Effective January 1, 2027. Applies to www.th3coll3ctiv3.com, the Rarivelle iOS and Android apps, and related services operated by Rarivelle LLC (“we,” “us”). This draft describes processing that happens today, and separately marks features that aren’t launched.
1. Contact and scope
Privacy questions: cardcafeadmin@gmail.com; postal address: 5171 Cobalt Falls Bnd, Aiken, SC 29801. This policy covers the website, the apps, the grading and valuation tools, accounts, collector profiles, the Concierge, creator programs and subscriptions. Other services we link to have their own policies.
2. Information we collect
Without an account. Your Vault, Grading Lab, planner and trade drafts stay in your browser (section 3). When you use a server feature we receive what that feature needs: a photo you choose to analyse (section 4), card details for a price or certification lookup (section 5), a message you send as feedback, and requests our host logs (including IP address).
Free accounts. Your email address, a one-way hash of your password, a hash of your recovery code, a random account ID and sign-in session records. You can instead save with a recovery code only, with no email. Nothing about you is collected from other sources to build a profile.
What you save to your account. Your cloud-saved Vault (cards, what you paid, values and where they came from, notes, binders, wanted list, set sizes and tracked sets, sales you record, history and settings), saved grading analyses, saved trades, submission plans, tracked grading submissions, watchlist and price alerts, alerts inbox and alert settings, and (Pro) daily portfolio totals.
Paid plans. From Stripe for web subscriptions: your email, customer ID, subscription status, plan, renewal date and receipts; never your full card number. From Apple or Google for app subscriptions: the transaction or purchase identifiers, product, status and renewal or expiry dates needed to confirm your plan; we don’t receive your store account password or payment card.
Creators. Applications, the agreement acceptance record, Stripe Connect payout account identifiers and payout records, referral codes and commission records.
Records of what you agreed to. Which version of a document you accepted, its fingerprint and when.
3. Data kept in your browser
The Vault, Grading Lab, Submission Planner and Trade Analyzer keep your records in your browser’s storage. Card photos you save with Vault cards are kept in your browser too, until they’re backed up to your account. They reach our servers only if you turn on cloud save, save an item to your account, or use a feature that sends data (described below). Without cloud save, clearing site data or losing a device can erase them, so download backups.
Browser storage also keeps small settings, listed in the table in section 10.
4. Photos and AI processing
Rarivelle uses Anthropic, which provides the Claude AI models, for these features. Each one runs only when you start it:
Card scan (one card or a binder page): your photo and an instruction to read the printed text. AI condition check: the photo of the side you choose. Slab scan: a photo of a graded slab’s label. Concierge: your question, up to the last six messages of the chat in your browser tab, and the data the answer needs from your account: card names, game, set, number, variant, grade or condition, quantity, binder, what you paid, values with their basis and date, portfolio totals, tracked sets and their progress, and summaries of your grading submissions. The Concierge may also look up a market price, which sends card details to a price provider (section 5).
Centering measurement in Grade Check runs on your device; that photo isn’t sent anywhere.
What Rarivelle keeps. Photos sent for scanning or checking aren’t stored; they’re discarded after processing. The exception is a card photo you choose to save with a Vault card (below). We don’t store Concierge questions or answers; the chat stays in your browser tab. We keep limited records: for AI checks, the side, estimated grade range and confidence; for slab scans, the grading company, grade and whether the cert was found and priced; for card scans, a daily count of scans used (keyed to your account, or to your IP address if you’re signed out, and reset each day) and an event noting a scan ran; for the Concierge, a cost log with the plan, model, token counts, cost and the names of the tools used, with no question or answer text. These are kept for [Scan Metadata Retention].
Card photos you save to your Vault. If you choose “Save my photo with this card” or add a photo to a card, we keep that photo on this device. If you have an account, we also store it in your account so it appears on your other devices. Stored photos have location and camera data removed, are visible only to you (not on share links or public profiles), and are deleted from our servers when you delete your account, or after you remove the photo or the card: the next time your Vault syncs once 24 hours have passed (the delay keeps Undo and your other devices working). Photos you only scan, without saving, are still discarded after processing. We keep the whole photo you took as well as the cropped card, so you can change the crop later.
What Anthropic keeps. Anthropic processes these requests as our service provider under its commercial terms. Anthropic states that, for API customers, it deletes inputs and outputs within 30 days of receipt or generation by default, unless a different arrangement is agreed, and may keep them longer where needed to enforce its usage policy (flagged content may be kept for up to 2 years) or where the law requires. [Statement on whether Anthropic trains on our API data — to confirm] “Not stored by Rarivelle” doesn’t mean “not retained by Anthropic”.
