Privacy Policy

• Account information. Your email address and password (stored hashed, never in plain text). If you sign in with Apple or Google, we receive the email address and display name that provider releases to us — with Sign in with Apple, that may be a private relay address.
• Profile information. An optional username and profile picture you choose to upload.
• User content. The data you enter about your collection and watchlist — cards, quantities, conditions, purchase and sale prices, dates, and notes.
• Purchase information. If you buy Ripdex Pro, our payments provider records your subscription status, plan, purchase and renewal history, store receipt or transaction identifiers, platform, and country. We never receive or store your payment card details — Apple and Google handle payment.
• Device & usage data. App usage events, crash reports and diagnostic logs, performance traces, device model, operating system and app version, language, approximate region, and IP address.
• Device identifier. A random identifier generated on your device and kept in secure storage. It lets us apply scan limits fairly and keep a purchase attached to its device before you sign in. It is not your advertising ID, and we do not use the advertising identifier at all.
• Push notification token. If you enable notifications, so we can send price alerts and the updates you subscribed to.
• Support messages. Anything you send us through the in-app contact form or by email, including the message and your email address.

The scanner is the only feature that uses your camera, and it runs only while the scanner screen is open. How that data is handled:

• Camera frames are processed entirely on your device. Card recognition compares a compact numeric fingerprint of the frame against a card index downloaded to your device.
• We do not upload, store, or retain camera frames or photos of your cards. Nothing the camera sees leaves your device.
• We record a count of how many scans you have performed, tied to your device identifier and account, to enforce the free-tier scan allowance. We do not record what you scanned as part of that count.
• Photo library access is requested only if you choose to set a profile picture, and only the image you pick is uploaded.

• Provide and operate Ripdex features and services.
• Sync and back up your collection data across your devices.
• Process and restore purchases, and determine whether Ripdex Pro is active on your account.
• Diagnose crashes, monitor performance, and improve the app.
• Send the notifications and emails you asked for, such as price alerts and portfolio summaries, and important updates to our Terms or this Policy.
• Apply usage limits, and detect, prevent, and address fraud, abuse, or misuse.
• Respond to your support requests.

We do not use your information for advertising, and we do not sell or share it for cross-context behavioral advertising.

We use a small number of service providers to run Ripdex. Each receives only what it needs, and each processes data under its own privacy policy:

• Supabase. Hosting, authentication, database, and file storage for your account and collection data.
• Google Firebase. Analytics (app usage), Crashlytics (crash reports), Performance Monitoring, and Cloud Messaging (push notifications). Firebase receives usage events, diagnostic data, device and app details, an app instance identifier, and your notification token.
• RevenueCat. Subscription and purchase management. It receives an app user identifier, your device identifier, store receipt and transaction data, platform, and country, and tells the app whether Ripdex Pro is active.
• Apple and Google. Payment processing for all purchases, and Sign in with Apple / Google sign-in if you use them.
• Resend. Delivery of transactional email such as support replies, alerts, and account emails.
• Cloudflare and Vercel. Image delivery and hosting for this website. This website also uses Google Analytics; the app does not.
• Catalog and pricing sources. TCGplayer, CardMarket, PSA, and similar providers, from which we retrieve card data and prices. We do not send them your personal data or tell them what you own.
• eBay and the eBay Partner Network. Ripdex links to eBay listings, and some of those links are affiliate links. We do not send eBay your account details or your collection. When you tap such a link, eBay receives the information any website receives from a visit, including your IP address and device information, and may set its own cookies or identifiers to attribute a purchase. We receive only aggregate commission reporting, which does not identify you. eBay’s privacy policy governs what happens once you leave Ripdex.

We do not sell your personal data.

If you create a share link for your profile, a collection, or a watchlist, the information in that view becomes accessible to anyone who has the link, without signing in. Private fields such as purchase prices and notes are excluded from shared views. You can revoke a share link at any time in the app, which immediately breaks the old link.

We keep your account and collection data for as long as your account exists. When you delete your account, your account record, collection, watchlist, profile picture, and share links are deleted from our systems. Crash and analytics data held by Firebase, and purchase records held by RevenueCat, Apple, or Google, follow those providers’ own retention schedules; the stores may retain purchase and tax records where the law requires it. Backups rotate on a short cycle and are overwritten in the normal course.

You may delete your account and all saved data at any time by going to Settings › Delete Account in the app. Deleting your account does not cancel a paid subscription — cancel that through your Apple or Google account, as described in our Terms of Service.

Ripdex uses Firebase Analytics and Crashlytics to understand how the app is used and to find crashes. This is limited to usage and diagnostic data linked to your account or app instance — we do not track you across other companies’ apps or websites, we do not use the advertising identifier, and we show no ads. The exception is that tapping an affiliate link hands you off to eBay, which does its own tracking under its own policy.

Ripdex does not knowingly collect data from children under 13. If you believe your child has provided personal information, please contact us immediately and we will delete it.

Depending on your location, you may have rights under the GDPR, UK GDPR, CCPA/CPRA, or similar laws, including the right to access, correct, delete, export, or restrict the use of your data, and to object to certain processing. Most of these you can exercise directly in the app; for anything else, contact us at support@ripdex.app and we will respond within the time the applicable law allows. You will never be charged a different price or offered a lesser service for exercising these rights.

Ripdex is operated from the United States, and our providers store and process data in the United States and other countries. If you use Ripdex from outside the United States, your information is transferred there, and we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses, where required.

Data is encrypted in transit, access to your data is restricted by per-user database rules, and sensitive values on your device are kept in the platform keychain or keystore. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. Updates will be reflected by the “Last updated” date above. Your continued use of Ripdex after changes means you accept the revised Policy.

If you have any questions or concerns about this Privacy Policy, please contact us at support@ripdex.app.