Privacy Policy

Who We Are

SamleFeber is operated by SamleFeber, CVR 41333073, Denmark. For privacy questions, use the contact form.

Information We Collect

We collect the following information:

• Account information: email, username, password (stored securely), and login method.
• Profile information: city, optional area, trade methods, and map visibility.
• Your area helps you find nearby collectors. We store a rough area of about 1.5 km, not your address. You can change or remove it anytime.
• Collection information: cards you own, quantities, spares, wishlists, and share links.
• Trade and message information: trade offers, trade history, messages, and notifications.
• Content you upload: card images and notes.
• Trade reports and moderation records, including the reason, a snapshot of the trade evidence, resolution status, and any strikes or ban state, when you report a trade or are reported. Only administrators can review these records.
• Contact information: name, email, and message.
• Technical information such as IP address, browser type, session data, and security logs.
• Analytics information: pages visited, referrer, basic browser information, errors, and a pseudonymous visitor ID.

Guest Collections

You can collect cards as a guest without creating an account. A guest is a temporary account stored on our servers, not a full profile.

• Guest collection data: the cards you add (card ids and quantities) and the series you track, stored under a synthetic guest account.
• The guest account has no real email, display name, area, trade or message data. Its address uses an unroutable domain and is never mailed.
• Guest collections inactive for 90 days are deleted by a daily job.
• A recovery code lets you restore a guest collection on another device or after clearing browser data. We store only a hash of the code, never the code itself.
• You can delete guest data immediately from the guest panel on the settings page.
• Guests cannot submit card images, trade, message other collectors, create share links, appear on the community map, or connect apps.
• Guest mode uses the same essential session cookie as a normal account. No marketing cookies are added.

Children and young people

SamleFeber is not directed at children under 13. If you are under 18, a parent or another adult must join you when you trade. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete it.

How We Use Your Information

We use your information for these purposes:

• Provide your account and the card trading platform (contract).
• Process trades, messages, and notifications (contract).
• Recommend trades and calculate distances (contract; area is optional).
• Show city clusters on the community map (on by default; you can turn it off in settings).
• Send account and trade emails (contract).
• Protect against abuse, fraud, and security incidents (legitimate interest).
• To review trade reports, apply the three-strike policy, and prevent payment requests in trades that were declared free.
• Understand how the site is used and fix errors (legitimate interest).
• Meet legal obligations and respond to lawful requests (legal obligation).

Legal Bases

We rely on the legal bases shown in brackets above. You can withdraw consent at any time and object to processing based on legitimate interest.

Information Sharing

We share personal data only as described here:

• We never sell your personal data.
• With other users: your username, city, trade methods, cards/spares, messages, and trade history.
• Publicly, if you create a share link: your username, city, missing cards, and spares. Anyone with the link can view it. Links expire after 180 days.
• With service providers that help us run the platform: hosting and CDN, email delivery, login, maps, fonts, image delivery, analytics, and CAPTCHA.
• With authorities when required by law, or to protect our legal rights.

International Transfers

Some providers process data outside the EU/EEA. Where required, we use appropriate safeguards such as standard contractual clauses.

How Long We Keep Data

• Account and profile data: while your account is active. Deleted when you delete your account, except as described below.
• Trade and message records: kept without your identity for as long as needed for disputes or legal obligations.
• Trade reports and moderation strikes are kept while the affected account or trade exists and for as long as needed to enforce the three-strike policy and resolve disputes. Dismissed reports are retained for audit; an administrator can revoke a strike, but reports and strikes are not deleted.
• Card submission images: up to 30 days if unreviewed; deleted when reviewed.
• Share links: up to 180 days.
• Contact emails, security logs, and analytics: kept only for a limited period.

Cookies and Local Storage

We use only the cookies and local storage needed to run SamleFeber. We do not use analytics or advertising cookies.

• A language cookie remembers your choice for 1 year.
• A session cookie keeps you logged in for up to 7 days.
• Local storage remembers your light/dark mode until you clear it.
• Local storage remembers that you dismissed the app install hint for 90 days.

Analytics

We use self-hosted, cookie-free analytics to see which pages are used and to fix errors. It does not track you across other websites or show ads. It records the page, referrer, basic browser information, and a pseudonymous visitor ID. We honour Do Not Track and Global Privacy Control: when either is enabled, analytics is not loaded.

Data Security

We protect your data with:

• Encrypted connections (HTTPS).
• Passwords are stored securely, and login sessions are protected.
• Limited access to personal data on a need-to-know basis.
• CAPTCHA and abuse controls on sign-up and contact forms.

Your Rights

Under GDPR and Danish data protection law, you have the right to:

• Access your personal data.
• Correct inaccurate personal data.
• Delete your personal data.
• Receive your data in a portable format.
• Restrict how we use your data.
• Object to processing based on legitimate interest.
• Withdraw consent at any time.
• Complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
• To exercise your rights, use the contact form. We may need to verify your identity.

Use the contact form

Deleting Your Data

You can delete your account in Settings. We send a confirmation link to your email; the account is deleted when you click it. Admin accounts cannot be self-deleted; contact another admin.

• Open Settings, choose 'Delete account', and confirm with the link we send you by email.
• When you delete your account, we delete your profile, collection, sessions, share links, notifications, and card submissions. Trade and message records you shared with other users are kept with your identity removed where needed to resolve disputes or meet legal obligations. Server logs may retain technical data for a limited period.

Use the contact form

Questions?

If you have any questions about this Privacy Policy, please contact us.

Use the contact form