Don’t include unnecessary personal information in photos or questions.
5. Pricing and verification services
To look up prices and card details we send card-identifying fields (game, name, set, number, year, variant, grade) to the price or catalog provider for that game: PokemonPriceTracker, Scryfall and YGOPRODeck today, and the Pokémon TCG API for card identification and set checklists; PriceCharting or SportsCardsPro if connected later. This happens when you look up a price, when Premium checks your watchlist, when the Concierge looks one up, or when Set Completion loads a checklist. PSA certification lookups send a certificate number to PSA. We cache results (prices up to 24 hours, checklists up to 7 days, certifications up to 7 days). These providers handle requests under their own policies. A registry match isn’t physical authentication.
6. Collector profiles, follows, blocks and reports
Profiles are off unless you create one, and private unless you publish. A public profile shows your profile name, display name, bio, banner colour, up to 12 featured cards (name, game, set, number, year, variant, grade only), set milestones if you choose, card and set counts if you choose, whether you’re open to trades and your trade note, your follower count, and the month you joined. Never what you paid, cert numbers, notes or your email. Profiles are text only: no photos or links.
We store who follows whom, who has blocked whom, and reports: the profile reported, the reporter’s account, the reason and details, and how it was resolved. Administrators can see reports and profile text in order to moderate, and can hide a profile. Blocks and reports aren’t shown to the person blocked or reported.
Public profile pages ask search engines not to index them; that’s a request to search engines, not access control. Anyone with the address can see a public profile, and copies others have saved can’t be recalled.
7. Exchange (not launched)
The Exchange isn’t open. No trade lists, matches or proposals are processed today. If it opens, it will store the cards you choose to offer (with your estimate, never what you paid, cert numbers or notes), your wanted list, matches, and proposals and counteroffers with any notes, visible to the other collector involved. Rarivelle won’t collect or pass on shipping addresses or payment details for trades. This section will be updated before launch.
8. Share links
Anyone with a link can open it and pass it on. Turning a link off stops it working from then on, but copies or screenshots someone already made can’t be recalled. Share pages ask search engines not to index them; that’s a request, not access control.
| What you share | What viewers see | Live or snapshot | How to stop |
|---|---|---|---|
| Whole Vault or one binder | Card name, game, set, number, year, variant, grade or condition, quantity; your estimated values only if you turn that on. Never what you paid, cert numbers or notes. | Live: it shows your current cloud-saved Vault each time it’s opened | Profile or Vault → stop sharing; deleting your account also ends it |
| A saved trade (Plus/Pro) | The trade’s cards, grades or condition, quantities, values used and where they came from, cash, and the result. Never your Vault IDs. | The trade as you last saved it; re-saving updates it | Turn the link off, delete the trade, or delete your account |
9. Notifications and alerts
Alerts (price alerts, new followers, trade updates, billing and account notices) are kept in your alerts inbox in your account; we keep the last 200, with your alert settings (categories, quiet hours and time zone, daily limit).
Phone notifications are optional and only in the apps. If you turn them on, we store your device’s push token, platform and notification categories, and send notifications through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android), which receive the token and the notification text. Turn them off in Profile → Alerts, in the app, or in your phone’s settings. Notification text may appear on your lock screen. We don’t send promotional notifications.
We don’t currently send email notifications or marketing email.
10. Cookies, local storage and analytics
We use two first-party cookies and no advertising or third-party analytics cookies, tags or pixels.
Usage events. To understand which tools are used, we record events with these fields: the event name (for example “trade_analyzed”), the page, where the visit came from (for example a creator code or a search engine name), the creator code from a referral cookie if present, and the time. They don’t include your account ID, email, IP address or device ID, and we don’t combine them with those. Separately, our host keeps request logs that include IP addresses, under its own retention ([Host Log Retention]). Outbound link clicks record the time, the site, the link’s position, search words and any creator code.
