Privacy policy

Last updated: October 22, 2026

Claimheist (claimheist.com) is a claim-based sales platform for collector communities. This page explains what personal data we handle and why. The short version: we store what's needed to run a sale, and nothing is sold or shared with advertisers.

What we store

Sellers — handle, email and a hashed password when you create an account, plus the listings and products you publish.
Buyers — the handle and email you enter when you claim an item, your claims, and whether you've confirmed your email. A buyer account (password or social sign-in) is optional.
Comments — if a seller turns comments on for a sale, what you write there is stored with your handle and shown publicly on that product. Comments can't be edited after posting; the seller can hide them, and they are deleted along with your other data if you ask us to delete your account.
Reports — if you report a sale, a comment or a seller, we store the reason, what you wrote and, if you're signed in, your account, and email it to the Claimheist team. The person you report is never told who reported them. If you delete your account, the report stays without your name on it.
Blocks — a seller can block a buyer from their own sales. We store which seller blocked which buyer and when, so the block works; the buyer can't claim or comment on that seller's sales, and their comments there are hidden. Blocks are in your data export and are deleted with your account.
Social sign-in — if you sign in with Google or Facebook, we receive the email address and name the provider returns (for sellers we also store the provider's user ID so you can sign in again). We never see your Google or Facebook password, and we post nothing on your behalf.
Technical — session cookies (sign-in and claim identity) and standard server logs (IP address, timestamp). If you accept it in the cookie banner, we also collect anonymous usage statistics via Google Analytics 4 (Consent Mode v2, anonymised IP) — off by default, and you can change your choice any time via "Cookie settings" in the footer. We use no third-party advertising cookies.
Abuse prevention — with each claim we store a keyed hash of your IP address (and of its network range), never the address itself, and we keep a short record of claims that were released without a purchase. It lets us tell whether claims that never turn into a sale come from scripts or from the same person, so sales stay fair. It is used only for that, and is erased 90 days after the claim.

The Android app

The Claimheist app for Android uses the same accounts and stores the same data as the website — nothing extra is collected.

Sign-in — after you sign in (email and password, Google, or an email code for buyers), the app keeps a sign-in token on your phone, encrypted with the Android Keystore. Signing out or deleting your account removes it, and so does changing your password from another device.
Photos — the app only uses your camera or photo library when you, as a seller, add a photo to a product. Those photos are uploaded as product photos, exactly as on the website.
No tracking — the app contains no analytics, advertising or crash reporting SDKs.
Your rights — you can download your data and delete your account from the app's account screen, as on the website.

What it's used for

Running the sale: showing who claimed what, and giving the seller the winner's contact email so payment and delivery can be arranged directly between you.
Transactional email: verification codes, claim receipts and password resets. Email is delivered via Brevo (an EU email provider) acting as our processor.

What we don't do

We don't sell personal data, we don't run ads, and we don't handle payments — settlement happens directly between buyer and seller outside Claimheist.

Retention and your rights

Claims and listings are kept while the seller's account exists, so both sides keep a record of the sale. Under the GDPR you can request access to, correction of, or deletion of your personal data.

Download your data any time from your account's Settings page (a JSON file with everything we hold about the account).
Delete your account from the same page, from the app's account screen, or by writing to hello@claimheist.com. A seller's listings, products, photos and the claims on them are deleted, and buyers with unpaid claims are told the sale is cancelled. A buyer's email, name, password, sign-in connections and comments are deleted; claims they won stay with the seller as "Deleted account", without contact details, so the seller's records still add up.
Sign-ins expire. A seller sign-in ends after 30 days without use and after 90 days at most; changing your password or email, or resetting it, signs you out everywhere else.

Anything else — or if you can't sign in — write to hello@claimheist.com and we'll sort it out.

Who we are

Claimheist is operated from Denmark. Data is hosted with Hetzner in the EU. Questions: hello@claimheist.com.