Privacy Policy
Effective October 2, 2026 · Version 2026-10-02
This policy explains what personal data RipRoom (“we”) collects when you use riproom.stream, why, who we share it with, and the choices and rights you have, including under the Texas Data Privacy and Security Act. RipRoom is operated in Texas, United States.
The short version: we collect what we need to run live breaks and keep card records. We don't sell your personal data and don't use it for targeted advertising. Records show buyers as first name and last initial, never emails or addresses.
- What we collect
- What's public
- How we use it
- Who we share it with
- Cookies and analytics
- How long we keep it
- Your rights and choices
- Security, children, changes
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email address, display name, confirmation you're 18+, terms acceptance, role and plan | Sign-in, running your account, plan limits |
| Profile (optional) | Handle, bio, links, profile picture and banner (creators); public collection page settings (collectors) | Your public pages |
| Collection and Pull Records | Cards you pull or add, photos, grades and cert numbers, values you enter, custody steps (shipping/grading requests, carrier and the last 4 digits of tracking numbers) | Your collection and the card's verifiable history |
| Live room activity | Slot claims and purchases, chat messages, follows | Running breaks, follow alerts |
| Video and images (creators) | Stream recordings, clips of pulls, evidence frames, sealed box photos | Clips and evidence on Pull Records |
| Box custody (creators) | Product, serials, store name, city and state, purchase date, uploaded receipts or invoices | Box records and custody; receipts are private (see below) |
| Card scans | Images you send for AI identification and the result | Identifying cards; measuring accuracy and cost |
| Referrals and marketing | The creator link and campaign tag you arrived through; email preferences | Crediting creators; go-live emails you opted into |
| Requests | What you send through Contact & requests | Responding to you |
| Device and usage | IP address, browser, pages visited, actions like claiming or following, security and error logs | Security, abuse prevention, analytics |
| Payments (when checkout launches) | Handled by our payment processor; we receive status and limited details, not full card numbers | Purchases, fees, payouts |
We don't knowingly collect sensitive data such as precise geolocation, biometric identifiers, health or financial account numbers. Please don't upload them (for example, cover card numbers on receipts).
2. What's public
- Pull Records (card, photos, the break, the creator, custody steps, clips, evidence frames) and certificate pages. Owners appear as first name and last initial; tracking numbers as last 4 digits plus a fingerprint.
- Your display name in rooms and chat; creator pages; your collection page only if you turn it on (values hidden unless you choose to show them).
- Box records: product, serial, store, city and state, purchase date, and the fact (not the contents) that a receipt is on file.
- Records, milestones and stats. Collectors are named in records only if their collection is public.
3. How we use it
To provide and secure the Service; run breaks, holds and payments; build and verify Pull Records; cut clips and frames; send sign-in codes, go-live alerts you opted into and service messages; enforce our Terms and plan limits; prevent fraud and abuse; understand how the Service is used so we can improve it; and comply with law. We don't sell personal data, don't use it for targeted advertising, and don't use it for profiling that produces legal or similarly significant effects.
4. Who we share it with
We share personal data only with service providers that process it for us under contract, when you choose to share it, or when the law requires it:
- Cloudflare: hosting, database, file and video storage (Stream), email delivery, security and bot checks (Turnstile).
- AI providers via OpenRouter (for example Anthropic): card images you scan, processed to identify the card, with data collection by the provider disabled.
- Google Analytics: page views and product events, with advertising features off.
- Our payment processor (Stripe), when checkout launches.
- Creators and buyers: a creator sees the display name of buyers in their break and what they need to ship your cards; buyers see the creator's public profile.
- Platforms you connect (for example YouTube, Twitch, Kick, Facebook, X for simulcast) receive your broadcast under their terms.
- Authorities, when required by law or to protect rights and safety; and a successor in a merger or sale, under this policy.
5. Cookies and analytics
- Necessary: a sign-in session cookie; Cloudflare security cookies.
- Referral:
rr_refandrr_camp(30 days) record the creator link you arrived through. - Analytics: Google Analytics cookies (
_ga…) measure visits and usage. Google signals and ad personalisation are turned off. You can block them with your browser settings or Google's opt-out add-on. - Your browser also stores small preferences (for example hiding a checklist).
6. How long we keep it
- Account and profile data: while your account is open, then deleted or de-identified (backups roll off within about 30 days).
- Pull Records: kept permanently so card histories stay verifiable. Signed entries can't be edited; after account deletion we stop linking them to you and can hide your name from display.
- Full stream recordings: for your plan's period (90 days, or 1 year on Creator Pro); pull clips and evidence frames stay with their records.
- Receipts and invoices: while the box record exists; you can ask us to delete the file (its fingerprint stays in the record).
- Room chat: the latest 50 messages per room. Security and audit logs: as long as needed for security and legal purposes. Analytics: per Google Analytics retention settings (14 months).
7. Your rights and choices
You can ask us to:
- Access the personal data we hold about you, or confirm whether we process it;
- Correct inaccurate data;
- Delete your account and personal data (subject to the Pull Record limits above and legal obligations);
- Get a copy of your data in a portable format;
- Opt out of targeted advertising, sale of personal data and profiling (we don't do these, but you can still register the request);
- Appeal if we decline your request.
Send requests through Contact & requests. If you're signed in, we use your account email to verify you; otherwise we may ask you to confirm from the email on your account. We respond within 45 days (we may extend once by 45 days if needed and will tell you why). Requests are free up to twice a year. If we decline, you can appeal through the same form; we'll answer within 60 days. If your appeal is denied, you can contact the Texas Attorney General. You can use an authorised agent where the law allows, and we won't discriminate against you for exercising your rights.
You can also: turn go-live emails off in My Collection or with the link in any alert; make your collection private at any time; and remove your profile picture, banner and links in creator tools.
8. Security, children and changes
- We protect data with encryption in transit, access controls (admin areas sit behind an additional sign-in), signed records and monitoring. No system is perfectly secure; tell us through Contact & requests if you find a problem.
- RipRoom is for people 18 and older and isn't directed to children. If we learn we've collected data from a child, we'll delete it.
- Data is stored and processed in the United States and wherever our providers operate.
- We'll update this policy as the Service changes, change the version date above, and notify you of material changes.
Contact: Contact & requests.