RipNova Privacy Policy

1. Who we are and what this policy covers

Effective: October 25, 2026. Last updated: October 25, 2026.

RipNova is a collectibles app and website run by VelaVia LLC ("VelaVia", "we", "us"), 2108 N St Ste N, Sacramento, CA 95816, USA. You can reach us at contact@velavia.io. VelaVia LLC is the business responsible for your personal information.

Members use RipNova to scan and track everything they collect in one portfolio, including Pokémon, Magic: The Gathering and Yu-Gi-Oh! cards, graded slabs, watches, sneakers, jewelry, comics, coins and cars. They see estimated values, set price alerts, build binders and wishlists, trade with other members, record sales, track grading submissions and sealed products, open packs and boxes with free play credits, and buy Nova Credits in the Shop to open packs and boxes whose pulls can be shipped. Payments are handled by Stripe and PayPal (including Venmo).

This policy explains what personal information we collect, why, who receives it, how long we keep it, and your choices and rights. It covers:

• the RipNova website at https://velavia.io/ripnova/ and its pages (the "Site");
• the RipNova app for Android, downloaded from the "Download for Android" button on the Site, and any RipNova app we later offer through Google Play or for iPhone (the "App");
• the RipNova servers the App connects to, including public pages they serve, such as wishlist sharing links;
• Nova Credits purchases, Nova Credit pulls, sell-backs and shipping; and
• emails and messages we exchange with you about RipNova.

Together these are the "Services". This policy does not cover other VelaVia products or other pages on velavia.io, which are covered by the VelaVia Privacy Policy (/privacy.html), or third-party sites and apps we link to. For RipNova, this policy controls where it differs from any general VelaVia notice.

This policy is a notice, not a contract. It describes our practices and does not create contractual rights or duties beyond those the law provides. Where a screen says you agree to it, that means you acknowledge you have read it. Your use of RipNova, and any dispute about it, is governed by the RipNova Terms (/ripnova/terms/), including their arbitration agreement and class-action waiver.

Where RipNova is offered. RipNova is designed for and offered in the United States only. Nova Credits can be bought only by adults 18 or older, and only where permitted by law.

Related documents:

• Terms (/ripnova/terms/)
• Disclaimers (/ripnova/disclaimers/)
• Rip Standard for packs and boxes (/ripnova/rip-standard/)
• Community & Trading Guidelines (/ripnova/guidelines/)

2. Information we collect

We collect information you give us, information created when you use RipNova, and a limited amount from service providers. Section 3 covers purchases, payments, shipping and identity checks.

a. Account information. When you create an account, we collect:

• the handle and display name you choose, which are public;
• an internal account ID, your profile color or avatar, and when you joined; and
• a key that keeps you signed in on your phone. Our servers store only a hashed form of the key. If you have not added a sign-in, this key is your account: uninstalling the App or clearing its data loses the account.

Email and Google sign-in. You can sign in, or protect your account, with a one-time email code or with Google, through our authentication provider, Supabase. We then receive your email address (or the email and account identifier Google shares) and keep it linked to your account, with a scrambled form of it. RipNova does not use passwords. Before an email code is sent, a bot check by hCaptcha runs in a browser page; hCaptcha receives the technical data of that page visit. If an account is banned and later deleted, we keep a scrambled form of its sign-in email or Google identifier for up to 24 months, so it can't sign up again (Section 8).

