Privacy Policy

Last updated: 12 September 2026

This Privacy Policy explains how Ripstead ("Ripstead", "we", "us") collects, uses and shares personal information when you use ripstead.com and related services (the "Service"), and the choices you have. For questions, contact us at privacy@ripstead.com.

1. Information we collect

Information you give us

• Waitlist: your email address.
• Account: email address, password (stored only as a secure hash by our authentication provider), username, and your confirmation that you are 18 or older. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Verification (when required): name, date of birth, country, address, a photo of your government ID and a selfie holding it, used to check that the ID belongs to you. See section 2.
• Shipping: name, delivery address and phone number.
• Support: anything you send us when you contact us.

Information created when you use the Service

• Activity: Packs opened, Collectibles pulled, kept, sold back or shipped, your Credit and Buyback Token balances and transaction history.
• Payments: payment confirmations and limited card details (such as the last four digits) from our payment processor, and a reference our processor gives each card so that we can tell when two accounts have paid with the same one, which we use to keep the invite programme honest. We do not store full card numbers, and that reference cannot be turned back into one.
• Screening results: the outcome of checks against government sanctions lists, and of fraud checks.

Information collected automatically

• Device and usage data: IP address, approximate location derived from it, browser and device type, pages viewed and language preference.
• Cookies and similar technologies: see section 7.

2. Identity photos and biometric information

Today, a member of our team checks your identity by hand: they look at the photo of your ID and your selfie and confirm they show the same person. We do not use face-recognition software and do not create a face template. The photos are stored privately, can be seen only by the staff who review them, and are deleted when you delete your account, unless the law requires us to keep them longer (section 6).

If we later use an identity-verification provider (for example, Stripe Identity or Sumsub), it may compare the face in your selfie with the photo on your ID automatically, which creates biometric data (a face geometry template). In that case:

• We ask for your consent before collecting it.
• It is used only to confirm your identity and prevent fraud.
• It is never sold, and it is shared only with the verification provider.
• It is permanently deleted within 30 days after verification is complete, or sooner if the law requires.

3. How we use information

We use personal information to:

• provide the Service: your account, Packs, Vault, Sell-Back, Buyback Tokens and shipping;
• verify your age, identity and location, screen against sanctions lists, and keep the Service available only where it is permitted;
• process payments and keep the records we are required to keep;
• prevent fraud, abuse, money laundering and security incidents;
• provide support and send service messages (for example, receipts and security alerts);
• send the launch email you asked for when you joined the waitlist, and marketing messages if you have agreed to them (you can unsubscribe at any time);
• improve the Service, including understanding which features are used;
• comply with legal obligations and enforce our Terms of Service.

Where the law requires a legal basis (such as in the EU and UK), we rely on:

• performing our contract with you;
• our legitimate interest in running a safe, fair Service;
• complying with legal obligations; and
• your consent, for example for marketing and biometric verification.

4. How we share information

We do not sell your personal information, and we do not share it for targeted advertising. We share it only with:

• Service providers that process data for us under contract, including:
  • hosting, infrastructure and site measurement (Vercel, United States);
  • database and authentication (Supabase, with data stored in Japan);
  • the support chat (Tawk.to, United States), which receives your messages and, if you are signed in, your account id, email address and username;
  • identity verification, if we use an outside provider (for example, Stripe Identity or Sumsub);
  • payment processing, shipping carriers, email delivery and customer-support tools;
• Google, if you choose to sign in with Google;
• Professional advisers, such as lawyers, auditors and insurers;
• Authorities, where the law requires it or to protect the rights and safety of Ripstead, our users or others;
• A successor, if our business is sold or reorganised, subject to this Policy.

Card images on the Service are loaded from a third-party image service (images.pokemontcg.io), which may receive your IP address when your browser loads them.

5. International transfers

We and our providers operate in several countries, and your information may be processed outside the country where you live.

• Japan stores our main database.
• The United States hosts our website and some service providers. The U.S. has no single comprehensive federal privacy law equivalent to Japan's APPI or the EU's GDPR. Protection instead comes from sector-specific and state laws, and from our contracts with providers.

Where required, we use safeguards such as standard contractual clauses. On request, we will tell you more about the privacy laws of any country your data is transferred to. We do not offer the Service in mainland China.

6. How long we keep information

7. Cookies and local storage

We use a small number of cookies and similar technologies that are needed for the Service to work:

We measure how the site is used and how quickly it loads with Vercel Web Analytics and Speed Insights, which set no cookies and do not follow you between sites: they count page views, a few actions such as opening a pack, and page speed, all in aggregate. We do not use advertising or third-party advertising analytics cookies. If we add any, we will update this table and ask for your consent where required. We honour the Global Privacy Control browser signal as a request to opt out of any sale or sharing of personal information.

8. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, or withdraw consent;
• move your information to another service (portability);
• opt out of marketing emails (use the unsubscribe link, or email us).

US residents (including California):

• We do not sell or "share" personal information for cross-context behavioural advertising.
• We use sensitive personal information (such as government ID and biometric data) only to verify your identity, prevent fraud and meet legal obligations.
• You will not be treated differently for exercising your rights.

Japan: we handle personal information under the Act on the Protection of Personal Information (APPI), including its rules on providing data to third parties and to other countries.

China: where the Personal Information Protection Law (PIPL) applies, we process personal information with your consent where required, including separate consent for transfers outside mainland China.

To exercise any right, email privacy@ripstead.com. We may need to verify your identity first. You can also complain to your local data-protection authority.

9. Security

We use industry-standard measures to protect personal information. These include:

• encryption in transit and hashed passwords;
• access controls, and database rules designed so that each player can read only their own account data;
• limiting staff access to what each person needs.

No system is perfectly secure, so please use a strong, unique password. If a data breach affects your personal information, we will notify you and the relevant authorities without undue delay, and within any time limit the law sets.

10. Children

The Service is only for people aged 18 or older (or the age of majority where they live). We do not knowingly collect personal information from anyone younger. If you believe a minor has given us personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will notify you by email or on the Service before they take effect.

12. Contact

Ripstead Postal address available on request at support@ripstead.com Privacy enquiries: privacy@ripstead.com We do not currently offer the Service in the European Union or the United Kingdom, so we have not appointed a representative there. We will appoint one before we do.