Privacy Policy

Version 1 · 26 August 2026

Funkopedia is a catalogue of Funko Pop figures built by collectors. This policy explains, in plain English, what we collect, what we don't, and what happens when you follow a link to a shop. Privacy policies nobody reads are worse than none, so this one tries to be readable and honest about the parts most policies gloss over.

The short version

You can browse without an account. We set a small number of working cookies (and one longer-lived one only if you ask us to keep you signed in), run no analytics or advertising trackers of our own, and keep short-lived server logs. When you press Scan to see live prices, your browser loads pictures straight from eBay, which means eBay sees your IP address. When you click through to a shop, that shop tracks the visit so we earn a small commission. That's the whole shape of it; the detail follows.

When you just browse

Cookies we set

Two while you are just browsing, and a third only if you ask us to keep you signed in — all functional, none of them tracking you across the web:

A session cookie (laravel-session) that lets the site remember you across pages during a visit, and a security token (XSRF-TOKEN) that protects forms against cross-site request forgery. Both are marked Secure and are only ever issued over an encrypted (HTTPS) connection. They expire after about two hours of inactivity; if you keep browsing they refresh.

If you tick "Remember me" when you sign in, we also set a long-lived sign-in cookie so you do not have to log in each time. It lasts up to 400 days, and signing out removes it.

We run no analytics or advertising cookies of our own. No Google Analytics, no advertising pixels, no cross-site trackers are loaded by our pages.

Server logs

Like almost every website, our server keeps a technical access log. Each entry records your IP address, the time, the page or file you requested, your browser type, and — because it is part of the web address — anything included in a search link's query string. In practice that means if you type a search and the results load as a link (for example a character name), that term can be written to the log next to your IP address. These logs are kept for about two weeks and then automatically deleted. We use them to run and secure the site, not to build a profile of you.

Which figures get looked up

When you press Scan on a figure to check current listings, we record that some browser looked up that figure on that date — so we can show which figures collectors are searching for. We do this without identifying you:

The record is tagged with a one-way hash, computed from your session using a secret key that only we hold. It cannot be reversed to identify a person, it is never linked to your account even if you are signed in, and it is regenerated every day, so activity cannot be joined together across days into a history. We store no IP address and no time of day with it — only the figure and the calendar date. These are counts of interest, not visit histories, and they are not unique-visitor numbers: the same browser looking twice in a day counts once, and the same browser tomorrow is a new, unconnected tag.

When you contribute

You only need an account to contribute. When you register we collect a username, which is public and appears on everything you contribute, and your name and email address, which are not public. Your password is stored only as a one-way hash — we never keep it in readable form. We use your email to run your account and contact you about it, not to market to you.

Photos you upload

When you upload a photograph, we strip its embedded metadata — including any GPS location and camera EXIF data — before it is stored. A photo taken at home can carry the coordinates of your home; we remove that so it is never published or kept. We store a resized web-format (WebP) copy for display and discard the original upload. What you grant us for the photo itself is covered by our Terms of Use.

Shops and affiliate links

Funkopedia earns commission when you buy through the shop links on a figure page. That involves other companies, and here is exactly what reaches them.

eBay

When you press Scan to see live listings, your browser contacts eBay directly to load the listing images. This reveals your IP address and browser to eBay, which is unavoidable whenever your browser fetches an image from another company's servers. eBay may use its own cookies and tracking on that request under its own privacy policy; eBay is not told which page of ours you were on. The listing links are affiliate-tagged, so if you click through and buy, we earn a commission — and from the moment you click, you are on eBay under eBay's tracking, not ours.

Amazon

We participate in the Amazon Associates programme. Where an Amazon link is shown for a figure, it is affiliate-tagged in the same way; clicking it takes you to Amazon under Amazon's own tracking and privacy policy.

Affiliate networks (CJ Affiliate and others)

Some shop links reach a retailer through an affiliate network — including CJ Affiliate (Commission Junction). When you click one, that network records the click using its own cookies so that a resulting purchase is credited to us. This is how the commission is attributed; it does not add cost to you. What the network collects and does with it is governed by its own privacy policy.

Turning off cookies and tracking

You are always in control of cookies:

Your browser's settings let you block or delete cookies, including the ones our affiliate partners set — though blocking our working cookies will stop you from signing in. To opt out of interest-based tracking by advertising and affiliate companies across sites, you can use the industry opt-out tools at optout.aboutads.info (Digital Advertising Alliance) and optout.networkadvertising.org (Network Advertising Initiative). eBay, Amazon and each affiliate network also describe their own opt-out choices in their privacy policies.

Your choices and rights

You can ask us to show you what we hold about your account, correct it, or delete it. Closing your account removes your photographs and, on request, de-attributes your factual contributions; the handling of contributions is described in the Terms of Use. Depending on where you live, you may have additional legal rights over your personal data, and you can exercise them by contacting us.

Children

Funkopedia is not directed to children, and accounts are intended for people aged 16 or older. We do not knowingly collect personal information from children; if you believe a child has given us personal information, contact us and we will remove it.

Changes to this policy

We will update this page when what we collect changes, and we will move the version number and date at the top when we do. Material changes will be noted here rather than made quietly.

Contact us

For anything about your privacy — a question, a request to see or delete your data, or an intellectual-property notice about a photo — email us at privacy@thefunkopedia.com.