Phone verification. Buying Nova Credits needs a verified account: a sign-in (email or Google) and a mobile number confirmed with a text code. To send and check the code, your number goes to Supabase and the text-message provider it uses. We keep only a keyed scrambled form (hash) of the number and when it was confirmed, never the number itself or the code. One number per account, and one account per number.

b. Age confirmation and Terms acceptance. Before the App creates an account, it asks you to confirm that you are 18 or older and to accept the Terms. From app version 0.3.14, our server records the date and time you ticked that box. From app version 0.3.14.2, it also keeps a Terms acceptance record: which versions of the Terms and this Privacy Policy you accepted, when, and, where the App reports them, the App's version and your device's system (such as Android). An account created on an earlier version has no such record until you confirm again in the App that you are 18 or older, for example when you turn on meetups (Section 2(p)), and we record when you did. We also keep any notice you send us opting out of arbitration.

c. Collection and portfolio data. This includes:

• the cards you add, with details such as edition, quantity, condition, grade, notes and price paid;
• your Keep, Never trade, For trade and For sale flags;
• toys you add in Collection › Items, such as LEGO® sets, Funko Pop! figures and Pop Mart figures, with their line, series, number, condition, quantity and extras (such as exclusive or chase), what you paid and when you bought it, your notes, your own estimate of what each is worth (with the days you changed it), photos (Section 2(d)), whether you'd keep, trade or sell each one, and whether you show each one on your profile;
• non-sport cards you add in Collection › Items, such as Topps or Upper Deck cards, with their maker, set, name or subject, number, year, condition or grade and extras (such as a parallel, serial number or autograph), how many you have, what you paid and when you bought it, your notes, your own estimate of each card's value (with the days you changed it), photos (Section 2(d)), whether you'd keep, trade or sell each one, and whether you show each one on your profile;
• the other items you add in Collection › Items: watches, sneakers, comics, coins, bags, jewelry, cars and sealed product. For each one, what you type: its brand or maker (for a car, its make; a comic, its publisher; a coin, its country or mint; sealed product, its game), its name (such as a watch's model, a sneaker's model and colorway or a comic's title), its series and number where its kind has them (a watch's collection and reference, which is the model number, not the serial number; a comic's series or volume and issue; a sneaker's style code; sealed product's set), its condition, how many you have and its details: a watch's year and whether it has its box and papers; a sneaker's size; a comic's year and cover or variant; a coin's year and mint mark; for a graded comic or coin, the grader and the grade; a bag's color and material; jewelry's metal, stones, ring or chain size and year; a car's year, trim, color and mileage; sealed product's product type. And what you paid and when you bought it, your notes, your own estimate of its value (with the days you changed it), photos (Section 2(d)), whether you'd keep, trade or sell it, and whether you show it on your profile. We never ask for a serial number, a car's VIN or its plate number, so don't add them, even in your notes;
• your binders, set progress, wishlist (with the printing you want for each card, and any maximum prices), price alerts and profile showcase;
• price targets you set on wishlist cards: the amount, the printing it is for, and whether the card's value has gone under it. When it does, we send you a note in the App (and a push notification, if you allow them). Only you see your targets;
• a start value for each card you add to your wishlist: the card's estimated value that day, the printing it is for, what kind of price it was, the date of that price and the values update it came from. We save it when the card is first added, and use it to show you how the card's value has changed since then. Only you see your start values and those changes; and
• portfolio figures we calculate from your items and our estimated values, such as value over time, cost basis and gain. If you turn on Count my estimates in my total, your own estimates for toys, non-sport cards and other items are added to your total, labelled as yours.
• graded slabs: the grader, grade, certificate number and your estimate, and the photos you add of your own slab;
• custom cards you add when a card is not in our catalog (its name, details and photo);
• if you use them, your collection tools: sales you record (what you sold, when, for how much, fees and the gain or loss), grading submissions you track (the grader, cards, fees, status and results), sealed products you track (what you paid and when), your openings (the cards you record from each pack you open) and figures we calculate from them, such as Your pull luck, set completion and the trade scorecard made from your trades. Only you see these.

d. Scan photos and item photos. The App uses your camera only while the scanner or photo screen is open. The scanner reads Pokémon, Magic: The Gathering and Yu-Gi-Oh! cards. Each scan photo is sent to our servers, where our own recognition software compares it with reference card images from public card databases (such as TCGdex, Scryfall and YGOPRODeck) to identify the card and show its estimated value. We send those databases nothing about you or your photos. We do not keep scan photos after identification (the answer is held in memory for a few minutes so a retry does not scan twice) unless you choose to save a photo to an item. Photos you add to an item are stored with that item. We record which match you confirm, without the photo, to measure and improve identification. You can also choose photos from your phone's gallery to scan, several at once; each one is sent and handled the same way as a scan taken with the camera.

