Who we fetch from, and how to reach me if you’d rather we didn’t.

Every Rarix connector — whether it runs on a user’s phone or on our worker — sends this exact identifier:

rarix.app/1.0 (collector tracker; +https://rarix.app/legal/connector)

The URL in the UA points back here. Block it, throttle it, allowlist it — your call. We’d rather you write me first (address below) so we can fix the actual problem instead of playing cat-and-mouse with a UA string.

• Scryfallserver (worker)
  Sourceapi.scryfall.com
  Cache TTLPer Scryfall's API rate-limit guidance (≤10 req/s; ETag honored)
  NotesLicensed catalog for Magic: The Gathering. Images stored in r2://owned/ under Scryfall's terms.
• Pokémon TCG APIserver (worker)
  Sourceapi.pokemontcg.io
  Cache TTLHot-entity refresh on demand; respect official rate limits
  NotesLicensed catalog for Pokémon TCG. Images stored in r2://owned/.
• MyFigureCollection (MFC)client (user device)
  Sourcemyfigurecollection.net
  Cache TTLPer-itemId 24h in-process cache on client
  NotesRuns on the user's device to use their real browser fingerprint past Cloudflare bot detection. Cached images served from r2://cached/ — never publicly redistributed.
• Pop Mart Storefrontclient (user device)
  Sourcepopmart.com (US + global)
  Cache TTLPer-spuId 24h in-process cache
  NotesParses public __NEXT_DATA__ off the storefront SPA. Cached images served from r2://cached/.
• Mercari JPclient (user device)
  Sourcejp.mercari.com
  Cache TTLPer-query short-window cache (price observations are time-sensitive)
  NotesSold-listing price signal only. Disabled in regions without a licensed-via flag; see /legal/terms.
• Colekaclient (user device)
  Sourcecoleka.com
  Cache TTLPer-itemId 24h in-process cache on client
  NotesOpen figure catalog mirror. Cached images served from r2://cached/.
• Redditserver (worker)
  Sourcereddit.com (public JSON endpoints)
  Cache TTLPer-thread short-window cache
  NotesCommunity pull-rate signal only. We aggregate; we don't republish user content.

Pop Mart, MFC, Coleka — these are public storefronts and catalogs. We cache parsed responses per-item for 24 hours so we’re not hitting your CDN every time a user opens the same figure in their binder. If a user adds a Skullpanda to their collection at 9am and reopens it at 9pm, your server sees one request, not two. Worker restarts flush the cache (it’s process-local for v1).

Images from licensed APIs (Scryfall, Pokémon TCG) live in our ownedbucket and can be served publicly under those sources’ terms. Images we scrape from open catalogs live in our cached bucket, are keyed by content hash to dedupe across sources, and are neverserved via a public Rarix URL. They exist only to render inside an authenticated user’s own collection view.

If you own one of the sources above and want us to back off, rate-limit differently, or stop entirely — email me:

[email protected]

Real address. Reply isn’t instant — it’s just me — but it comes.