How we handle your personal information. Last updated 20 July 2026.
This policy explains what personal information we collect through the site, why we collect it, who we share it with, and what you can ask us to do with it.
Items from the collection are occasionally sold to other collectors. Because of that we treat this notice as being given under section 7 of the Personal Data Protection Act 2010 ("PDPA"), and we handle your information according to that Act whether or not it strictly applies to a collection of this size.
What we collect
We only collect information you give us directly. We do not run analytics, advertising, or third-party tracking scripts on this site.
Account details — if you register, we store your name, email address, phone number, and a securely hashed version of your password. We never store your password in readable form.
Wishlist activity — the collection items you save to your wishlist, linked to your account.
Enquiries — if you use the contact form, we store the name, email, phone number, and message you submit.
Essential cookies — a session cookie that keeps you logged in. It is required for the account area to work and is not used for tracking or advertising.
If you contact us on WhatsApp using a link on this site, that conversation happens on WhatsApp and is governed by their privacy policy, not this one. We keep the messages you send us as a record of the enquiry.
All of this information comes from you directly. We do not buy personal information, and we do not collect it about you from any other source.
Whether you have to give us this information
Giving us your personal information is voluntary — you can browse the public parts of this site without providing any of it. But some of it is required for particular features, and if you choose not to provide it we cannot make those features work.
Your name, email address, and password are required to register. Without them we cannot create an account, and you will not be able to save a wishlist or see member-only content.
A verified email address is required to activate your account and to reset a forgotten password.
Your name, email address, and message are required to submit the contact form. Without them we cannot reply to you.
Your phone number is optional. We use it only to reach you about an enquiry when email is not practical.
Why we use it
To create and maintain your account, verify your email address, and let you reset your password.
To show you your saved wishlist and give registered members access to member-only content.
To respond to your enquiries about items in the collection.
To keep the site secure and prevent misuse.
We do not sell your personal information, and we do not use it to send marketing emails unless you have separately asked us to.
Who we share it with
We use a small number of service providers to run this site. They process data on our behalf and only for the purposes below.
Vercel — website hosting and image storage.
Neon — the database where accounts, wishlists, and enquiries are stored.
Resend — sends transactional email such as verification and password reset messages.
We share your information with these providers only to the extent needed to run the site, and we do not disclose it to anyone else except where the law requires it or where it is necessary to deal with an enquiry you have made.
Transfers outside Malaysia
The providers listed above store and process data on servers outside Malaysia, including in the United States and Europe. By registering or sending us an enquiry you consent to your information being transferred and processed there for the purposes set out in this policy.
Before transferring your information we take reasonable steps to satisfy ourselves that it will receive protection substantially similar to that required under the PDPA, and that it will only be processed for the purposes described here. Each of these providers is contractually bound to process the data only on our instructions and to keep it secure.
How long we keep it
Account information is kept for as long as your account is open. Enquiries are kept for as long as we need them to deal with your request and keep a record of the transaction. If you ask us to delete your account, we remove your account details and wishlist.
Your rights
Under the PDPA you have the following rights over the information we hold about you. You can exercise any of them by emailing us at the address below. We may ask you to confirm your identity first, and we will respond within the period the PDPA allows.
Access — ask for a copy of the personal information we hold about you.
Correction — ask us to correct anything inaccurate, incomplete, or out of date. You can also update your own name, phone number, and password directly from the account area at any time.
Limit processing — ask us to stop or restrict processing your information for a particular purpose, including asking us not to contact you.
Withdraw consent — withdraw your consent to our processing at any time. Withdrawing consent for information we need to operate your account means we will have to close the account.
Delete your account — ask us to close your account and remove your details and wishlist. The site does not currently have a self-service delete button, so we handle these requests by hand and confirm once it is done.
If you are not satisfied with how we have handled a request, you may complain to the Personal Data Protection Commissioner of Malaysia.
Security
Passwords are hashed, the site is served over HTTPS, and access to the database is restricted. No system is perfectly secure, so please use a password you do not reuse elsewhere.
If a breach of personal data occurs that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, the individuals affected, within the timeframes set by the PDPA.
Minors
This site is intended for adults. If you are under 18 you may only register with the consent of a parent or guardian, who will be treated as responsible for the account. We do not knowingly collect information from a child without that consent — if you believe we have, contact us and we will remove the account.
Changes
If we change this policy we will update the date at the top of the page. Significant changes affecting registered members will be notified by email.
Contact
Questions about this policy, or any request to access, correct, or delete your information, can be sent to numisbob@hotmail.com.