Grading check. Where the App offers the Grading check, you take front and back photos of a card. Centering is measured by RipNova's own software. The photos are then sent to OpenAI, our AI provider, to read corners, edges and surface, with a coded identifier made from your account (not your name or handle). Photos are held in memory for that request only and never stored by RipNova; the request asks OpenAI not to store it (OpenAI may keep it up to 30 days to check for abuse). No result is stored: we keep only counts of checks per day.

Photos of toys, non-sport cards and other items. You can add up to 3 photos to each toy, non-sport card or other item you add, taken with the camera or chosen from your gallery. The App re-encodes each photo before it is sent, which removes its location and camera details, and our server removes any that remain. We keep a full-size copy and a small copy of each photo on our hosting provider's storage until you remove the photo or the item or delete your account, or our staff remove it after a report (Section 6). Item photos are not included in our daily database backups. Your toy photos are private unless you show the toy on your profile and turn on Show photos too (Section 6). Photos of your non-sport cards and other items are only ever shown to you, even when you show the item on your profile. The links the App uses to load them expire within about 2 days.

Frame only the item. Anything else in the photo is sent too, such as your hands, your home, a document or a license plate. Service providers that process photos for us may use them only to provide services to us, not for their own purposes, including training their own models.

e. File imports. You can import a CSV file, such as an export from another collection app. You pick the file in Android's own file picker, and the App reads only that file. We turn its rows into items in your collection and do not keep the file itself. We do not connect to your accounts with other apps, and they send us nothing.

f. Trading and messages. This includes:

• trade matches and suggested offers, which we generate by comparing members' wishlists with items flagged for trade;
• offers, counter-offers, acceptances and declines, the items involved, and each trade's status and history;
• receipt confirmations and any in-person trades you log (do not enter personal details about people who are not members);
• the carrier and tracking number you add when you tell the other member you shipped your cards (Shipped, with tracking), and when you added or changed it;
• in-trade chat messages, including anything you choose to share in them, such as an address or phone number;
• reviews you give and receive; and
• the members you block, and the reputation badges and badge progress we calculate from your trading history.

Other members also create information about you, for example by sending you an offer, messaging you or reviewing you.

g. Community activity. Follows, likes, activity shown in the community feed (such as items you add, list or complete), and your appearance in lists such as "Collectors with this card".

h. Notifications. Records of the alerts we send to your RipNova inbox about offers, messages, price alerts, follows, orders and shipping. If you turn on push notifications (the App asks first), we receive a push token for your device and send it, with the notification's text, to Expo's push service and Google's Firebase Cloud Messaging to deliver it. You can turn them off in the App's settings or in Android.

i. Device and usage data from the App. When the App talks to our servers, we and our hosting providers log your IP address, the date and time, the request and response, and technical details such as App version, device model and operating system. We also collect crash and performance diagnostics, how features are used, and fraud and security signals, such as repeated failed requests or unusual account activity. We use this to run, secure, debug and improve the Services.

j. Website data. When you visit the Site, we collect analytics through Google Analytics, our hosting provider keeps server logs, and your browser loads fonts from Google (Section 4). Server logs include your IP address, the date and time, the page or file requested (including each App download), the referring page, your browser and device type, and the response code.

k. Messages you send us. If you email contact@velavia.io or write to us, we receive your contact details, your message and anything you include, such as questions, reports, privacy requests or an arbitration opt-out notice.

l. Email update sign-ups. If you signed up on the Site for RipNova email updates, we hold your email address, a record that you confirmed you are 18 or older and wanted RipNova email (with the date and time), which form you used, and any optional answers you gave about what you collect and which phone you use. These records are kept in our customer relationship management (CRM) system. If you already had a VelaVia contact record with the same email address, your RipNova details were added to it.

