Privacy Policy

1. Who we are

RipVault (“RipVault,” “we,” “us”) operates the website and services available at ripvault.gg (the “Service”). For questions about this policy, contact privacy@ripvault.gg.

2. Information we collect

We collect only what we need to operate the Service.

2.1 Information you give us

• Account — email address, display name, password (stored as a hash we can’t read), date of birth, and state of residence.
• Shipping — name and postal address you save for Physical Delivery.
• Support correspondence — messages you send us.

2.2 Information from payment processing

Deposits are processed by Square, Inc. We receive from Square the payment identifier, amount, currency, and status of each transaction. We do not receive or store your full card number, expiration date, or CVV. Refer to Square’s privacy notice for their handling of that data.

2.3 Information collected automatically

• Usage — IP address, user-agent, referrer, pages viewed, timestamps, and action events (openings, sell-back, shipment requests).
• Device & cookies — session cookies required to keep you logged in; a small number of first-party cookies for preferences. We do not set advertising or cross-site tracking cookies.

2.4 Information we do NOT collect

• We do not collect Social Security Numbers.
• We do not collect biometrics.
• We do not knowingly collect information from anyone under 18.

3. How we use your information

• To create and secure your account.
• To process deposits and record Coin balances and transactions.
• To run Pack Openings, sell-back, and Physical Delivery.
• To detect and prevent fraud, abuse, or violations of the Terms.
• To provide support and respond to your requests.
• To comply with applicable law, respond to lawful requests, and enforce our agreements.
• To improve the Service, aggregated and de-identified where practical.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

4. When we share information

• Payment processor — Square, to settle deposits.
• Fulfillment partner — when you queue a Physical Delivery, we share the cards requested and your shipping address with our fulfillment partner so they can source and mail the physical card.
• Infrastructure providers — hosting (Vercel), database (Supabase), email delivery, error tracking. These providers act as data processors on our behalf.
• Legal compliance — we may disclose information if required by law, legal process, or to protect RipVault, our users, or the public.
• Corporate transactions — if RipVault is acquired or merges, user information may transfer to the successor entity subject to this policy.

5. Retention

We retain account and transaction data for as long as your account is active and as long as needed to comply with our legal obligations (typically seven years for financial records). We retain shipping information for as long as needed to fulfill outstanding requests and handle post-delivery claims.

6. Security

We use encryption in transit (TLS), encryption at rest for sensitive fields where applicable, row-level security on our database, and least-privilege access for the team. No system is perfectly secure; we encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorised access.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict some processing. To exercise these rights, email privacy@ripvault.gg. We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA). You have the right to know the categories of personal information we collect, the categories of sources, the purposes, and the categories of recipients; to access a copy of your information; to request deletion; to correct inaccuracies; and to limit the use of sensitive personal information. We do not “sell” personal information and do not “share” it for cross-context behavioural advertising as those terms are defined in the CPRA.

8. Children

The Service is for users 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

9. International users

RipVault is operated from the United States. If you access the Service from outside the United States, you understand and consent to the transfer of your information to the United States and to the processing of your information in a country whose data-protection laws may differ from those of your country.

10. Changes to this policy

We may update this Privacy Policy from time to time. If a change is material, we will provide notice in-product or by email. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

privacy@ripvault.gg