Privacy Policy

Rarix is operated by Rarix LLC (Delaware, USA). One human (Andrei) does the engineering, support, and these legal pages. If anything below sounds vague, email privacy@rarix.appand we’ll explain or fix it.

To make accounts and the vault work:

• Email + password. Email is your login. The password is hashed (bcrypt via Better-Auth) — we never see or store the plaintext.
• Handle + display name. Public on rarix.app/u/@handle if you make a binder public.
• Avatar + collection data.What you own / want / have for trade. Set completion %. Foil & condition. Notes.
• Scan attempts. When you scan a card or figure, we store the image, the embedding, the top-K matches, and which one you confirmed. Used to improve the recognition model.
• Push tokens. If you opt in to notifications, we store the Expo push token + platform.
• Sessions. A signed cookie identifying your logged-in browser/device. Better-Auth handles rotation.
• Server-side error logs. When the API errors, we log a stack trace + the request path. No request bodies, no cookies.
• Date of birth (year and month only).Captured once at signup. We use it to confirm you’re at least 13 before letting you create a primary account. We don’t ask for the day. We don’t share it with anyone. We don’t use it for personalization, advertising, or analytics.
• Purchase History (affiliate clicks).When you tap a “Buy this card”, “Complete this set”, “Buy this figure” or supplies CTA, we log a server-side click: the partner (eBay, TCGplayer, Amazon, etc.), the entity, the timestamp, and (if you’re signed-in) your user id. We log this to attribute commission revenue and measure which surfaces convert. We do not see what you actually buy — the partner’s purchase flow happens on the partner’s domain, and the partner does not share order contents with us. You will be able to disable affiliate-click logging in your account settings (users.allow_affiliate_click_logging) — that toggle is shipping soon; until then the click log is first-party and never shared with anyone besides the partner network we’re crediting the click against.

We don’t run third-party analytics. No Google Analytics, no Segment, no Meta pixel. No ads. Ever. Not banner ads, not native ads, not behavioral advertising, not third-party tracking pixels. The business model is a free tracker plus optional Pro workflow tools — your data is never the product.

• To run the service you signed up for (Art. 6(1)(b), contract performance) — accounts, vault, scan, public showcase.
• To improve recognition (Art. 6(1)(f), legitimate interest) — scan_attempts data trains the matcher. You can delete your account and all of it goes (or gets anonymized, see retention).
• To send you push notifications (Art. 6(1)(a), consent) — opt-in only, off by default. You toggle it in Settings.
• To maintain security & prevent abuse (Art. 6(1)(f), legitimate interest) — rate limits, B2B API key tracking, honest fraud prevention.

• Account + collection data: until you delete your account. After that, fully removed within 30 days from live + backups.
• Scan attempts:90 days at full fidelity (linked to your user_id), then anonymized — the row stays in the aggregate ML dataset, but your user_id is set to NULL so the scan can’t be tied back to you. Fully removed if you delete your account before the 90-day mark.
• Sessions + access tokens: session lifetime is 30 days; revoked on sign-out or account delete.
• Server logs: 30 days, then rotated out.
• Backups: rolling 30-day window. Account deletion includes a backup-purge step at the next backup rotation (≤30 days).

We use the following infrastructure providers. Each only sees the data needed to do its job.

• Postgres database — self-hosted on a Tailscale private network. Your data lives here.
• Cloudflare R2 (when configured) — image storage. Owned content (Scryfall licensed art, your uploads) stays in r2://owned/; scraped sources stay in r2://cached/ and are never publicly served.
• Expo push service — relays push notifications to iOS / Android. Sees the push token + the notification body.
• Dokploy + the deploy host (GCP) — runs the containers.
• Better-Auth — open-source library, runs in our process. No external SaaS auth provider.
• Cloudflare Turnstile — bot challenge on the /contact form. Cloudflare sees the challenge token and the submitting IP (Cloudflare already fronts rarix.app, so this is not new exposure). Turnstile is privacy-preserving by design — no third-party tracking cookies, no cross-site behavioral fingerprint shared with us. See Cloudflare’s privacy policy.