m. Play-credit rips. You can open packs and boxes with play credits, a free balance with no cash value. For each play-credit rip we record: the pack or box; the pack style (Normal, High or Max); the tier; what was pulled (for a card, its name, set, number, printing and any grade; for a box piece, its title, brand, category and size); its estimated value; whether a bonus card came with it; whether you kept it, sold it back for play credits or asked to have it shipped; and the date and time. We use these records to run your play-credit balance, your pulls and your collection, to show Recent pulls (Section 6), and to check that rips follow the published odds.

n. Invites. When you first open Account or share your invite link, we create an invite code and link for your account (shown under Account › Invite a collector). We count how many times your invite page is opened, as one total (a repeat visit from the same network on the same day counts once); we don't record who opened it. If you create your account with an invite code (typed in, from an invite link, or passed on by Google Play when you install the app from an invite link), we record once, at sign-up, which member's code you used, how it reached us and when. No one receives credits or anything else for an invite.

o. Ask Nova (AI assistant). If you use Ask Nova, we collect the questions you type and the answers it gives. We also collect which RipNova data it looked up to answer: for example a card's prices or, if you allow it, your collection totals and wishlist. And we collect your Ask Nova settings, and any answer you report with the reason you choose.

p. Meetups. Meetups are optional. If you turn them on in Account › Meetups to swap cards in person, we collect:

• your confirmation that you are 18 or older, with the date and time, and which version of the safety tips you were shown;
• your area: a 5-digit US ZIP code you type. We use it only to suggest public places near you and to show a rough distance between your ZIP area and another member's (such as "About 5–15 mi"). Our server works that out from the center points of ZIP areas published by the U.S. Census Bureau, a file stored on our server. Your ZIP is never shown to other members. It stays on our servers, which our hosting provider runs, and we don't send it to any other company;
• each meetup plan: the day, time and length, the place (a card shop from our list, or the name, city and state of a public place you type), any note, and who proposed, accepted, changed or cancelled it, with any reason chosen;
• what happens at and after a meetup: the time you tap I'm here (the time only, never where you are), Swap done, your answer to Everything OK?, and any no-show claim and the other member's answer; and
• whether your meetups are paused and why (Section 6), and the meetup lines added to the trade's chat.

Meetups never use your phone's location. The App doesn't ask for location permission for them, and nothing tracks your trip. If you tap Add to calendar, Share my plan or Open in Maps, the App passes the plan's details (for Open in Maps, a listed card shop's name and address) to the calendar, messaging or maps app you pick on your phone. What happens to them there is up to that app and the people you share them with.

If a question to Ask Nova says you are under 18, we also record a pause on meetups for your account, even if you never turned them on (Section 10).

q. Drops. If you use Notify me on Drops, the release calendar, we collect the products you watch, your drop alert settings (on or off, when you agreed to the alerts, and your phone's time zone, for reminder times) and the alerts we sent. Where Drops shows Best Buy stock, we also keep whether you want a stock note for each product you watch, your Best Buy stock at night setting, how many store checks you used each day, and the stock notes we sent, which are deleted within 72 hours.

Best Buy store checks. If you check Best Buy stores near a ZIP code, the ZIP you type is sent to Best Buy to find nearby stores. RipNova holds it in memory for up to 10 minutes, as part of an answer shared by everyone who checks that ZIP, with no account on it. It never writes the ZIP to its database, its logs or your account.

