Privacy Policy

The short version

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral (targeted) advertising, and we do not show ads.
• We do not track you across other companies' apps or websites.
• Your purchase costs, notes, holding photos, chases and wishlist are private by default.
• You can delete your account and data at any time from Profile.

1. Information you give us

You can browse card prices and public profiles without an account. To create an account and save a collection, we collect the following.

• Account details: your email address, name and sign-in method (Apple, Google or email), supplied through our sign-in provider, Clerk. If you use Sign in with Apple, you may share an Apple private relay email address instead of your real one.
• Age range: when you sign up, or the first time you sign in with Apple or Google, you tell us whether you are 13–17 or 18 or older. We store only that age range and when you answered. We never ask for your date of birth. Each time you create a marketplace listing, you also confirm you are at least 18, and we record that confirmation.
• Profile: your handle, display name, bio, avatar, header photo and display preferences (for example, whether your collection value is public).
• Collection data: the cards you save, grades and certification numbers, purchase cost, purchase date, private notes, chases, wishlist, and any photos you attach to a holding.
• Marketplace listings: listing text, photos, price, and the contact method you choose to display so buyers can reach you off-platform.
• Research questions: questions you type into Research, Rareform's card and set assistant, are sent together with the earlier messages in that conversation to OpenAI (through Replit AI Integrations) to generate the answer. OpenAI may use web search to answer and processes your questions under its own API data policies. Rareform does not store your Research questions or answers on our servers; we keep only a daily count of how many questions you have asked, to apply usage limits. On the website, your Research conversation is kept in your browser's session storage for that tab and is cleared when you close it.
• Support and safety: support requests, reports you file, and users you block.
• Copyright notices: if you send a copyright (DMCA) notice or counter-notice, the details you provide. See section 10.

2. Information collected automatically

• Server logs: when you use Rareform, our servers record standard technical information such as your IP address, request timestamps, the type of request and page requested, device or browser type, app version and error diagnostics. We use it for security, rate limiting, abuse prevention and fixing bugs. Our request logs do not record the text of your Research questions.
• Bot protection: the sign-up form runs Cloudflare Turnstile, a bot-protection check provided through Clerk. Turnstile processes technical signals from your browser or device, such as IP address and browser characteristics, to decide whether a person is making the request.
• Site analytics: our hosting provider, Replit, provides basic page-view statistics for the website. When a page loads, Replit's analytics script receives the page address, the referring page, your screen size, browser language, approximate device type and, as with any web request, your IP address. We use these statistics only to understand overall traffic. They are not used for advertising, and Rareform does not use session replay, keystroke logging or advertising SDKs.
• Fonts: the website serves its fonts from Rareform's own servers. It does not load fonts from Google Fonts or other third-party font services.
• Card images and scanning files: card pictures load directly from PokéTrace's image servers, and the on-device text reader on the website's scan pages downloads its files from jsDelivr, a public file server. Like any web request, these servers receive your IP address and standard browser information.

3. Cookies and similar technologies

We use only what is needed to run Rareform. We do not use advertising or cross-site tracking cookies.

• Sign-in cookies: Clerk, our sign-in provider, sets essential cookies to keep you signed in and to protect your session. Signed-in features don't work without them.
• Local and session storage: the website stores a few small settings in your browser, such as display preferences, your age-range answer while you finish signing up, a short note that pauses sign-up for 24 hours if you choose "under 13", and your Research conversation for the current tab.