We never sell your data, never share it with advertisers, never use it to train a third party’s model. If that ever changes — it won’t, but if — this page changes first and you get an email.

Some surfaces on Rarix carry “Buy this card”, “Complete this set”, “Buy this figure”, or “Sleeves & supplies” buttons that route to third-party retailers (eBay, TCGplayer, Amazon, CoolStuffInc). When you buy something through one of those links, the retailer pays Rarix a small commission at no additional cost to you. Affiliate commissions help fund the free-forever data tracker.

• We disclose every affiliate link.Each CTA carries a visible “Affiliate link — Rarix earns a small commission” disclosure next to the button (UWG-compliant German phrasing on de-* locales). The disclosure is not aria-only; it is rendered visible at default font scaling. FTC 16 CFR Part 255 / EU UCPD / German UWG §5a Abs. 4.
• Server-side redirect. Affiliate URLs are Rarix-hosted (/api/r/{partner}/{kind}/{id}); tapping one bounces through our server and 302-redirects to the partner with our affiliate tag attached. We set no third-party cookies on rarix.app. The partner sets their own cookie on their own domain after the redirect — that is the partner’s tracking, not ours, and is how every standard affiliate program works.
• No client-side affiliate JS.No Amazon Affiliate widgets, no ShareASale pixels, no iframe-embedded partner product widgets. Those are tracking tools and they poison the “no third-party tracking” posture we describe above. None of them ship on Rarix.
• We log clicks server-sidefor analytics + revenue attribution — see “Purchase History” in “What we collect” above for the exact fields.
• You can disable affiliate-click logging in your account settings (users.allow_affiliate_click_logging) — that toggle is shipping soon. While the toggle isn’t live yet, all affiliate clicks are first-party logged and never shared with anyone besides the partner network credited for the click.
• Affiliate availability is gated for kid-safety. Supervised profiles (under-13 accounts created by a guardian under our Family feature) never see affiliate CTAs. When a guardian inspects a supervised profile from the family dashboard, the guardian’s view of the child’s collection also hides CTAs. Defense in depth: the server-side redirect endpoint 404s for supervised-impersonation context, so a manually constructed URL doesn’t bypass the UI hide.

Current partner allowlist: eBay (primary), TCGplayer (contingent on partner reinstatement), Amazon (supplies + figures only — never cards, per Amazon Associates ToS), CoolStuffInc. Star City Games is reserved pending partner-side application acceptance. We do not currently run affiliate programs with Pop Mart, PSA, BGS, CGC, Mercari, or Pokellector.

The /contact form is how anyone — signed-in or not — gets in touch with us. It covers general questions, bug reports, partner inquiries, abuse reports, and product feedback. Submitting it sends one row to a private inbox table that only the operator can read. We do not email-blast you back, sign you up for anything, or share what you wrote.

What the form stores, per submission:

• Kind (contact / bug / partner / abuse / feedback / other) and an optional subject.
• Message body. Required. Whatever you write. Limited to 5,000 characters.
• Your email. Required so we can write back. Used only to reply to your submission. Not added to any list.
• Your name. Optional. Display name for the reply if you give one.
• A hashed IP.We don’t store your raw IP address. We store sha256(server-secret + your IP) — a 64-character hex string — so we can rate-limit submissions (5 / 15min) and cluster repeat abuse without holding the raw address. The server-secret rotates on a quarterly cadence, after which old hashes can’t be correlated to current submissions even by us.
• Your browser’s User-Agent string.Used for triage (“is this a real browser or a botnet”) and reproducing bug reports. After 90 days we truncate it down to <browser>/<major version> so the fingerprint surface shrinks.
• The page you submitted from (Referer header, allowlist-checked — off-rarix referrers are flagged but not stored verbatim).
• Bot-protection signals. Whether the hidden honeypot field was filled (a clear bot tell), whether a Cloudflare Turnstile token was attached, and the verification outcome (pass / fail / skip). These let us mark obvious spam without blocking borderline legitimate submissions.
• Per-kind extras — small JSON blob (max 4 KB): bug reports may include a URL and browser; partner inquiries may include company / role / team-size; abuse reports may include the target URL or handle. Schema-on-read; only the fields the form actually sends are stored.