r. On eBay now. Some card pages in the App may show an "On eBay now" panel with eBay listings for that card. Nothing is asked of eBay until you tap Show listings. Then our server asks eBay for that catalog card's listings. It sends only that card's details (its name, number, set and printing), our eBay Partner Network campaign and a feature tag, never your account, handle, ZIP code or anything you type. The answers stay in our server's memory for at most 35 minutes, with no account on them, and are never written to our database, our logs or your account. The App holds them in its memory only, never in your phone's storage. The listings' photos load from eBay's servers, so eBay receives your device's IP address and the photo requested, as other image hosts do. View on eBay opens the listing in your browser or the eBay app, where eBay's own terms and privacy notice apply. Its link carries eBay Partner Network tracking (our campaign and the feature tag) so that eBay can credit the referral, and VelaVia may earn a commission if you buy (see the Disclaimers, Section 13). eBay Partner Network's reports to us show referred purchases by campaign and feature tag. They don't name the buyer, and we don't link them to any account. eBay also sends us its members' account-deletion notices, as it requires of apps using its API; RipNova holds no eBay member data, and nothing in those notices is logged or kept.

s. Seen in store. Seen in store is part of Drops, open only to some members, all 18 or older. Members post sightings of products they saw on a store's shelf, picked from lists. If you use it, we collect: the 5-digit US ZIP code and the distance you type, to find stores and sightings near you and to send Seen nearby notes (it never uses your phone's location, and the App doesn't ask for location permission for it); the sightings you post (the store and the product, picked from our lists, about how many you saw, and when); your Still there and Gone votes on other members' sightings; the stores you suggest (the chain, street address, city and ZIP code, and the store's name if you type one); whether you turned on Seen nearby notes for a product you watch, and when you agreed to them; counts of how many of your sightings other members confirmed and how many were found false; and reports about sightings. A sighting has no photos, prices or notes. Our store list comes from OpenStreetMap, © OpenStreetMap contributors, available under the Open Database License (ODbL); our edited store list is available on request.

t. Appeals in the App. If your account is suspended or banned, you can appeal the decision once in the App, under Account › Account status (or by email, Section 6). We collect what you write (up to 1,000 characters) and when you sent it. Don't include payment details or passwords. Staff read it to decide the appeal, and the decision comes to your RipNova inbox.

Estimated values are not personal data. Our estimated values come from multiple marketplaces and recent sales. We send those sources no information about you. Values are estimates, not appraisals (see /ripnova/disclaimers/).

Images from other hosts. Some item images may load directly from third-party image hosts. Those hosts receive only the technical data any web request carries, such as your IP address, device details and the image requested, as independent providers. We send them nothing else.

What we do not collect. We do not collect your contacts, call logs, audio recordings or your activity on other companies' sites and apps. We do not collect your device's precise location (Section 3(e)). Meetups use only the ZIP code you type, never your device's location (Section 2(p)), and so do Best Buy store checks (Section 2(q)). We do not receive full payment card or bank account numbers. We do not buy personal information from data brokers.

3. Purchases, payments, shipping and identity checks

Nova Credits (100 Nova Credits = $1) are bought in the App's Shop by adults 18 or older, only where permitted by law, and are used to open packs and boxes. Each pack's and box's odds are listed in the App under Settings › Odds & how packs work. After a Nova Credit pull you can keep it in your RipNova collection, sell it back for 90% of its value in Nova Credits within 24 hours, or ask us to ship it. When you ask, RipNova obtains that exact item (from the maker, a retailer or a marketplace) and ships it to you. The Rip Standard (/ripnova/rip-standard/) explains how packs and boxes work.

a. Purchases and openings. We record each Nova Credits purchase (the package, the price, any bonus credits, the date and time, and the order status), each Nova Credit pull (the pack or box, the odds table version, the item pulled and its locked value), sell-backs, ship-fee orders, refunds, chargebacks and any credits owed when a refunded or charged-back purchase's bonus was already spent, and your spend limits, breaks and cool-offs and their changes. We use these records to deliver your item, show your history, handle refunds, chargebacks and disputes, prevent fraud, meet tax and accounting rules, and check that openings followed the odds shown. Any statistics we publish about pulls are aggregated and do not identify you. Play-credit rips are not purchases (Section 2(m)). Apart from aggregated statistics, single play-credit pulls appear without your name in Recent pulls (Section 6).

