This policy explains what information RipStack collects, how it's used, and how you can control it. We've tried to write this in plain English instead of legalese.
RipStack is operated by PF DATASTACK LLC, a New Jersey limited liability company founded by Paul Fregonese. The app is hosted at rips.pfdatastack.com.
Correspondence: [email protected] · PF DataStack LLC, New Jersey, USA
The minimum needed to make the app work:
RipStack uses a single session cookie to keep you logged in:
pf_rips_sidWe do not use tracking cookies, analytics cookies, or advertising cookies. No third-party cookie scripts are loaded.
When you take a photo of a card to scan, the image is sent to Anthropic's Claude API for identification, and then discarded immediately. We do not store card photos on our servers, ever.
Only the resulting metadata (card name, set, rarity, price) is saved to your collection.
To make the app work, we share data with these services:
All user data is stored on our own server in the United States. Each user has a single JSON file containing their collection and account status. Data is not sold, shared, or used for any purpose beyond running this app.
You have the right to:
Email [email protected] with the subject line "Privacy Request" and the email address tied to your account. We will respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity before processing deletion or access requests.
RipStack is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, please contact us and we'll delete it.
Reasonable steps are taken to protect your data: TLS encryption in transit, restricted file permissions, no public exposure of session files. However, no system is 100% secure. If you discover a vulnerability, please email us responsibly at [email protected].
RipStack is operated from the United States. If you access the app from the European Union or European Economic Area, your personal data is transferred to and processed in the U.S. We rely on the following legal bases under GDPR:
EU/EEA residents have the right to rectification, restriction of processing, and the right to lodge a complaint with your local data protection authority. Email [email protected] with the subject "Privacy Request" to exercise any of these rights. We will respond within 30 days.
Our sub-processors — Anthropic, Stripe, Cloudflare, and Resend — operate under their own Data Processing Agreements and participate in international data transfer frameworks (Standard Contractual Clauses or equivalent). Links to their privacy policies are in the "Third parties we use" section above.
If you are a California resident, you have the right to:
To exercise your rights, email [email protected] with the subject "Privacy Request" and include the email address associated with your account. We will respond within 45 days. We may request additional information to verify your identity before processing your request.
To keep RipStack reliable for everyone, we enforce the following limits:
These limits are enforced in memory and are not tied to your personal data beyond what is necessary to count your scans.
If we update this policy, the new version will appear at this URL with a new effective date. For significant changes, we'll notify users by email.