4. Camera, photos and AI card identification

• Camera and photo library: with your permission, Rareform uses your camera or photo library to scan cards and graded slabs. Photos stay on your device unless you choose to identify a card with AI, or attach a photo to a holding or listing. You can turn off camera access in your browser or device settings at any time; scanning stops working, but the rest of Rareform keeps working.
• Analyze with AI: when you choose this, a resized copy of the photo is sent through Replit AI Integrations to OpenAI, which suggests the card's name, set, number and version. Scan images are processed transiently and are not stored by Rareform unless you separately attach a photo when saving. Please don't include personal information in scan photos.
• Bulk scan: page photos you upload for a bulk scan are kept privately while the scan is processed and are deleted once you save the results, or after 7 days.
• Read text on device: this option processes the photo on your device and sends only the detected or edited text to our servers to match it to our catalog.
• PSA certification lookups: if a PSA label is visible, the scanner may read the certification number and look it up in PSA's public certificate registry. It uses PSA's official API when available, and otherwise Firecrawl, a web-scraping service that fetches the public certificate page. Only the certification number is sent. The public record is shown for your review. It does not authenticate the slab.
• Slab background removal: when you attach a photo of a graded slab to a holding, a copy may be sent to fal.ai to remove the background so the slab displays cleanly. The cleaned image replaces the display copy of your photo and stays private to you unless you list the card.
• About AI estimates: card identifications and values produced with AI are estimates built from public market data and the card details you enter. They are labelled as estimates. They do not authenticate a card, assess its condition or certify a grade, and they are not financial advice.

5. Rareform in ChatGPT

Rareform offers an optional app inside ChatGPT, which is operated by OpenAI. It prices cards and suggests negotiation numbers.

• What we receive: ChatGPT sends Rareform only the details its tools need: card name, set, number, language, finish, condition or grade, a PSA certification number if you provide one, and any asking price, bundle or trade you ask about. Rareform does not receive your ChatGPT conversation. Photos you share in ChatGPT are processed by OpenAI under OpenAI's own policies, and Rareform receives only the card details read from them.
• Without an account: pricing and negotiation tools work without a Rareform account. Those requests are processed to answer your question and are not linked to you. We keep only standard server logs, such as IP address and timestamp, for security and rate limiting.
• Linking your account (optional): if you link your Rareform account, you sign in on Rareform's own page and approve specific permissions: searching your collection and wishlist, saving cards, and logging deals. ChatGPT then receives an access token that lets it use only those tools for your account. It never receives your password. Rareform's responses, such as the matching cards from your collection, go back to ChatGPT and are handled by OpenAI under its privacy policy. Deals you log are private notes stored in your account. Rareform never processes purchases or payments through ChatGPT.
• Disconnecting: you can disconnect at any time from the Support page while signed in, or by removing the app in ChatGPT's settings. Disconnecting revokes every access token immediately. Deleting your account also deletes linked tokens and logged deals.

6. How we use information

• To provide Rareform: signing you in, storing your collection, identifying cards, answering Research questions, estimating values and showing market data.
• To run community features you choose to use: the marketplace and public profiles, including moderating listings and profiles.
• To support you and enforce our rules: responding to support requests, enforcing our Terms of Service, and handling reports, blocks and copyright notices.
• To keep Rareform safe and working: security, preventing abuse and fraud, rate limiting and diagnosing problems.
• To meet legal obligations: for example, responding to valid legal requests and keeping records of copyright notices.
• Email: we use your email address to sign you in, send verification codes and reply to you. Sign-in and verification emails are sent by Clerk. Rareform does not send marketing or newsletter emails.

7. What is public and what is private

• Private by default: purchase costs, purchase dates, private notes, holding photos, manual records, the cards in your chases, and your wishlist. Only you can see these.
• Public: your handle, display name, bio, avatar, header photo, your pinned showcase cards (without any purchase details), the number of chases you are running, and, only if you turn them on in Profile, your card count and collection value. Profile changes publish immediately and are not reviewed first. Profiles that are reported may be removed.
• Marketplace listings: listings, including their photos and the contact method you provide, become public after moderator approval. Approved listings and their contact details can be seen by anyone, including people without an account, so buyers can reach you. Don't share anything you aren't comfortable making public.

8. Service providers

We share information with the service providers below only as needed to run Rareform. Each provider processes data under its own privacy policy.