b. Getting and checking items you ship. When you ask to ship a pull, we record the request, the item we obtain for it, its inspection (cards come to RipNova first to be checked; boxed retail items may ship straight from the maker or retailer), its fulfilment status and tracking. Sellers and retailers we buy from receive what is needed to fill the order; for an item shipped straight to you from the maker or retailer, that includes your name and shipping address. Authentication or inspection is an opinion, not a guarantee (see /ripnova/disclaimers/).

c. Sell-backs. If you sell back a Nova Credit pull, we record the sell-back and the Nova Credits paid. RipNova does not pay out money: sell-backs pay Nova Credits only, so we collect no bank account or payout details.

d. Payments. Payments are handled by Stripe (cards, through Stripe Checkout) and PayPal (PayPal and Venmo). You enter your payment details on the processor's own checkout page. VelaVia never receives your full card number or bank account number. From the processor's notices we keep only what we need: the payment's ID, amount, status, refunds and disputes. We don't keep the payer's name, email or card details those notices may carry. To allow one card or PayPal account per RipNova account, we keep a keyed scrambled form (hash) of the card's fingerprint from Stripe or the PayPal payer ID. If the same card or PayPal account is used by another RipNova account, the order is held for our staff to review. Stripe and PayPal also handle your information under their own privacy policies.

e. Identity checks. RipNova does not run identity-document checks today and does not ask for your device's precise location. Your age is confirmed by you (Section 2(b)). We may ask for proof of age or identity where the law requires it or to investigate fraud, and we may use the state in your shipping address to apply any state-by-state restrictions. Before we use an identity-verification provider, we will update this policy. If a check ever uses a selfie or face comparison (biometric information), we or the provider will ask for your written consent first, use it only to complete the check and prevent fraud, never sell or otherwise benefit commercially from it, and destroy it once its purpose is met, and no later than 3 years after your last interaction with RipNova, or sooner where the law requires.

f. Saved shipping addresses and delivery. To ship a Nova Credit pull, you save up to three US addresses (the 50 states and DC) in the App: the recipient's name, street address, city, state, ZIP code and, optionally, a phone number. APO/FPO/DPO and US territory addresses are not accepted; PO boxes are accepted and shipped by USPS. Each parcel keeps a copy of the address it went to, with its tracking, delivery and insurance records and any claim. The recipient's name and address go on the shipping label, so the carrier (USPS today) receives them. We do not use your phone number for marketing. If you enter someone else's address or phone number, make sure they are happy for you to share it.

g. What other members see. Items you keep from a pull are part of your collection and follow your visibility settings (Section 6). We do not show other members your purchase history, what you paid for a pack or box, your sell-back activity, your payment details, or your shipping address. One exception: your play-credit pulls can appear without your name in each pack's and box's Recent pulls (Section 6), unless you turn this off.

4. Cookies, analytics and app permissions

Website analytics. The Site uses Google Analytics 4 to understand how the Site is used and to count App downloads. The RipNova pages do not load advertising tags, such as Google Ads conversion tags or the Meta Pixel. Google Analytics collects:

• pages viewed and events such as link clicks, scrolls and file downloads, including taps on the "Download for Android" button;
• the referring site or campaign;
• device type, operating system, browser, screen size and language; and
• approximate location (country, region and city) estimated from your IP address.

It does not receive your RipNova handle, account details, collection, scans, trades, purchases or messages, and we do not combine analytics data with your account.

Cookies. Google Analytics sets first-party cookies named "_ga" and "_ga_" followed by our property ID. They hold a random identifier used to count repeat visits and can last up to 2 years unless you delete them. We set no other cookies of our own for analytics or advertising on the RipNova pages. Our hosting provider may set strictly necessary cookies for security or load balancing. Where the Site has an interactive demo, it may save your demo choices in your browser's local storage, which stays in your browser.