Legal basis (GDPR Art. 6). Operating a feedback channel and acting on what you tell us is legitimate interest (Art. 6(1)(f)). Storing the hashed IP, honeypot signal, Turnstile outcome, and User-Agent for the purpose of combating spam, abuse, and automated harassment is also legitimate interest (Art. 6(1)(f), recital 47 — preventing fraud is an explicit legitimate-interest example). If your submission is itself an exercise of a GDPR right (deletion, export, correction), we additionally process it under Art. 6(1)(c) (legal obligation).

How long we keep submissions.

• Marked as spam (honeypot or Turnstile failed): up to 30 days, then auto-deleted. Kept short-term only to surface botnet patterns; not used for anything else.
• New / read / unresponded: up to 1 year. If we haven’t replied in a year, the submission is auto-deleted (you can always send another one).
• Responded or archived: up to 2 years from the response date. Kept so we can pick up where we left off if you follow up on the same thread.
• Bot-protection columns(ip_hash, user_agent, honeypot, turnstile_outcome) follow the row’s TTL. The salt for the IP hash rotates quarterly, severing cross-quarter correlation by design.

Your rights apply here too. You can email privacy@rarix.app and ask us to (a) send you a copy of every submission tied to your email, (b) delete every submission tied to your email, or (c) correct anything you got wrong. We handle these within 30 days. If you submitted while signed-in, your submissions are also included in your account deletion when you delete your Rarix account from Settings.

Bot protection — what fires and what it sees. The form runs three layers before storing your submission: an invisible honeypot field humans never see, an IP-bucketed rate limit (5 submissions per 15 minutes per hashed IP), and Cloudflare Turnstile, a privacy-preserving bot challenge run in your browser. Turnstile is a third-party service — see the sub-processors section above for what Cloudflare sees. We do not use Google reCAPTCHA. We do not load any third-party tracking script as part of the form.

What submissions don’t do. Submitting /contactdoes not create an account, does not opt you in to marketing emails (we don’t send any), does not share your submission with any third party, and does not feed any analytics product. The only side effect is one row in a private operator inbox.

Under GDPR (if you’re in the EU/UK) and CCPA (if you’re in California), and as a default for everyone else:

• Access: see what we have. The whole vault is visible in-app — but if you want a JSON dump, email privacy@rarix.app and we’ll send one within 30 days.
• Deletion (GDPR Art. 17 right to erasure): in-app, instantly, in two taps. Settings → Danger zone → Delete account. Same on web at /app/you. Deletion cascades to your supervised profiles, parent settings, blocked-users list, binders, owned items, scan history, and any Event Links you created. Reports you filed against other users are retained for our safety audit log, but your identity as the reporter is wiped (we set the reporter to NULL).
• Correction: edit your handle, display name, bio, and showcase visibility in Settings.
• Export: portfolio CSV export is available in-app under Portfolio. Full account export — including any supervised profiles under your account — is on the roadmap as a one-click in-app action. Until that ships, email privacy@rarix.app and we’ll send you a JSON dump within 30 days.
• Withdraw consent: turn off push, make your showcase private, or delete the account. All instant.
• Complain:if you’re in the EU, you can lodge a complaint with your local data protection authority. We’d rather hear from you first so we can fix whatever’s wrong.

Rarix accounts are for collectors aged 13 and up. We do not knowingly collect personal information from children under 13 through direct signups. Our signup form asks for year and month of birth and blocks anyone whose age is under 13 from creating a primary account.

If a parent or guardian wants their under-13 child to use Rarix, the parent creates their own primary account (they must be 13 or older themselves) and adds the child as a supervised profile under it. See the next section for how supervised profiles work and what the parent controls.

