Ostentio ("Ostentio", "we", "us") operates the website at ostentio.app — a public showcase where card collectors catalogue what they own and share it. We are based in Australia and this policy is written to meet the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This policy explains what personal information we handle, why, where it goes, and what you can do about it. It applies to the website and to any mobile app we release under the Ostentio name.
We only collect what the product actually needs to work. In practice that is:
We do not collect payment information. Ostentio does not sell anything, does not process transactions, and is not a marketplace. We do not ask for your address, phone number, or date of birth.
Photos. Photos you upload are stored as image files. If your camera embeds location data in a photo, that data travels with the file — we do not read it or use it, but we also do not strip it. If that matters to you, turn off location tagging in your camera app, or strip it before uploading.
This is the most important thing to understand about Ostentio, so it gets its own section.
Public means public. Your profile page can be viewed by anyone with the link, indexed by search engines, and copied or archived by third parties in ways we cannot control or undo. Do not put anything in your bio, your card notes or your photos that you would not want permanently visible.
We do not sell your personal information. We do not share it with advertisers, data brokers or marketing networks, and we do not build advertising profiles.
You can create an Ostentio account using Google or X instead of a password. When you do, that provider tells us your email address and, where available, your display name and profile picture. We do not receive your password, and we do not get access to your Google account, your posts, or your contacts.
We do not post anything to your Google or X account, ever. Whether you signed in with a provider is recorded against your account so that we can sign you back in the same way next time. You can revoke Ostentio's access at any time from your Google or X account settings — doing so may prevent you signing in, so set a password first or contact us.
Beyond what you publish publicly, we disclose personal information only to the service providers that make Ostentio run, and only so they can perform that function:
We may also disclose personal information where we are required to by Australian law, a court order, or a lawful request from a regulator or law enforcement agency, and where it is reasonably necessary to protect someone's safety or to investigate a serious breach of our Terms.
If Ostentio is ever sold or merged, account information would transfer to the new operator. We would tell you before that happened and this policy would continue to apply until you were given notice of a replacement.
Your information is stored outside Australia. Australian Privacy Principle 8 requires us to say so clearly rather than bury it.
Our database, your account record and your uploaded photos are held by Supabase in Tokyo, Japan. Website hosting (Netlify) and email delivery (Resend) are provided from the United States. By using Ostentio you consent to your personal information being stored and processed in those countries.
We take reasonable steps to work only with providers that maintain recognised security standards, but you should understand that overseas providers are subject to the laws of the countries they operate in, and those laws may differ from Australian privacy law.
No online service can promise perfect security. If we become aware of a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
We keep your information for as long as your account exists. You can delete your account at any time from Settings → Delete account.
Deleting your account removes:
One honest caveat. Image files you uploaded may remain in our storage bucket after your account is deleted, even though the card records that pointed at them are gone. The links are no longer published anywhere on Ostentio, but the underlying files are not yet purged automatically. If you want your uploaded photos deleted as well, email us and we will remove them. We intend to make this automatic and will update this policy when we do.
Backups and provider logs may retain copies for a short period after deletion before they age out in the ordinary course. Deletion is permanent — we cannot restore an account or its cards afterwards.
Under the Australian Privacy Principles you may:
We do not charge for access requests. We may ask you to verify your identity before acting on one, so that nobody else can request your information.
Ostentio is not for children. You must be at least 15 years old to create an account. We do not knowingly collect personal information from anyone under 15.
If you are a parent or guardian and believe your child has created an account, email us and we will delete it and the information associated with it.
Ostentio uses browser storage for one purpose: keeping you signed in. Your authentication session is stored locally in your browser by our authentication provider. Clearing your browser storage signs you out.
We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across other sites. If that ever changes, we will update this policy and, where the law requires it, ask for your consent first.
We may update this policy as Ostentio develops. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your personal information, we will notify you by email or with a notice in the app before it takes effect. Continuing to use Ostentio after a change means you accept the updated policy.
For any privacy question, access request, correction or complaint, email [email protected].
We will acknowledge your complaint within a reasonable time and aim to respond substantively within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner — oaic.gov.au, or 1300 363 992.