One analytics property across velavia.io. VelaVia uses one Google Analytics property across velavia.io, and the _ga cookie is set for the whole velavia.io domain, so Google Analytics may recognize your browser on other VelaVia pages. Those pages are covered by the VelaVia Privacy Policy (/privacy.html) and may use advertising tags. Google signals and ad-personalization settings are not switched off for that property, so Google may link visits to signed-in Google accounts and use the data for its own purposes under its own terms. For that reason we treat Site analytics as a possible "sale" or "sharing" and honor opt-outs (Section 7). We do not build advertising audiences from visits to the RipNova pages, and we keep event-level analytics data for no more than 14 months. Google states that Google Analytics uses IP addresses to estimate location and does not store them.

Web fonts. Site pages load typefaces from Google Fonts. To deliver them, your browser contacts Google directly and sends your IP address, browser details and the address of the page. Google receives this as an independent provider under its own privacy policy (policies.google.com/privacy). We receive none of it.

In the App. The App does not use cookies for tracking, contains no advertising network code and does not use advertising identifiers. The View on eBay links in the "On eBay now" panel are eBay Partner Network affiliate links, marked as an ad in the panel, and they carry no information about you from us (Section 2(r)). It stores your session token and settings on your device until you sign out, clear the App's data or uninstall it. Any crash-reporting or diagnostic tools in the App are run by service providers acting for us and collect only the data described in Section 2(i). When RipNova is listed on Google Play, Google may also give us install statistics and crash reports from users who allow it.

Android permissions. The App asks for permission where Android requires it, and you can change permissions at any time in your phone's settings.

• Camera: to scan items, add photos (such as your profile picture or photos of the toys, non-sport cards and other items you add) and use the flashlight toggle, only while the scanner or photo screen is open. Scanning will not work without it, but the rest of the App will.
• Notifications: to send push alerts, only if you allow them (Section 2(h)).
• Location: not used. Meetups, Seen in store and Best Buy store checks use only a ZIP code you type (Section 2).
• Choosing a file: Android's file picker gives the App access only to the file you pick.
• Choosing photos: your phone's photo picker gives the App only the photos you pick, for a scan (you can pick several at once), your profile picture, or a toy, non-sport card or other item you add.
• Internet, network state and vibration: to connect to our servers, check whether you are online and give haptic feedback.

Android may also list some system-level permissions declared by software libraries bundled in the App. No RipNova feature uses them to collect data, and we do not collect audio. Before a new feature uses a new permission to collect data, we will update this policy.

Your choices on the Site. If your browser sends a Global Privacy Control (GPC) signal, the RipNova pages do not load Google Analytics. You can also block or delete cookies in your browser (the Site works without them), use Google's opt-out add-on (tools.google.com/dlpage/gaoptout) or use a content blocker.

5. How we use information

We use personal information only to:

• Provide the Services: run your account and keep you signed in; store and show your collection, binders, wishlist, portfolio values and price alerts; keep your toys, non-sport cards and other items and show the ones you choose on your profile; send the drop reminders, stock notes and Seen nearby notes you ask for; show store sightings near the ZIP code you type for Seen in store; identify scanned items; import files; match trades and deliver offers, chat, receipt confirmations and reviews; suggest public places near your ZIP code, show distance bands, and run meetup plans, reminders and check-ins; run follows, likes, the feed, profiles, showcases and wishlist sharing links; calculate reputation badges and apply blocks; and send notifications.
• Sell Nova Credits and fulfill pulls: take payment, record openings, run sell-backs, obtain and ship items, apply spend limits and breaks, handle refunds, chargebacks and claims, and check that openings follow the odds shown.
• Check eligibility: confirm age, a verified account (sign-in and phone) before purchases, and identity where the law requires, and apply any state-by-state restrictions.
• Keep RipNova safe: detect and prevent fraud, scams, counterfeits, money laundering, spam, harassment and other misuse; enforce the Terms and the Community & Trading Guidelines (/ripnova/guidelines/); pause meetups after safety reports, no-shows and late cancels; hide content, and suspend or ban accounts, that break our rules; and handle reports, appeals and disputes.
• Ask Nova: answer your Ask Nova questions. Keep it safe: we check questions and answers for harmful content, prevent abuse and apply daily limits. And review answers members report, and questions or answers our safety check flags. Our staff can read those, with the RipNova data looked up for them.
• Improve RipNova: fix bugs and measure performance, reliability and scan accuracy, using logs, diagnostics, confirmed matches and aggregated usage. We do not read your in-trade chat for this.
• Understand the Site: measure, in aggregate, which pages work and how many people download the App.
• Communicate with you: service messages such as receipts, order and shipping updates, security notices and changes to our documents; replies to your questions; and, where you have agreed, RipNova news (Section 11).
• Meet legal obligations: tax, accounting and consumer-protection rules; keeping records of what you agreed to; responding to lawful requests; and establishing or defending legal claims.

