Privacy Policy

Who we are

cofre.trade (“Cofre”, “we”, “us”) is run by Cofre LLC, a small business in Florida, USA, that buys, sells and trades graded Pokémon cards and publishes free market information. This policy covers the website cofre.trade. It does not cover other sites we link to, such as auction houses, marketplaces, news outlets or our Instagram page; they have their own policies.

What we collect

We don't have user accounts, a checkout or a payment form. We only get personal information when you send it to us through one of these forms, plus the technical data described under Analytics & cookies.

Where	What you send
Sell to us / trade (/sell)	The card's name, set, grade, cert number, your asking price (optional), whether you want to sell or trade, notes, front and back photos, your name, email and phone number (optional).
Buy, make an offer or ask about a card (on a listing)	Your name, an email address or phone number, your message or offer amount, and which card it's about.
Contact form (/about)	Your name, an email address or phone number, and your message.
Collection value offer (/collection)	Your name, contact details and the list of cards you ask us to make an offer on.
Weekly update sign-up	Your email address and the page you signed up from. Email delivery hasn't started yet: for now the update is published at /newsletter, and we'll only email it once delivery starts.
“Alert me when one comes in”	Your email address and the card you want to hear about.

With every form we also record the IP address the request came from, to stop spam and abuse. Each form carries an invisible anti-spam field and a timestamp; there's no CAPTCHA.

The collection value tool keeps your card list in your own browser (local storage, under the name cofre.collection.v1). It isn't sent to us unless you ask for an offer. A share link keeps the list in the part of the address after the “#”, which browsers don't send to our server.

Our own server doesn't keep a log of the pages you visit. Our network provider, Cloudflare, processes every request (see Who we share it with).

Analytics & cookies

Google Analytics

Every page uses Google Analytics 4 (measurement ID G-C30VP3ZZG1) to show us how the site is used in aggregate: which pages are read (the page address, including anything typed into the site's search boxes, but with email addresses and unsubscribe links removed first), how people find us, roughly where they are (country and city, derived from the IP address), the device, browser and screen size, and whether a form was sent (we record that a form was submitted, never what was typed into it). Google Analytics 4 does not store full IP addresses. We use it to improve the site, not to show you ads.

To stop Google Analytics on every site, install Google's opt-out add-on: tools.google.com/dlpage/gaoptout. Blocking cookies or using a content blocker also works; the site works fully without it. Google's own policy explains how it uses this data: policies.google.com/technologies/partner-sites.

Cookies and similar storage

cofre.trade itself sets no cookies. These are the ones you may see:

Name	Set by	Purpose	Lasts
_ga	Google Analytics	Tells one browser from another, so we can count visitors	2 years
_ga_C30VP3ZZG1	Google Analytics	Keeps track of the current visit (session)	2 years
__cf_bm, cf_clearance	Cloudflare	Security only: set when Cloudflare needs to tell people from bots, for example after a challenge. Strictly necessary; not used for tracking	30 minutes to 1 year
cofre.collection.v1 (local storage, not a cookie)	cofre.trade	Your collection value list, on your device only	Until you clear it

You can delete or block cookies in your browser settings. We don't use advertising or social-media tracking cookies, and the site doesn't embed videos, social widgets or ads.

How we use your information

• To answer you: make an offer on your card, confirm a purchase, arrange payment and insured shipping, or reply to your question.
• To send the weekly update or a card alert you asked for, once email delivery starts. Every email will have a one-click unsubscribe link.
• To keep the site safe: rate limits and spam filtering use your IP address.
• To keep business records of purchases, sales and trades, as tax and accounting law requires.
• To understand and improve the site, using aggregate analytics.

We never sell your personal information, and we don't share it for targeted (cross-context behavioral) advertising. We don't publish your name, contact details or photos.

If you're in the EU or UK, our legal bases are: taking the steps you ask for before or under a deal with us (your offer, purchase, sale or question); our legitimate interests in running a secure, working website and understanding how it is used (security and analytics); your consent for the weekly update and card alerts, which you can withdraw at any time; and legal obligations (business records).

Who we share it with

We use a few service providers to run the site and reach you. They handle data for us, not for their own marketing:

• Cloudflare delivers and protects the site. It handles every request, including your IP address, browser details and the page asked for, and keeps copies of our pages to serve them quickly.
• Google (Google Analytics) measures site use as described above.
• Google (Gmail): when you send a form, we get an email alert with your message, and we reply to you by email.
• ntfy (ntfy.sh), a push notification service, alerts our phone to a new message. The alert includes your name, contact details and the start of your message.
• Shipping carriers and payment providers, only when you buy from us or sell to us, to ship the card and pay or get paid.

Your form messages, photos and records are kept on computers we operate ourselves in the United States, not in a third-party CRM. We may also disclose information if the law requires it, to protect our rights or the safety of others, or to a buyer of the business, who would have to honour this policy.

How long we keep it

• Offers, questions and Sell-to-us submissions (including photos): as long as we need them to deal with you and for our records, and no longer than 3 years after our last contact, unless they become part of a purchase, sale or trade.
• Purchase, sale and trade records: as long as tax and accounting law requires, generally 7 years.
• Weekly update and alert sign-ups: until you unsubscribe or ask us to delete them. After you unsubscribe we keep only a note that the address unsubscribed, so we never email it again.
• IP addresses used for spam limits are held in memory for 24 hours. The IP address stored with a form message stays with that message.
• Google Analytics data is kept by Google for the retention period set in our account (at most 14 months for user-level data).
• Backups: deleted data disappears from our backup copies within about two weeks, as they roll over.

Your rights

Wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy;
• correct it;
• delete it (we may keep what the law requires us to keep, such as sale records);
• stop emailing you (or use the unsubscribe link in any email).

Residents of US states with privacy laws (such as California, Virginia, Colorado, Connecticut, Texas and others) have these rights under those laws, plus the right to opt out of the sale or sharing of personal information for targeted advertising. We don't do either, so there is nothing to opt out of. If we turn down a request, you can appeal by replying to our answer, and we'll look at it again.

If you're in the EU, the EEA or the UK, you also have the right to restrict or object to our processing, to data portability, to withdraw consent at any time, and to complain to your data protection authority. We're based in the United States, so your information is processed there.

To make a request, use the contact form and start your message with “Privacy request”. Tell us the email address or phone number you used with us, so we can find your data and confirm the request is yours. We'll answer within 30 days (45 days where US state law allows), and we won't treat you differently for using your rights. An authorized agent may make a request for you with your signed permission.

Children

cofre.trade is not directed to children under 13, and we don't knowingly collect personal information from them. If you think a child under 13 has sent us information, tell us through the contact form and we'll delete it.

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the effective date at the top. Changes apply from that date.

Contact

Questions about privacy, or a request about your data: use the contact form, or reply to any email we've sent you. Cofre LLC, Florida, USA.

See also our Terms of Service.