Privacy notice
Last updated 7 October 2026
This explains what Retroly keeps about you, why, who else sees it, and your rights. The short version: we keep what's needed to run your collection, your shop and your orders; we don't sell your data, show adverts or use tracking or analytics cookies.
Who's responsible
Retroly is the controller of your personal data under UK data protection law.
What we keep and why
| What | Why | Legal basis |
|---|---|---|
| Your name, email address and password (stored only as a secure hash) | Your account and signing in | Contract |
| Signed-in devices: browser, approximate device type and IP address; sign-in attempts | Keeping your account secure, showing you where you're signed in, stopping password guessing | Legitimate interests (security) |
| Your team, collection, wishlist, notes, prices paid, where you bought things, and spreadsheets you import | The service you use us for | Contract |
| Photos you upload (location and camera data removed) | Showing your copies, and in your shop if you choose | Contract |
| Shop details: shop name, location, about text, payment details you choose to give buyers (such as bank details or a PayPal email) | Running your shop and checkout | Contract |
| Orders and offers: items, prices, your delivery name and address, messages, tracking numbers | Completing purchases between buyers and sellers | Contract |
| Refer a friend: who invited you, who you invited, rewards earned and paid, and the PayPal email you give for rewards | Paying referral rewards | Contract |
| Messages, bug reports, feature requests and votes | Answering you and improving the site | Legitimate interests |
| Sold prices from public listings (no buyer or seller names) | Estimating values | Legitimate interests |
Who else sees it
- Other users: the leaderboard shows your first name and initial (or a nickname you choose) with your rank and points; you can hide yourself from it. if you joined through someone's invite link, they see your name and whether you've earned the reward. your shop and its listings are public if you open a shop. When you buy, the seller sees your name, delivery address, email and order; when you sell, the buyer sees your shop name and the payment details you've set. People in your team see your team's collection.
- Railway hosts the site and its database.
- Resend sends our emails (invitations, password resets, order and offer updates) and receives email sent to our support address.
- Anthropic: when you use Snap the cover with AI reading, the photo is sent to Anthropic's Claude to read the cover. It isn't used to train their models.
- Royal Mail: if a seller uses Click & Drop, the buyer's name, address and email go to Royal Mail to make the postage label and send tracking updates.
- PayPal or the seller's bank, when you pay a seller (you deal with them directly; we don't see your payment details).
- Library pictures are loaded from Spectrum Computing and other public archives, so those sites see the request from your browser (your IP address), as with any web page.
Some of these providers are outside the UK. Where they are, the transfer is covered by UK adequacy rules or the standard contractual protections those providers offer. We don't sell personal data, and we'd only share it otherwise if the law requires it.
Cookies
We only use cookies the site needs to work, so there's no cookie banner:
| Cookie | What it does | How long |
|---|---|---|
rv_session | Keeps you signed in | 30 days, or until you sign out |
rv_csrf | Protects your forms from being submitted by other websites | Your browser session |
rv_ref | Remembers whose invite link brought you here, so you both get the referral reward if you join | 30 days |
theme | Remembers light, dark or automatic, when you choose one | 1 year |
No advertising, analytics or tracking cookies, and no third-party cookies.
Visit statistics
To see how many real people use the site (as opposed to search engines and other bots), which pages help them and whether they come back, we count page views ourselves, without cookies and without anyone else. For each page we note the address of the page, the site you came from, the kind of device (phone, tablet or computer), and how long the page was on screen and how far down you read. We also note the words people search for and how many results they got (with the day's scrambled code, not who you are), to see what's missing from the catalogue.
We don't store your IP address. To count a visitor within a day we keep a scrambled code made from it and your browser's name, with a key that changes every day, so it can't be turned back into your address. To tell a return visit from a new one, once you've scrolled, tapped or typed on a page your browser keeps a random code (in its local storage, not a cookie) and sends it with these statistics; if you're signed in, a code made from your account is used instead. Neither is used for anything else, shared, or linked to your address. If your browser sends Global Privacy Control, no code is kept. We keep these statistics so we can compare over time.
Applies to this browser.
How long we keep it
- Your account and collection: while you have an account. When it's closed we delete them within 30 days, except what we must keep.
- Orders: for 6 years after the sale, as records of a transaction the buyer or seller may need.
- Signed-in devices end after 30 days without use; sign-in attempts are kept briefly for security.
- Spreadsheet imports: until you delete the import (the copies it added stay in your collection).
Your rights
You can ask to see the data we hold about you, to correct it, to have it deleted, to receive a copy to take elsewhere, and to object to or restrict how we use it. Much of it you can change yourself in Settings. To ask, send a message from Help; we'll reply within a month. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Passwords are hashed, connections are encrypted, photos are stripped of location data, and sign-in is rate-limited. Tell us straight away if you think your account has been misused.
Changes
If we change how we use your data in a way that matters, we'll tell you before it happens. The date at the top shows the latest version.
See also our terms of use.