bountygalaxy

Privacy notice

Last updated: October 2, 2026

1. Data controller

bountygalaxy, available at bountygalaxy.com, is an unofficial fan project. Its administrator ("the Controller") is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and other applicable regulations. For any matter related to this notice, write to [email protected].

2. Personal data we collect

  • Account data: username, email address and password. The password is stored hashed and nobody, not even the Controller, can read it.
  • Content you record: the figures in your collection (packaging status, missing accessories, purchase date, price paid and notes), your wanted list (bounties, with priority, maximum price and notes) and, if you send them, figure proposals with photos, comments, the language they are written in and the link to your social network or website for the photo credit.
  • Technical data: cookies needed to keep your session, protect forms and remember your language, plus the IP address and browsing data processed by the server and Cloudflare for security. The server keeps access logs (IP address, date and time, requested page and browser) that are deleted automatically after 14 days.

We do not collect sensitive personal data or bank or payment details.

3. Purposes

We use your data for the following purposes, which are necessary to provide the service:

  • Creating and managing your account and logging you in.
  • Saving your collection and your wanted list.
  • Reviewing the figure proposals you send and, if approved, publishing them in the catalog with the corresponding credit.
  • Sharing your wanted list when you generate a public link.
  • Protecting the site against abuse and keeping it running.

We do not use your data for advertising, marketing or commercial profiling, and we do not sell it.

4. Information that becomes public

  • When one of your proposals is approved, the figure's photos and details join the public catalog, with a credit that may show your username (or the alias you choose) and the link to your social network.
  • If you share your wanted list, anyone with the link will see your username and the figures you are looking for. You can stop sharing it or generate a new link at any time.

Your email address and your collection are never shown publicly.

5. Providers that process data on the Controller's behalf

To run the site we use providers that process data only following our instructions:

  • Amazon Web Services: server hosting and private storage of images.
  • Cloudflare: site delivery, HTTPS encryption and attack protection.

These providers may have servers outside Mexico. We do not transfer your data to other third parties, except when required by a competent authority under the law, or when necessary to protect the site's rights, prevent or investigate abuse, or protect the safety of users or the public.

If the management of the project passes to another person, we will announce it on the site before transferring your data, and the new controller must honor this privacy notice.

6. Cookies

We only use technical cookies that the site needs to work:

  • Session: keeps you logged in; it lasts up to 2 weeks or until you log out.
  • Form protection (CSRF): prevents other sites from sending forms on your behalf; it lasts up to one year.
  • Language: remembers the language you chose; it is deleted when you close the browser.

We do not use analytics, advertising or third-party tracking cookies. You can block cookies in your browser, but then you will not be able to log in.

7. Retention and security

We keep your data while your account is active. If you ask us to delete it, we delete your account data, your collection and your wanted list; backups are deleted automatically within 14 days at most. Photos and information that were already approved may stay in the catalog, but you can ask us to remove your credit or your content.

The site uses HTTPS, passwords are stored hashed and images are kept in private storage accessed through temporary links. Even so, no method of transmission over the internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

8. ARCO rights and withdrawal of consent

You have the right to access your data, rectify it, cancel it or object to its processing (ARCO rights), and to withdraw your consent. To exercise them, send an email to [email protected] from the address registered in your account, including:

  • Your username.
  • The right you want to exercise and a clear description of your request.
  • Any document that helps locate your data, if applicable.

We will reply within the time limits set by law. If you believe your right was not respected, you may contact the personal data protection authority.

9. Minors

The site is not directed to children under 13 and we do not knowingly collect their data. If you are a minor, you need the consent of your parent or guardian to create an account.

If you are a parent or guardian and believe your child gave us their data without your consent, write to [email protected] and we will delete it.

10. Changes to this notice

Any change to this privacy notice will be published on this page, with its update date.