Privacy Policy

1. Who we are

CrowdCollectable is a hosted private vault and public museum for real collections, operated by BWN Group in Australia. We are not an auction house, broker, or marketplace taking offers. Bounties and escrow are in development and are not live.

Questions: support@mail.crowdcollectable.com.

2. What we collect

• Account details you give us: email, username, display name, password hash (via our auth provider).
• Vault and museum content you upload: photos, titles, descriptions, and item attributes.
• Claim-link activity when you redeem a hosted museum.
• Waitlist and feedback emails, and claim or take-down requests, if you send them.
• For pre-built vaults only: public posts and pages about a collection, the contact routes a collector publishes for enquiries, and a record of our messages to them (see Pre-built vaults).
• Basic device and usage data (pages viewed, errors) via first-party and hosting analytics.

We do not need payment cards. There are no paid vaults and no checkout on this product today.

3. Why we use it

To run your account, store your vault, publish the items you mark public, process a claim or takeover of a hosted museum we issued to you, keep the service secure, and reply when you contact us. We do not sell collector lists or museum photos.

4. Public museum vs private vault

Private vault items stay in your account. Public museum items — including photos you choose to publish — can be seen by anyone with the link or who browses the museum. Serial numbers and similar fields can be kept private even when the item is public. You decide what is on show.

5. Photos you upload

You keep ownership of photos you take or have the right to use. We store copies so we can show them on the service (and on share cards for public items). See the Terms for the licence you grant us to host and display that content.

6. Hosting and overseas storage

The site is hosted on infrastructure that may store data outside Australia (including the United States). If you use CrowdCollectable, your account and photos may be processed on those servers. We take reasonable steps to keep that hosting locked down.

These overseas organisations receive personal information from us:

• Vercel (hosting and the AI Gateway) (United States): hosts the site and routes AI drafting requests.
• Anthropic (Claude, reached through the Vercel AI Gateway) (United States): drafts pre-built vault pieces from public posts and pages.
• Meta (Instagram) (United States): official Instagram embeds and embed checks.
• TikTok (United States and other countries): official TikTok embeds and embed checks.
• Google (YouTube) (United States): official YouTube embeds (privacy-enhanced mode) and embed checks.

7. Pre-built vaults

Some vaults are pre-built by CrowdCollectable for collectors, creators, brands and venues who already show their collections in public, so they can claim a ready-made vault instead of starting from nothing. A pre-built vault says so on the page, and it stays out of search engines until its owner claims it. We set some up by hand, and some with our Vault Scout tool.

What we use. Only what the person has made public themselves: their public name or handle, links to their public Instagram, TikTok and YouTube posts, and public press or web pages that allow automated reading. We collect facts about the objects in their collection, not about their private life. We do not collect sensitive information, and we do not build vaults for anyone who appears to be under 18 or for private individuals.

How Vault Scout works. A person at CrowdCollectable chooses each source. We read Instagram, TikTok and YouTube only through their official embed services, and web pages only where their robots.txt allows it. Before the text of a post or page is stored or sent anywhere, we remove email addresses, phone numbers and street addresses from it. An AI model (Anthropic's Claude, reached through the Vercel AI Gateway) drafts short, factual descriptions in its own words from that text. A person reviews every draft before anything is published.

Photos. Vault Scout never copies anyone's photos: until the vault is claimed, such a piece shows the owner's own public post through the platform's official player, which loads only when a visitor taps it. When the owner claims the vault, those embedded posts are removed and the owner adds their own photos. Some pre-built vaults also show photos we host ourselves: photos we took, photos the owner gave us for their vault, or photos we use under a licence (for example Wikimedia Commons or a press kit), with that basis recorded for each one. We remove any of them on request.

Contacting the owner. To offer someone their vault, we may note the contact routes they publish for enquiries (for example a business email address or a social media handle). We keep a record of each message we send about a vault: who it went to, how, when and what it said, and whether they replied. If you ask us about a vault through the “Is this you?” panel or our contact form, we keep your email address and message so we can answer. We only ever contact someone about a pre-built vault one to one, by a person, never in bulk.

How long we keep it. The text Vault Scout reads from posts and pages, and our review notes on it, are deleted after 90 days (the title and link of each source stay, so we know what a vault was built from). A vault built with Vault Scout that is not claimed within 90 days of going live is archived (taken off the site). Vaults we set up by hand stay up until their owner claims them or asks us to take them down. Contact notes and the record of our messages are kept while the vault exists, including after it is taken down, so we never contact the same person twice. Ask us and we will delete them, apart from a note of the name so we don't build the vault again.

Is this you? You can claim your vault, ask us to correct it, or ask us to remove it, at any time: use the “Is this you?” panel on the vault or email support@mail.crowdcollectable.com. Removal takes the vault and its embedded posts down, and we record the name so the vault is not built again. We aim to act within two business days.

8. Cookies and analytics

We use session cookies to keep you signed in. Optional analytics are off by default. We do not run an advertising pixel network.

9. How long we keep it

Account and vault data stay while your account is open. If you delete an item or close the account, we remove it from the live museum. Backups and logs may persist for a short period for security and recovery. Claim tokens expire or are marked used.

10. Access, correction, and deletion (Australia)

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. Email support@mail.crowdcollectable.com. We will deal with requests in line with the Australian Privacy Principles.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC). We would rather fix it with you first.

11. Children

The service is aimed at adults. Do not create an account for a child without a parent or guardian managing it.

12. Changes

If this policy changes in a material way, we will update this page and the date above (currently 30 September 2026).