USD CAD
Start Tracking
100 Coins
USD CAD

Privacy Policy

Last updated: October 14, 2026

This policy explains how 100 Coins (100-coins.com) collects, uses, and protects your personal information. Questions? Contact justin@100-coins.com.

What we collect

We collect only what is necessary to provide the service:

  • Email address — when you create an account, used only for authentication via Firebase.
  • Watchlist and collection — the games you add and their details (edition, condition, cost paid). Stored to provide personalized features.
  • Shared collection links — if you share a collection, we store an anonymous list of its games (game, edition, condition) under a random link you can send to others. It contains no personal information.
  • Analytics events — we record usage events (pages viewed, games searched and opened, which controls you use) to understand how the site is used. If you browse without an account, nothing is recorded unless you accept on the cookie banner, and declining means nothing is recorded at all. If you create an account, analytics is on — creating one is your acceptance, as stated when you sign in — and you can turn it off at any time from your Account page, on every device. Events are identified by a numeric user ID; your email address is shared with PostHog only at first sign-in, to link your analytics profile to your account. If you have an account we also store aggregate figures on your analytics profile — how many games are in your collection and watchlist, their total value, and your currency — never the games themselves.
  • Paid plan — if you subscribe, we store the identifiers our payment provider gives us for you and your subscription, your plan's status, its renewal or end date, its billing currency, and the country of your billing address (used to check that the right currency was charged). Your card details go directly to the payment provider and never reach us.

We do not collect your name, address, phone number, card or bank details, or any sensitive personal data. We do not store IP addresses in our database. They are used in memory for rate limiting and abuse prevention, and our hosting provider's request logs (Google Cloud) record the IP address of each request, which we keep for 30 days to diagnose errors and abuse.

Third-party services

  • Google Cloud — hosts this site and its database (Cloud Run and Cloud SQL, in Google's us-central1 region, United States). Your account data is stored there. Google Cloud Privacy Notice.
  • Firebase / Google — handles authentication (passwordless email link and Google sign-in). Your email is sent to Firebase to complete sign-in. Firebase Privacy Policy.
  • PostHog — analytics, used if you accept on the banner or have an account. Receives usage events identified by a numeric user ID, and your email address at first sign-in to link your analytics profile. Its client library also records ordinary interactions automatically, such as which buttons and links you click and their visible text. Server-side error diagnostics (stack traces from unexpected failures) are also sent to PostHog to help us fix bugs. PostHog Privacy Policy.
  • Cloudflare — DNS for this domain. Requests to 100-coins.com (without the www) are proxied by Cloudflare, which may process IP addresses and set security cookies; www.100-coins.com, the address this site uses, resolves directly to Google Cloud. Cloudflare Privacy Policy.
  • Stripe and Link — process payments for the paid plan. The plan is sold through Link, a payment service of Stripe, as merchant of record: Link charges your card, collects sales tax and sends your receipts. When you start a checkout we send Stripe your email address and your numeric user ID; Stripe tells us the status of your subscription and the country of your billing address. Stripe Privacy Policy, Link Privacy Policy.

We do not sell or share your personal information with advertisers, data brokers, or marketing partners.

ChatGPT plugin

100 Coins offers a plugin that lets ChatGPT look up game prices for you. When you use it, ChatGPT (operated by OpenAI) sends us the lookup it wants to make, such as a game title or ID, and we send back the same public price data shown on this site. What you type into ChatGPT and your ChatGPT account details stay with OpenAI and are covered by the OpenAI Privacy Policy.

  • An anonymous ChatGPT identifier — ChatGPT sends an anonymized user identifier with each lookup. We never store it as received: we store only a one-way, salted hash of it, together with how many lookups it has made and when it made its first and latest one. This is how the number of lookups available without signing in is limited. The hash cannot be turned back into the identifier, and we cannot link it to you, your ChatGPT account or your 100 Coins account. Connecting your account (below) does not change this.
  • A daily total — a count of lookups made without signing in, per day, across everyone. It contains no personal information.
  • Analytics events — we send PostHog an event when such a lookup is made (which kind of lookup it was and how many that identifier has made) and when the limit is reached, identified only by the hash above. We do not create an analytics profile for it.
  • Connecting your 100 Coins account — if you choose to connect ChatGPT to your account, you sign in on 100-coins.com and approve the connection. We then store the connection (which app, when you connected it and when it was last used) and the access codes ChatGPT uses for it, which we keep only as one-way hashes. Lookups ChatGPT makes with those codes count as your account's, so that your plan applies to them; we send no analytics events for them. ChatGPT learns nothing about you from us beyond whether your account can use the plugin: not your email address, collection, watchlist or payment details. You can disconnect at any time from your Account page, and deleting your account deletes the connection.

We do not store the games you look up through ChatGPT, and we do not use the language, location or other information ChatGPT may send with a lookup. The IP address our hosting provider records for a plugin request is that of OpenAI's servers, not yours. Lookup counts are kept so the limit keeps applying; because they cannot be linked to you, we cannot look them up or delete them on request.

Cookies and local storage

We use the following first-party cookies:

  • Session cookie — strictly necessary for login. Stores your user ID and a CSRF security token. HTTP-only, Lax SameSite, expires after 365 days.
  • Currency cookie — remembers your USD/CAD display preference. Expires after 365 days.
  • analytics_ok cookie — set when you accept analytics on the banner, and when you sign in to an account. Without it the server records no usage events at all. Cleared if you decline or withdraw consent, and your withdrawal is stored on your account so signing in again does not undo it. Expires after 365 days.

Your watchlist and collection are also stored in your browser's local storage when you are not logged in. This data never leaves your device unless you create an account.

Data retention

Your personal data is retained until you delete your account. Deleting your account permanently removes your email address, watchlist, and collection from our database. If you have a paid plan, deleting your account first cancels it, and also removes your plan details and payment-provider identifiers from our database; Stripe and Link keep their own records of your payments under their privacy policies.

Shared collection links expire 7 days after they are created and are then deleted automatically, whether or not anyone has opened them. A shared link is a short-lived way to show someone your collection, not a permanent page — the expiry date is shown on the shared page itself.

Your rights

Under PIPEDA (Canada) and GDPR (EU), you have the right to access, correct, export, and delete your personal data:

  • Access and export — download a copy of your data from your Account page.
  • Delete — permanently delete your account and all associated data from your Account page.
  • Withdraw analytics consent — turn analytics off at any time from your Account page, whether you accepted on the banner or by creating an account. Withdrawing takes effect immediately, stops all further recording in your browser and on our server, and is remembered on your account so it survives signing out and back in.

To exercise any right or ask a question, contact justin@100-coins.com. We will respond within 30 days.

Applicable law

This site is operated from Quebec, Canada. Your data is handled in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU's General Data Protection Regulation (GDPR) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).