• Clerk: account creation, sign-in, sign-in and verification emails, and session management. Receives your email, name, sign-in method, session and device information, and IP address.
• Cloudflare (Turnstile), through Clerk: bot protection on the sign-up form. Receives technical browser or device signals such as IP address, not your collection data.
• Replit: hosts our application, database and file storage; runs the AI Integrations connection used for scanning, Research and value research; and provides the website's page-view analytics. Receives the data stored in and sent through Rareform, and the analytics data described in section 2.
• Google Cloud Storage: the storage behind Replit's file storage, where your photos are kept. Receives your stored photos.
• OpenAI (through Replit AI Integrations): card identification from scan photos, answers to Research questions and other AI-assisted searches, and AI value research and explanations. Receives resized scan photos, the questions you type and their conversation context, and card details.
• OpenAI (ChatGPT): only if you use the Rareform app in ChatGPT. Sends card details and questions to Rareform and receives Rareform's answers, including collection results if you link your account.
• fal.ai: background removal for graded-slab photos you attach to a holding. Receives the slab photo.
• PSA (Professional Sports Authenticator): official certificate lookups. Receives the certification number only.
• Firecrawl: fallback public PSA certificate lookups and web price research. Receives the certification number, or card name, set, number, finish, language and grade. Never your personal information.
• PokéTrace, TCGdex and Pokemon Price Tracker: catalog, image and market price data. Our requests contain card identifiers only, never your personal information. Card images load directly from PokéTrace's servers, which receive your IP address.
• jsDelivr: a public file server that delivers the on-device text reader used on the website's scan pages. Receives your IP address and standard browser information.
• Apple and Google: only if you choose Sign in with Apple or Google. They share your name and email (or Apple private relay address) with Clerk to create your account.

9. Other sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Apart from the service providers above, we share information only in these cases:

• Other users and the public: the profile and listing information described in section 7.
• Copyright notices: as described in section 10.
• Legal and safety reasons: when we believe in good faith that the law, a court order or a valid legal request requires it, or that it is needed to protect the rights, property or safety of Rareform, our users or others.
• Business transfers: if Rareform or Boyd Intel is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that deal. It would stay subject to this policy, or we would notify you of any change.
• At your direction: for example, when you link your account to ChatGPT.

10. Copyright (DMCA) notices

If you send a copyright notice or counter-notice through our public form at https://rareformtcg.com/copyright, or by email, we keep the details you provide to handle the claim and as a legal record. That includes your name, email, phone number (optional), mailing address, the work and material identified, your statements and your typed signature.

As the law requires, a counter-notice, including your name and contact details, is forwarded to the person who sent the original notice. We may share a notice with the user whose material was removed. Copyright strikes and any suspension are recorded on the affected account.

11. How long we keep information

• Account data is kept for as long as your account exists.
• When you delete your account, we delete your profile, collection, chases, wishlist, listings, logged deals, ChatGPT connections, blocks, stored photos, Research usage count and your sign-in record with Clerk. This can't be undone. If photo uploads were recently started, deletion may be held until those upload links expire, and Rareform tells you when to try again.
• Support requests and reports are kept after account deletion for safety and dispute handling. Your account identifier is removed from them, but the message text and any reported listing or profile identifiers remain.
• Copyright notices are kept as a legal record for as long as needed to handle the claim, resolve any related dispute and meet our legal obligations.
• Server logs containing IP addresses are kept only as long as needed for security and operations.
• Bulk-scan page photos are deleted once you save the results, or after 7 days.
• Service providers may keep backups or logs for a limited time under their own retention policies.

12. Your choices

• Review and edit your profile, privacy toggles and collection at any time.
• Turn off the public card count and collection value in Profile.
• Turn off camera or photo access in your browser or device settings.
• Disconnect ChatGPT from the Support page or in ChatGPT's settings.
• Delete your account from Profile.
• Email brandon@boydintel.com to request a copy of your data or its deletion.

13. Your California privacy rights

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together the "CCPA"), gives you the rights described in this section and the next. We honor these requests for all users, wherever they live.

In the last 12 months we have collected these categories of personal information:

• Identifiers: name, email address, handle, account ID, IP address.
• Customer records: the contact method you put on a listing; mailing address and phone number if you send a copyright notice.
• Characteristics: age range (13–17 or 18+) only.
• Commercial information: the cards you own or want, purchase cost and date, listings, logged deals.
• Internet or network activity: server logs, page-view statistics, device and browser type, app version, error diagnostics, bot-protection signals.
• Audio, electronic or visual information: photos you scan, attach or upload.
• Sensitive personal information: account sign-in credentials, handled by Clerk. We use these only to sign you in and keep your account secure, which the CCPA permits without offering a right to limit.

14. How to use your California rights

We collect this information from you, from your device, and from Apple or Google if you use their sign-in. We use it for the purposes in section 6, disclose it to the recipients in sections 8 and 9, and keep it for the periods in section 11. We do not collect precise geolocation, and we do not use personal information to infer characteristics about you.

