Effective 2026-07-31 · Last updated 2026-07-31

This Privacy Policy explains what Waxcrest ("we", "us", "our") collects when you visit waxcrest.app, how we use it, who we share it with, and what choices you have. We wrote this in plain language because the sealed-pack market already has too many pages full of legal fog — we'll keep ours readable and tell you exactly what we'd expect a privacy notice at a small DTC shop to say.

If anything below is unclear or you want a copy of the data we hold about you, email waxcrest@polsia.app and we will reply within five business days.

What we collect

We collect the minimum needed to run the tracker, the Drop-Window alert, the waitlist, and (in the future) a member account. We do not buy or rent third-party marketing lists, and we do not collect device fingerprints, advertising IDs, or social-graph profiles.

Information you give us

Email address on the Drop-Window waitlist (#alerts block on the home page) and on the early-adopter waitlist, stored in our WaitlistEntry table. We use it for the waitlist confirmation message and, if you opt in per SKU, to send a Drop-Window alert when the SKUs you specify cross a per-source price trigger ("within ~90 seconds" of the trigger being met is a Waxcrest marketing claim about the alert pipeline, not a service-level guarantee).
Email address, chosen tier, and a paid-status flag when you submit the pricing page lead-capture form, stored in our PricingLead table. The paid-flag is set true once the checkout returns a verified session; before that it's false. We use this for human follow-up and to confirm which Wartime Pricing club tier you're aiming at.
Member account profile (planned). If and when a Waxcrest account feature is launched, we will collect an email address, a password or passwordless login token, and the portfolio data you choose to add — sealed-product watchlist entries, saved filters, and your alert-configuration preferences. No member-account data is being collected today; this paragraph describes a future capability we will add when it ships.
Messages you send us when you email waxcrest@polsia.app. We keep them so we can reply and (where relevant) so we remember context across conversations.

Information we collect automatically

Anonymized page-view telemetry through our hosting platform. Page views, referrer host (truncated, no full URLs from external sites), and rough country are aggregated to understand which sealed SKUs and which blog entries people actually look at. The hosting platform uses only what its own privacy controls surface; we do not run a separate Google Analytics or Hotjar instance.
Strictly necessary cookies set by our checkout flow so Stripe can mint and remember the redirect-to-checkout URL during your session. We do not set marketing or analytics cookies, and we do not use third-party retargeting pixels.

What we do NOT collect

No phone numbers. There is no SMS or voice channel on Waxcrest, no Twilio integration, and no phone-number field on any form. If a future feature adds one, we will update this Policy before collecting a single number.
No payment card data. Checkout is a hosted redirect to Stripe Connect, and Waxcrest never sees, stores, or transmits a card number, CVC, or bank account. Card data collected at checkout is governed by Stripe's Privacy Policy, not this one.
No special-category personal data (health, biometrics, government IDs, racial or ethnic data, sexual orientation, …). The sealed-product hobby does not require it and we will not ask for it.

How we use it

We use the data above to:

Send the waitlist confirmation, the Drop-Window alert, and (if applicable) follow-up messages about the Waitlist cohort.
Follow up on a pricing lead in response to your inquiry and confirm the WPC tier you're evaluating.
Power the catalog and sealed-price tracker (read-only product data only; no per-user tracking of which cards you view beyond the anonymized telemetry above).
Operate an account feature (when shipped) and let you manage your watchlist, filters, and alert preferences.
Respond to the messages you send us.
Comply with applicable law (tax records, fraud prevention, and the lawful requests of courts or regulators).

We do not run automated decision-making with legal or similarly significant effects on you. Drop-Window alerts are not credit or insurance decisions — they're emails.

Who we share with

We share data only with the parties needed to operate the site. We do not sell, rent, or trade your data.

Stripe Connect (Stripe, Inc.) — for checkout and subscription billing. Stripe processes card and bank details on its own servers; Waxcrest never handles them. Stripe receives only the data their checkout flow requires (the chosen tier, the price, and the redirect URL). Their handling is governed by stripe.com/privacy.
Transactional email provider — for the waitlist confirmation, the Drop-Window alert, the pricing-lead follow-up, and any reply you receive from us. We use a single provider; we do not relabel or spoof the sender. The provider receives only your email address and the message body. We do not send attachments, cc/bcc copies, or custom-From headers from the consumer-facing site (they are not supported by our current delivery setup).
Hosting platform — our Next.js application runs on infrastructure that may log anonymized request metadata (URL path, response status, approximate latency) for abuse prevention and capacity planning.
Law enforcement or regulators — when compelled by a valid legal process, and only to the extent required.

We do not share your data with social platforms, ad networks, data brokers, or analytics resellers.

How long we keep it

WaitlistEntry — kept while your waitlist status is active. When you unsubscribe from a specific alert or request deletion, that entry is removed within five business days.
PricingLead — kept for twelve months after the last interaction, then deleted unless you have an active subscription or an open support thread tied to the lead. We retain leads somewhat longer than waitlist entries because pricing conversations take time to mature.
Member account data (planned) — kept for the lifetime of your account. Deleting your account removes your profile, watchlist, and alert preferences within five business days; anonymized aggregate counts (e.g. "1,204 active sealed SKUs being watched across all accounts") may be retained.
Anonymized telemetry — capped at thirteen months at the hosting platform; after that it's aggregated further or dropped.
Email correspondence — kept while we have an active thread with you, plus twelve months, then summarized or deleted.

When we delete data we delete it; we do not retain "shadow copies" in backups beyond the standard backup rotation. Encrypted backups are overwritten on their normal rolling cycle, with the longest possible retention being thirty days.

Your choices

Unsubscribe from Drop-Window alerts — every alert email includes a one-click unsubscribe link. Clicking it removes your email from that specific SKU's alert list; it does not delete your broader waitlist entry unless you also request that.
Request a copy of your data — email waxcrest@polsia.app. We will export the data we hold tied to your email address within thirty days.
Request deletion — same address. We will confirm the deletion and the date it took effect.
Object or restrict processing — if you have a concern about how we use your data, tell us. We will work with you on a workable path.

Children

Waxcrest is a hobbyist tracker and store for adult collectors. The site is not directed to children under thirteen, and we do not knowingly collect personal information from any child under thirteen. If you believe a child has submitted data through one of our forms, email us and we will delete it.

Security

We protect data with TLS in transit, encrypted storage at rest, role-based access for the small set of people who need to see it, and audit logs on changes. No system is perfectly secure — if you discover a vulnerability, please email waxcrest@polsia.app with the subject line starting with "SECURITY" so we can act on it first.

International transfers

Waxcrest is operated from the United States. If you are accessing the site from another country, your data will be processed in the U.S., where data-protection regimes may differ from yours. By using the site you understand this transfer.

Changes to this Policy

If we change anything material — a new category of data, a new third party, a longer retention window — we will post the revised Policy at this URL with a new "Effective" date at the top, and we will email active waitlist and account members at least fourteen days before the change takes effect.

Contact

Waxcrest · waxcrest@polsia.app

For data-access requests, deletion requests, security disclosures, or any other privacy question, this is the right address. Replies happen within five business days.