What we store, and why.
SlabHub is run from the Netherlands and hosted in the EU. We keep as little about you as the product allows, we do not track you around the internet, and you can have everything back or deleted by sending one email.
We store your email address and the username you reserved. We use them to hold your name and to tell you when SlabHub opens. We do not sell data, we run no advertising, and we set no tracking cookies — which is why you have never seen a cookie banner here.
Who is responsible
SlabHub is operated by its owner, based in the Netherlands, who is the data controller for the purposes of the GDPR. For anything in this policy — access, correction, deletion, export, or a complaint — write to davidptcgnl@gmail.com and you will get a human reply.
What we collect, and on what basis
| What | Why | Basis |
|---|---|---|
| Email address | To hold your reservation and email you when we open | Your consent |
| Chosen username | It becomes your page address, and is reserved so nobody else takes it | Your consent |
| Rough collection size (optional) | To understand who is signing up and in what order to open | Your consent |
| Sign-up time | Reservations are first come, first served, so the order matters | Your consent |
| Account sign-in records | To keep you signed in and to secure the account | Performing our agreement with you |
| Anything you publish later — slab details, photos, display name | It is your public page; publishing it is the point | Performing our agreement with you |
We do not ask for or store payment details, addresses or identity documents, because SlabHub handles no payments, escrow or shipping.
Cookies and tracking
We run no analytics products, no advertising pixels and no third-party trackers, so there is nothing to consent to and no banner to dismiss. If you sign in, your browser stores a sign-in token so you stay signed in — that is strictly necessary for the service and is not used to profile you.
There is one measurement, and this is all of it. Sellers were being signed out and having to ask for a new code, and we could not fix that without knowing how long a sign-in actually lasts on a real phone. So a signed-in browser reports, at most once a day: how many hours since it last signed in, how many times it has ever signed in, and whether it is running as a normal browser, an installed app or inside Instagram. It is tagged with a random number generated on your device, which exists only so that one phone reporting for a month counts as one phone. No account, email, username, IP address or page you visited is stored with it, and nothing in it can be traced back to you or joined to your vault. It is read once a morning as a single set of totals. Clearing your browser data erases the random number and it starts again as a new one.
Where your data lives, and who processes it
- Supabase (database, sign-in and photo storage) — hosted in Frankfurt, Germany.
- Our web server — a virtual server in Europe that runs the site.
Both act as processors on our instructions. Your data is not transferred outside the EU or the EEA. When we later add an email provider to send sign-in links, it will be added to this list before it is used.
How long we keep it
Sign-up list entries were how usernames were reserved before SlabHub opened. Anyone can create an account now, and unclaimed reservations release on 31 August 2026 — after that a reservation entry holds nothing and is kept only as a record that you asked us to. If you ask us to remove you, we delete the entry rather than mark it inactive. Account data stays for as long as your account exists; delete the account and it goes with it. Our server also keeps a plain backup copy of sign-ups, held outside the public website, and deletions are applied to it too.
Your rights
Under the GDPR you can ask us to show you what we hold, correct it, delete it, hand it to you in a portable file, or restrict what we do with it. You can also withdraw consent at any time — for the waitlist, that simply means asking to be taken off. Email davidptcgnl@gmail.com; we aim to answer within a few days and are required to answer within one month. If you think we have handled your data badly, you can complain to your national data protection authority — in the Netherlands that is the Autoriteit Persoonsgegevens.
Security, honestly stated
Traffic is encrypted, the database enforces access rules per account, and administrative credentials live outside the public website. No system is perfect. If personal data is ever exposed in a way that puts you at risk, we will tell affected people and the regulator, rather than quietly patch it.
Children
SlabHub is meant for people aged 16 and over. We do not knowingly hold data about anyone younger; if you believe we do, email us and it will be removed.
Changes
If this policy changes in a way that affects you, we will say so on the site and, where the change is significant, by email. The date at the top always reflects the current version.