• Right to know and access: ask what personal information we have collected about you, the sources, why we collected it, who we disclosed it to, and get a copy in a portable format.
• Right to delete: ask us to delete your personal information, subject to legal exceptions (for example, keeping copyright records or safety reports). You can also delete your account yourself from Profile.
• Right to correct: ask us to correct inaccurate information. Most of it you can edit directly in Rareform.
• Right to opt out of sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
• Right to limit use of sensitive personal information: we use sensitive personal information only for permitted purposes, so this right doesn't apply.
• Right to non-discrimination: we will not deny you the service, charge you differently or give you a lower quality of service for using your rights.
• How to make a request: email brandon@boydintel.com from the email address on your account, with the subject "Privacy request" and the right you want to use. To protect your account, we confirm your identity by matching the request to your account email, and we may ask for more information if needed. You can use an authorized agent; we will ask for proof of the agent's permission and may ask you to confirm your identity directly. We aim to respond within 45 days, and we will tell you if we need more time, as the law allows. If we decline your request, you can reply to ask us to reconsider it.
• Shine the Light: we do not disclose personal information to third parties for their own direct-marketing purposes.

15. Do Not Track and Global Privacy Control

Rareform does not track you across other companies' websites or apps, and we do not sell or share personal information. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information for that browser. Because we do not sell or share personal information, our data practices are the same with or without the signal. Our website, including Replit's page-view analytics, does not currently respond differently to Do Not Track signals.

16. Children's privacy

Rareform is for people 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

• Sign-up asks for your age range (under 13, 13–17, or 18 or older) instead of your date of birth.
• If you choose under 13 on the sign-up form, no account is created.
• If you sign in with Apple or Google and then choose under 13, the account is locked immediately and deleted, including the sign-in record Clerk created, and no age information is kept.
• Marketplace listings publish contact details, so only people who confirm they are 18 or older can create one. Accounts that said they are 13–17 cannot post listings.
• Parents and guardians: if you believe a child under 13 has created an account or given us personal information, email brandon@boydintel.com and we will delete it.

17. Data security

All traffic between Rareform and our servers is encrypted in transit. Holding photos are served only to their signed-in owner. Profile photos and approved listing photos are public by design. Sessions are managed by Clerk, and access to production systems is limited to the operator. Access tokens for the ChatGPT connection are stored only in hashed form, and the key used to sign them is stored encrypted. Your stored data is held by our hosting providers, Replit and Google Cloud, under their security practices.

No method of storage or transmission is perfectly secure. Use a strong, unique password or Sign in with Apple or Google, and contact us right away if you think your account has been compromised. If a security breach affects your personal information, we will notify you as required by law.

18. Users outside the United States

Rareform is operated from the United States, and our service providers store and process information in the United States and possibly in other countries where they operate. If you use Rareform from outside the US, your information will be transferred to, stored and processed in the US, where data protection laws may differ from those where you live.

19. Users in the EEA, UK and Switzerland

Boyd Intel (Brandon Boyd) is the controller of your personal information. We process it to provide Rareform to you, for our legitimate interests in security, abuse prevention, reliability and moderating public content, to comply with legal obligations, and with your consent where we ask for it (for example, camera access and linking ChatGPT), which you can withdraw at any time. You can ask to access, correct, delete or export your information, or restrict or object to certain processing, by emailing brandon@boydintel.com, and you can complain to your local data protection authority. Your information is transferred to the United States as described in section 18.

20. Changes to this policy

We may update this policy as Rareform changes, for example when the iPhone app launches or we add a new service provider. We will update the effective date at the top. If we make material changes, we will tell you in Rareform, or by email if the change significantly affects how we use information we already have. If you keep using Rareform after a change takes effect, the updated policy applies to you.

21. Contact us

Questions, requests or concerns about privacy: Boyd Intel, operator of Rareform, Attn: Brandon Boyd, owner and developer. Riverside, California, USA. Email: brandon@boydintel.com. Websites: https://rareformtcg.com and https://boydintel.com.

Signed-in users can also send a private support request from the Support page, and replies appear in Rareform.