USD CAD
Start Tracking
100 Coins
USD CAD

Privacy Policy

Last updated: September 2, 2026

This policy explains how 100 Coins (100-coins.com) collects, uses, and protects your personal information. Questions? Contact justin@100-coins.com.

What we collect

We collect only what is necessary to provide the service:

  • Email address — when you create an account, used only for authentication via Firebase.
  • Watchlist and collection — the games you add and their details (edition, condition, cost paid). Stored to provide personalized features.
  • Shared collection links — if you share a collection, we store an anonymous list of its games (game, edition, condition) under a random link you can send to others. It contains no personal information.
  • Analytics events — we record usage events (pages viewed, games searched and opened, which controls you use) to understand how the site is used. If you browse without an account, nothing is recorded unless you accept on the cookie banner, and declining means nothing is recorded at all. If you create an account, analytics is on — creating one is your acceptance, as stated when you sign in — and you can turn it off at any time from your Account page, on every device. Events are identified by a numeric user ID; your email address is shared with PostHog only at first sign-in, to link your analytics profile to your account. If you have an account we also store aggregate figures on your analytics profile — how many games are in your collection and watchlist, their total value, and your currency — never the games themselves.

We do not collect your name, address, phone number, payment information, or any sensitive personal data. We do not store or log IP addresses. IP addresses are used temporarily in memory for rate limiting and abuse prevention, but are never written to disk or a database.

Third-party services

  • Google Cloud — hosts this site and its database (Cloud Run and Cloud SQL, in Google's us-central1 region, United States). Your account data is stored there. Google Cloud Privacy Notice.
  • Firebase / Google — handles authentication (passwordless email link and Google sign-in). Your email is sent to Firebase to complete sign-in. Firebase Privacy Policy.
  • PostHog — analytics, used if you accept on the banner or have an account. Receives usage events identified by a numeric user ID, and your email address at first sign-in to link your analytics profile. Its client library also records ordinary interactions automatically, such as which buttons and links you click and their visible text. Server-side error diagnostics (stack traces from unexpected failures) are also sent to PostHog to help us fix bugs. PostHog Privacy Policy.
  • Cloudflare — DNS for this domain. Requests to 100-coins.com (without the www) are proxied by Cloudflare, which may process IP addresses and set security cookies; www.100-coins.com, the address this site uses, resolves directly to Google Cloud. Cloudflare Privacy Policy.

We do not sell or share your personal information with advertisers, data brokers, or marketing partners.

Cookies and local storage

We use the following first-party cookies:

  • Session cookie — strictly necessary for login. Stores your user ID and a CSRF security token. HTTP-only, Lax SameSite, expires after 365 days.
  • Currency cookie — remembers your USD/CAD display preference. Expires after 365 days.
  • analytics_ok cookie — set when you accept analytics on the banner, and when you sign in to an account. Without it the server records no usage events at all. Cleared if you decline or withdraw consent, and your withdrawal is stored on your account so signing in again does not undo it. Expires after 365 days.

Your watchlist and collection are also stored in your browser's local storage when you are not logged in. This data never leaves your device unless you create an account.

Data retention

Your personal data is retained until you delete your account. Deleting your account permanently removes your email address, watchlist, and collection from our database.

Shared collection links expire 7 days after they are created and are then deleted automatically, whether or not anyone has opened them. A shared link is a short-lived way to show someone your collection, not a permanent page — the expiry date is shown on the shared page itself.

Your rights

Under PIPEDA (Canada) and GDPR (EU), you have the right to access, correct, export, and delete your personal data:

  • Access and export — download a copy of your data from your Account page.
  • Delete — permanently delete your account and all associated data from your Account page.
  • Withdraw analytics consent — turn analytics off at any time from your Account page, whether you accepted on the banner or by creating an account. Withdrawing takes effect immediately, stops all further recording in your browser and on our server, and is remembered on your account so it survives signing out and back in.

To exercise any right or ask a question, contact justin@100-coins.com. We will respond within 30 days.

Applicable law

This site is operated from Quebec, Canada. Your data is handled in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU's General Data Protection Regulation (GDPR) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).