus Google single sign-on.
- Passwords are stored only as salted hashes by our managed authentication provider — we never see them.
- Password reset by email using time-limited, single-use recovery links.
- Sessions use short-lived access tokens with refresh-token rotation, and are revoked on sign-out.
Data handling
- All traffic is served over HTTPS/TLS.
- Database and file storage are encrypted at rest by our managed infrastructure provider.
- Row-level security policies are enabled on user data tables so every read and write is scoped to the owning account.
- Privileged server operations run behind authenticated server functions; the service credentials are never exposed to the browser.
Payments
Paid subscriptions are not yet live. When they are, billing will be processed by Stripe and CollectIQ will never see or store your full card number, CVC, or bank credentials — only Stripe customer and subscription identifiers.
Subprocessors
These vendors actually receive or process CollectIQ user or application data:
- Cloudflare — Edge hosting, CDN, and network protection.
- Supabase — Managed Postgres database, authentication, and file storage.
- Stripe — Subscription billing (stores customer and subscription identifiers).
- Lovable (email delivery) — Sends transactional and notification email from notify.collectiq.tools.
- Lovable AI Gateway — Runs AI research and card-scanning requests.
- eBay Browse API — Receives card identifiers (never your personal data) to return market data.
- JustTCG — Receives card identifiers (never your personal data) to return market data.
- CardSight — Receives card identifiers (never your personal data) to return market data.
- Card Hedge — Receives card identifiers (never your personal data) to return market data.
- Pokémon TCG API + TCGdex — Receives card identifiers (never your personal data) to return market data.
Market-data providers receive card identifiers only (set, card number, grade). They do not receive your account details, portfolio, or any personal information.
Reporting a vulnerability
If you believe you’ve found a security issue, email security@collectiq.tools. Please give us a reasonable time to investigate and remediate before public disclosure.
Shared responsibility
Keep your device and email account secure, use a unique password for CollectIQ, and be cautious of phishing. We will never ask for your password by email.