Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Kollek collects, uses, stores, and protects information when you use the hosted Kollek service.

Kollek is an open source collection management application for cataloguing, organizing, and managing personal or shared collections.

If you self-host Kollek, you are responsible for your own privacy practices, hosting environment, database, backups, and legal compliance.

1. Information We Collect

We collect information you provide directly, including:

• account details, such as your name, email address, language preference, and authentication settings;
• collection data, such as catalogues, items, copies, categories, tags, locations, conditions, sets, series, valuations, loans, maintenance records, provenance records, transactions, and notes;
• uploaded files, such as photos and documents attached to items or copies;
• account activity, such as sign-ins, security events, API key activity, audit logs, and changes made inside the application;
• support messages or other communications you send to us.

We may also collect technical information automatically, including:

• IP address;
• browser and device information;
• pages or routes requested;
• timestamps;
• error logs;
• security and diagnostic events.

2. How We Use Information

We use information to:

• provide and operate Kollek;
• create and manage user accounts;
• store and display your collection records;
• process uploads and attached documents;
• authenticate users and protect accounts;
• send transactional emails, such as sign-in, security, invitation, API key, and support notifications;
• provide support;
• detect, investigate, and prevent abuse, security incidents, and service misuse;
• debug errors, maintain reliability, and improve the service;
• comply with legal obligations.

We do not sell your personal information.

3. Your Collection Data

You own the collection information and files you add to Kollek.

We process your collection data only as needed to provide, secure, maintain, and support the service.

Kollek is a recordkeeping tool. We do not verify the authenticity, value, ownership, insurance status, provenance, or legal status of items you record.

4. Hosting, Infrastructure, and Network Protection

The hosted Kollek service uses third-party infrastructure providers to operate, secure, and deliver the application.

We use Laravel Cloud to host and run the application.

We use Turso to store application database records.

We use Cloudflare in front of the service for DNS, traffic routing, caching, performance, abuse prevention, DDoS protection, TLS termination, and other network security and acceleration features.

These providers may process technical and service data on our behalf as infrastructure, database, hosting, networking, and security providers. We rely on them to provide the services necessary to run Kollek securely and reliably.

Uploaded files, such as photos and documents, may be stored using configured file storage services used by the hosted application.

5. Encryption and Keys

Kollek encrypts information at rest where supported by the application and infrastructure.

For the hosted Kollek service, encryption keys are managed by us. We are the only party that controls those application-level encryption keys. Infrastructure providers may operate the systems that store or process encrypted data, but they do not receive our application encryption keys for normal service operation.

Encryption helps protect stored information, but no security measure is perfect. You are still responsible for protecting your account credentials and controlling who has access to your account.

6. Emails

Kollek may send transactional emails related to your account and use of the service, including:

• sign-in and security notifications;
• magic links or password-related emails;
• account invitations;
• API key notifications;
• support replies;
• account deletion or administrative notifications.

We do not use transactional emails for unrelated marketing unless you separately consent where required.

7. Cookies and Similar Technologies

Kollek uses cookies and similar technologies that are necessary for the service to work, including:

• session cookies;
• authentication cookies;
• security cookies;
• preference cookies, such as language or theme settings.

We do not use cookies to sell advertising profiles.

8. Analytics and Tracking

Kollek is designed to avoid invasive tracking.

We may collect operational logs and basic technical information needed for security, debugging, abuse prevention, performance monitoring, and reliability.

If analytics are added in the future, this policy should be updated to describe what is collected and why.

9. Sharing Information

We may share information only in limited circumstances:

• with infrastructure providers, such as Laravel Cloud, Turso, and Cloudflare, that help us operate, secure, and deliver the service;
• with service providers that process email, storage, payments, monitoring, support, or security functions;
• when required by law, legal process, or a valid government request;
• when necessary to protect the rights, safety, and security of Kollek, users, or others;
• in connection with a merger, acquisition, financing, reorganization, or sale of assets, if applicable;
• with your consent or at your direction.

We do not sell your personal information.

10. Payments

If paid hosted plans are offered, payment information may be processed by a third-party payment processor.

We do not intentionally store full payment card numbers on Kollek servers.

Payment processors may collect and process billing details according to their own privacy policies.

11. Data Retention

We keep personal information and collection data while your account is active or as needed to provide the service.

We may retain certain information longer where needed for:

• backups;
• security and fraud prevention;
• audit logs;
• legal compliance;
• dispute resolution;
• enforcing agreements.

If you delete your account or collection data, it may take time for deletion to propagate through backups and operational systems.

12. Backups

The hosted service may maintain backups for operational recovery, reliability, and security.

Backups are retained for a limited period according to our operational practices.

For self-hosted installations, backup creation, retention, security, and deletion are entirely your responsibility.

13. Security

We use reasonable technical and organizational measures to protect information, including application-level encryption, encryption at rest, authentication protections, access controls, security logging, and infrastructure security features provided by Laravel Cloud, Turso, Cloudflare, and other service providers.

No system is perfectly secure. You are responsible for keeping your login credentials safe, enabling available security features, and managing access for invited users.

14. International Processing

Your information may be processed in countries other than where you live, depending on where our service providers, hosting infrastructure, database infrastructure, network security providers, support tools, and operational systems are located.

Those countries may have different privacy and data protection laws than your jurisdiction.

15. Your Rights and Choices

Depending on where you live, you may have rights to:

• access your personal information;
• correct inaccurate information;
• delete your information;
• export your data;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• file a complaint with a privacy regulator.

You can manage much of your account and collection information directly inside Kollek.

To make a privacy request, contact us using the details below.

16. Children

Kollek is not intended for children under 13, or the minimum age required by law in your jurisdiction.

We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can take appropriate action.

17. Open Source and Self-Hosting

Kollek may be available as open source software.

If you download, modify, or self-host Kollek, your use of the software is governed by the applicable open source license.

This Privacy Policy applies to the hosted Kollek service operated by us. It does not apply to independent self-hosted installations operated by other people or organizations.

18. Changes to This Policy

We may update this Privacy Policy from time to time.

If changes are material, we will take reasonable steps to notify users, such as posting a notice in the service or updating the date above.

Your continued use of Kollek after the updated policy takes effect means the updated policy applies.