Privacy Policy
Last updated: August 13, 2026
KO Collectibles is a collectibles marketplace. To work, it needs some of your data: here is exactly which, what we use it for and what you can demand from us. No fine print.
This is an English translation of our Spanish Privacy Policy, provided so you can read it in your language. If the two versions ever differ, the Spanish version applies.
1. Who processes your data
KO Collectibles, operated by Skyflow Labs. For anything related to your personal data, write to privacidad@kocollectibles.app and we will answer.
2. What data we collect and why
We only ask for what the app needs to do its job. This is all of it:
| Data | What for | When |
|---|---|---|
| Email and password | Creating your account and signing in. The password is stored encrypted; nobody on the team can read it. | When you sign up |
| Public name | Identifying you to whoever buys from you or sells to you. | When you sign up |
| Photos of your items | Showing what you sell. They are public inside the app. | When you list |
| Shipping address | So the seller can send you what you bought. | When you buy |
| Chat messages | Coordinating a specific purchase, sale or trade. | When you use the chat |
| Payment details | Charging and paying out. We don’t store them: Stripe handles them directly. | When you buy or sell |
| Identity document | Verifying that whoever receives money is who they say they are. Stripe Identity handles it; we only store whether the verification succeeded. | Only if you sell |
| Technical errors | Finding out that something broke and fixing it. | If the app fails |
What we DON’T do: we don’t sell your data, we don’t hand it to advertisers and we don’t track you across other apps or websites. The app contains no advertising SDK.
3. About the chat
KO’s chat is not open messaging: it only exists inside a specific purchase, sale or trade. You can’t write to someone you don’t have an ongoing transaction with.
We keep the messages because they are the record of what was agreed: if there is a dispute, the team needs to be able to read what was said. You can report a user from their profile, and if we remove a listing for breaking the rules, its conversation is closed.
4. Who we share data with
Only with the services needed to operate, and only what is strictly necessary:
- Stripe — payments, seller payouts and identity verification. Your card and document details go straight to them: they never pass through our servers.
- Sentry — app error reports, with technical context and no personally identifiable data.
- Resend — sending verification and password-recovery emails.
- Hosting provider — where the database and the images you upload live.
Product analytics are off by default and only turn on if you expressly allow them in Settings. Error reports are always on: without them we would not find out that the app is broken.
5. How long we keep it
- Your account: for as long as you keep it open.
- Transactions and invoices: for as long as tax and accounting rules require, even if you close your account.
- Messages of a transaction: for as long as the transaction could lead to a dispute.
- Verification codes: 15 minutes. After that they stop working.
6. Your rights
You can ask us at any time for:
- Access — a copy of what we hold about you.
- Rectification — correcting whatever is wrong.
- Erasure — deleting your account. You can do it yourself from Settings.
- Objection and restriction — asking us to stop processing certain data.
- Portability — taking your data with you in a readable format.
An honest caveat about deletion: if you have bought or sold, we can’t erase the record of those transactions even if you delete your account — the law requires us to keep them. What does disappear is your profile, your listings and the personal data tied to them.
7. Minimum age
KO Collectibles is for people 18 and older. Real money moves and valuable items are shipped, so it is not meant for minors. If we detect an account belonging to a minor, we close it and delete its data.
8. Security
All traffic is encrypted. Passwords are stored hashed, never in plain text. Payment and identity data never touch our servers. Team access to production data is restricted and requires two-factor authentication.
Even so, no system is infallible. If a breach that affects you ever happens, we will tell you — you won’t hear about it somewhere else first.
9. Changes
If we change something important we will let you know inside the app before it takes effect. The date at the top always says when it was last updated.
10. Contact
Any question, complaint or request about your data: privacidad@kocollectibles.app. You can also file a complaint with the data protection authority of your country.