Last updated: 12 October 2026
This describes exactly what Voidalis stores about you, why, and who can see it. It is deliberately specific — a privacy policy that could describe any website is not telling you anything.
Alin Robitu, an individual based at Str. Mărășești nr. 20, Județ Ilfov, Romania, is the data controller. Questions about anything on this page go to contact@voidalis.com.
When you register: your username, your email address, your password as a secure hash (never the password itself), and the city you enter.
From the onboarding questions: whether you want to trade, buy and sell or both; whether you prefer meeting in person, online or at events; which collections you are interested in; and the short bio you write about yourself.
As you use the site: the cards you mark as owned, missing or spare; how many spares you have and what you are asking for them; the deals you propose, accept, decline or complete; the messages you exchange with the other person in a deal; the reviews you leave and receive; your coin balance and what you spent it on; and anything you post or vote for on the feedback board.
We also keep a history of changes to your trade listings: when a listing was added, changed, taken down or removed, with its quantity, price and condition at that moment. You see the current state of your listings; the history exists so that we can check what a listing looked like at the time if someone complains about a trade.
Automatically: a session cookie that keeps you logged in, and standard server logs kept by our hosting provider, which include IP addresses and are used to keep the site running and to investigate abuse.
We do not ask for and do not want your home address, your phone number, your date of birth, or any payment card details.
Most of it because we cannot run your account or match you with anyone without it — that is performance of our agreement with you. Reviews, reports, moderation records, listing history and server logs we keep because we have a legitimate interest in keeping the site safe and in being able to investigate when something goes wrong. Where we ever need your consent for something, we will ask for it separately and you can withdraw it.
Public, to anyone: your username, your city, your bio, your reputation and completed-trade count, and any spares you have chosen to list. If you share your list link, that page is visible to anyone who has the link, without an account.
Never shown to other users: your email address and your password.
Between the two of you: the messages in a deal. We can read them if one of you reports a problem or if we are investigating abuse — we do not read them otherwise, and we do not use them for anything else.
Marking a card as a spare does not publish it. Nothing you own becomes visible to anyone until you list it.
The site runs on Cloudflare (Workers, D1 and R2), which stores and processes this data on our behalf, on servers inside and outside the EU under standard contractual clauses. Resend (Resend, Inc.) sends transactional emails such as password resets on our behalf. Nobody else. We do not sell your data, we do not share it with advertisers, and there is no advertising or analytics tracking anywhere on this site.
One cookie, which keeps you logged in. It is strictly necessary for the site to work, which is why you are not being shown a consent banner. There are no analytics cookies, no advertising cookies and no third-party trackers.
Your account data for as long as your account exists. When you delete your account, your lists, listings and messages are deleted with it. The one exception is the history of changes to your trade listings: we keep it for 12 months after you delete your account, so that a complaint about a trade you were part of can still be looked into, and then delete it automatically. Reviews you left about other people stay, with your name removed, so that someone else's trading record does not vanish when you leave. Server logs are kept for a short period by our hosting provider.
You can ask for a copy of your data, correct anything wrong, delete your account, take your data elsewhere, or object to us using it for safety and moderation purposes. Your collection exports as a spreadsheet from My Collection at any time, and account deletion is in your account settings.
If you think we have handled your data badly, please tell us first at contact@voidalis.com. You also have the right to complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).
You must be at least 16 to have an account here. If you believe a younger child has created one, tell us at contact@voidalis.com and we will remove it.
If we start collecting something new, this page changes first, and we will tell you on the site before it takes effect.