| Name | Type | Lifespan | Purpose |
|---|---|---|---|
| cc_ref | First-party cookie | 30 days | Credits a Creator Club referral |
| cc_acct | First-party cookie (HttpOnly) | Up to about 13 months (password sign-ins expire after 90 days) | Keeps you signed in to your account |
| cc.vault.v1, cc.vault.extra.v1 | Local storage | Until you clear it | Your Collection Vault, wanted list and history |
| cc.lab.v1, cc.plan.v1 | Local storage | Until you clear it | Your Grading Lab inputs and submission plans |
| cc.cat, cc.ai.ack, cc.aid | Local storage | Until you clear it | Your last card type; that you’ve read the AI notice, and a random ID that ties that acknowledgment to this browser |
| cc.photo.v1 | Session storage | Until the tab closes | A photo you picked on the home page, handed to Grade Check on this device |
| cc.src, cc.visit | Session storage | Until the tab closes | Where this visit came from, and whether it was already counted, for anonymous usage counts |
| cc.sync.v1 | Local storage | Until you clear it | Which synced version of your Vault this device has |
| cc.trade.v1, cc.concierge (session), cc.concierge.notice, cc.scan.history, cc.sync.v1 | Local or session storage | Until you clear it (the Concierge chat lasts until the tab closes) | Your current trade, Concierge chat in this tab, that you’ve read the Concierge notice, scan history, and cloud-save sync state |
| cc.applock | Local storage (apps only) | Until you clear it | Whether you turned on app lock |
| rarivelle-photos | Browser database (IndexedDB) | Until it’s backed up to your account, or you clear it | Card photos you saved with Vault cards on this device |
| cc.vault.view, cc.vault.fx | Local storage | Until you clear it | Your chosen Vault view, and whether card effects are on |
11. How we use information
To provide the features you ask for, keep your account and saved data, confirm and manage plans, attribute and pay creator referrals, moderate public profiles, provide support, prevent fraud and abuse, secure the service, understand product use from the usage events above, and meet legal obligations. We don’t sell personal information, and we don’t share it for cross-context behavioural advertising.
12. Who receives information
Service providers acting for us: Render (hosting and logs), Stripe (web payments and creator payouts through Stripe Connect), Anthropic (AI features in section 4), the price, catalog and verification providers in section 5, and Apple and Firebase Cloud Messaging for push notifications if you turn them on.
Parties acting independently: Apple and Google for app purchases they bill (they act under their own terms), marketplaces you choose to visit through our links, and other collectors who view what you choose to make public or share.
Others: advisers, authorities where the law requires, and a successor in a lawful business transaction. We don’t currently use an analytics provider or an email delivery provider.
13. Retention and security
Waitlist: [Waitlist Retention]. Creator applications and feedback: 12 months, then deleted automatically. Transaction and tax records: 5 years. Referral records: 5 years. AI-related records in section 4: [Scan Metadata Retention]. Moderation reports: 5 years. Host logs: [Host Log Retention]. Account data, including saved card photos: while your account exists (photos you remove are deleted as described in section 4), then as described in section 14. We use reasonable safeguards, including hashed passwords and recovery codes, but no system is perfectly secure.
14. Closing your account
You can delete your account in Profile → Your data. Deletion removes, immediately from our live systems: your account record and sign-in sessions, your cloud-saved Vault, its card photos, and everything saved to your account (analyses, trades, plans, submissions, watchlist and alerts), your share links and trade links, your public profile with your follows and blocks (and your account is removed from moderation reports), your Exchange list if any (open proposals are withdrawn), your alerts inbox and push tokens, and your links to app-store purchases. Your public pages stop working at once.
Subscriptions: deleting your account turns off renewal of a web subscription first; if we can’t reach Stripe to do that, nothing is deleted and we tell you. App Store and Google Play subscriptions must be cancelled with Apple or Google; we show you where. If you can’t reach billing, contact cardcafeadmin@gmail.com.
What may remain: records we must keep, such as transaction and tax records and creator commission and payout records (5 years); records of documents you accepted; moderation reports about a profile, with the account identifiers removed, for 5 years; usage events, which aren’t linked to your account; and copies in backups, which are overwritten within [How long backups are kept before being overwritten]. Stripe, Apple and Google keep their own records under their policies.
15. Your choices and rights
You can see and change most of your data in the product, download a Vault backup, and delete your account yourself. You can also ask cardcafeadmin@gmail.com for access, correction or deletion, or to exercise other rights the law gives you. We may need to verify your identity and may keep data where the law allows or requires.
Which US state privacy laws apply to Rarivelle depends on facts such as revenue and the number of residents of each state whose data we process; that assessment is pending ([Which state privacy laws apply — counsel assessment]).
16. Children
Rarivelle is intended for [Audience]. We don’t knowingly collect personal information from children under 13. If you believe a child has given us information, contact cardcafeadmin@gmail.com and we’ll delete it.
17. Changes and contact
We’ll post changes here with a new effective date and give notice of material changes where the law requires. Contact cardcafeadmin@gmail.com, 5171 Cobalt Falls Bnd, Aiken, SC 29801.