Platform availability. Family supervision (adding and managing supervised profiles, trade approval thresholds, kid-safety toggles) is currently available on the Rarix mobile app (iOS / Android). Web parity for Family setup is shipping in a follow-up release. Until then, Family setup must happen on mobile — the parent installs the app, signs in with their primary account, and adds the child via You → Family → Add child.

If you believe a child under 13 has somehow created a primary account, email privacy@rarix.appand we’ll move them to a supervised profile under a parent or delete the account, your choice. Same response if a kid signed themselves up by lying about their birth year.

Rarix is published in the App Store under the Lifestyle category, not the Kids category. We don’t market to children, and we don’t collect data designed for child-targeted features.

EU users (GDPR-K).Some EU member states set the minimum digital-consent age higher than 13 (commonly 14–16). Rarix does not currently offer service in the EU — when EU service is available we’ll publish per-country age gating before we accept signups from those countries.

A supervised profile is a sub-account that lives under a parent or guardian’s primary account. It’s how Rarix lets younger collectors (kids, younger siblings, the family card-trading crew) use the app without holding their own credentials.

Mobile-only for now.Creating and managing supervised profiles is currently available on the Rarix mobile app (iOS / Android) only. Web parity is shipping in a follow-up release. Once the parent has set up Family on mobile, the supervised profile’s data is visible to the parent everywhere — the limitation is on setup & admin, not on read access.

The parent is the legal account holder.Under privacy law, we treat all data collected through a supervised profile as the parent’s data. The parent can:

• Create, rename, and delete supervised profiles at any time.
• See everything the supervised profile collects — binders, scans, trade history, wishlist, blocked-users list, the lot.
• Edit or delete any of the supervised profile’s data directly.
• Set a trade approval threshold (default $50). Any trade proposed by the supervised profile above this dollar value waits for parent approval before it goes out. Set it to $0 to approve every trade. Set it higher if you trust the kid.
• Set a value-delta threshold on incoming trades — anything the math flags as more lopsided than the limit you choose needs your approval too.
• Decide whether the supervised profile can create public Event Links and showcase pages.

Supervised profiles cannot sign in directly. There’s no email + password for the child to type in, no password reset, no OAuth path. All access is mediated through the parent’s session. This is enforced at the authentication layer, not just the UI.

Trades + sharing follow the parent’s settings. Locked binders (favorites a kid never wants to trade away) are excluded from trade suggestions at the data-model level. Reports and blocks work for supervised profiles exactly like primary accounts.

When the parent deletes their account, supervised profiles and everything they’ve collected are deleted with the parent. No orphan data. When you request a data export (see Your rightsabove), supervised profile data is included in the export because it is legally your data — we’re working on an in-app one-click export; for now, email privacy@rarix.app and we’ll fulfill it manually within 30 days.

Safety — block + report. Any user (primary or supervised) can block or report another user from the in-app report flow. Reports tagged minor_safety get reviewed within 24 hours. The in-app report button is the primary channel; you can also email safety@rarix.app for anything urgent that can’t wait for the in-app flow.

HTTPS everywhere. Passwords hashed via bcrypt. Postgres on a private Tailscale network — not publicly addressable. Row-level security enforces ownership at the SQL layer (you can only ever read/write your own rows, even if the API has a bug). B2B API keys are sha256-hashed at rest, never stored in plaintext.

We’re a small team. If a breach happens, we’ll email affected users within 72 hours and post a public incident report.

If we change this policy materially (new sub-processor, new data class, new purpose), we’ll email everyone with an account and bump the date below. Version history lives in our public repo.

privacy@rarix.app for privacy, GDPR, and CCPA requests, account-export requests, and anything else about how we handle your data. We answer within 5 business days, usually same day.

safety@rarix.appfor child-safety concerns, harassment, or urgent abuse reports that can’t wait for the in-app report flow. Routes to the operator inbox. Reports tagged minor_safety are reviewed within 24 hours.