Privacy policy

• Controller: Marc Ferrer Margarit
• Privacy contact: kitvaultdev@gmail.com

• Your account: email address, sign-up date and the plan you are on, plus whatever you add to your profile (name, photo, favourite team, the description about you and, if you choose one, your public address). The photo is cropped and downscaled in your browser before upload, and stored privately like your collection's. Your password is kept, hashed, by our authentication provider; we never see it.
• Your collection: the details of each shirt (team, season, version, country, league, manufacturer, notes) and its photos. Photos are downscaled in your own browser before upload, which also strips their metadata — including the GPS location many phones write into the image.
• AI identification: what the AI suggested for each photo, the details it read from it (crest, sponsor, patches or visible text), what you finally saved, and a record of each identification (time, model used and request size) that we use to apply the daily limits and keep the cost under control.
• Messages you send through the help form, with the page you wrote from and the interface language.
• If you join the Pro waiting list, that fact and the date.
• Technical data: the session cookie that keeps you signed in, a cookie that remembers your language, and the usual server logs (IP address, time and page requested) produced by our hosting providers.

• To provide the service — storing your collection, identifying shirts with AI, sending confirmation and password-reset emails. Basis: performing the contract you accept when you sign up (GDPR art. 6.1.b).
• To apply each plan's limits and prevent abuse. Basis: our legitimate interest in keeping the service available and its cost under control (art. 6.1.f).
• To answer your help messages. Basis: legitimate interest, and the contract when they concern the service.
• To improve identification in the future from the corrections you make to the AI's suggestions. Basis: legitimate interest. You can object by writing to us.
• To count visits in aggregate so we know which pages are used. This is done without cookies and without identifying you (see “Cookies”). Basis: legitimate interest.

We do not sell your data, do not use it for advertising, and make no automated decisions with legal effects on you.

We use providers that process data on our behalf (processors), under contract and only to run the service:

• Supabase — authentication, database and photo storage. Your data and photos are stored in the European Union, in Frankfurt (eu-central-1).
• Google (Gemini API) — receives the photo when you ask for an identification and returns its suggestion. We use the paid tier of the API, under which Google does not use requests or responses to improve its products.
• Vercel — hosts the website and counts visits in aggregate.
• Resend — sends account emails and help-form messages, from servers in the European Union (Ireland).
• Cloudflare — manages the domain and forwards mail sent to our contact address.

Several of these providers are US companies. Where their services involve transferring data outside the European Economic Area, this is done under the EU-US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

Your collection is private unless you decide otherwise. If you choose an address and switch on “Public vault” in your profile, anyone with the link kitvault.dev/u/<your address> can see:

• Your name, photo, favourite team and the description about you.
• Your shirts with their photos and details (team, season, version, country, league and manufacturer), and the totals of shirts, countries and leagues.

Your email, your shirts' notes and the AI identification data are never shown.

The vault is not offered to search engines, but anyone with the link can pass it on, and what someone sees they can save. The basis is your consent (GDPR art. 6.1.a), which you can withdraw at any time by switching the option off: the vault stops being visible at once, though links to photos someone has already loaded may keep working for up to an hour.

For as long as you have an account. When you delete it from your account menu, we delete your photos first and then the account with everything attached to it: collection, corrections, identification record, help messages and waiting-list entry. It is immediate and cannot be undone.

Our providers' backups may hold that data for their normal rotation period before it disappears from them too. The language cookie expires after a year.

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time. Several are one click away in the app itself:

• Rectification: edit any shirt from your collection.
• Access and portability: “Download my data”, in your account menu, gives you a file with everything we hold about you.
• Erasure: “Delete account”, in the same menu.

For anything else, write to kitvaultdev@gmail.com. We will reply within one month. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority where you live.

We only use cookies the site needs to work: the session cookie that keeps you signed in, and the one that remembers the language you choose. Neither is used for advertising or to follow you across sites, which is why we do not ask for consent.

Visits are counted with Vercel Web Analytics, which uses no cookies and stores nothing that identifies you.

Each user can only read and change their own data — apart from what you choose to make public in your vault — and that separation is enforced by the database itself, not just the application. Photos are kept in private storage and served through links that expire. All traffic is encrypted (HTTPS).

KitVault is not aimed at children under 14, and they cannot create an account.

If we change this policy in a meaningful way, we will tell you by email before the change applies.