We do not use your information to build advertising profiles, and we do not use it to market other VelaVia products unless you separately agree.

Automated features. Trade matching, suggested offers, estimated values and reputation badges are produced automatically. They are suggestions and summaries, not decisions with legal or similarly significant effects. Reputation badges reflect trading history in RipNova only. They are not identity verification and do not mean we vouch for a member. Automated fraud, security and eligibility checks may block or hold a purchase or shipment. If that happens, you can ask for a person to review the decision by emailing contact@velavia.io. A person reviews an automated flag before we close an account because of it.

6. How we share information

We share personal information only as described here.

With other members and the public, because that is how RipNova works.

• Your collection. Every item not marked Never trade, including items marked Keep, is visible to other members on your profile and in lists such as "Collectors with this card", with your handle and display name. Estimated values may appear next to them. Price paid, cost basis and gain are not shown to other members or on public pages. To hide an item, mark it Never trade. Toys, non-sport cards and the other items you add work the other way round (next points).
• Your toys. Toys you add in Collection › Items are private. Other members see one only if you turn on Show on my profile for it. They then see its name, line, series and number, facts from our toy list, its condition and how many you have, and its photos only if you also turn on Show photos too. They never see what you paid or when you bought it, your estimate, your notes or whether you'd keep or trade it. Hide everything I added from my profile in Account › Settings (Hide all my toys from my profile in older versions of the App) hides your toys, non-sport cards and other items at once. Toys are not on wishlist pages or other public web pages.
• Your non-sport cards. Non-sport cards you add in Collection › Items are private too. Other members see one only if you turn on Show on my profile for it. They then see what it is (its maker, set, name or subject and number, and its year, parallel, serial number, autograph and grade where you gave them), its condition and how many you have. They never see its photos, what you paid or when you bought it, your estimate, your notes or whether you'd keep or trade it. Non-sport cards are not on wishlist pages or other public web pages.
• Your other items. The other items you add in Collection › Items (watches, sneakers, comics, coins, bags, jewelry, cars and sealed product) are private too. Other members see one only if you turn on Show on my profile for it. Then signed-in members see it on your profile, on its kind's shelf and on its own page: the brand or maker, name, series and number you typed where its kind has them, the details shown for its kind (for example a watch's year, box and papers, or a sneaker's size), its condition and how many you have. They never see what you paid or when you bought it, your estimate, your notes, whether you'd keep, trade or sell it, its photos, or a car's mileage. RipNova shows no market value for these items. They are not in trade matching, offers, wishlists, meetups, Ask Nova or Recent pulls, or on wishlist pages or other public web pages.
• Trade matching. Your wishlist and the items you flag for trade are used to match you with other members, who can see that you have items they want or want items they have.
• Match briefings. A member you are matched with can open a short summary of you made from RipNova's own records: the cards you have that they want and theirs that you want, how many trades you have finished and with how many collectors, your rating and review tags, how many collectors said you were slow to reply or that cards were not as described (only once at least two collectors have said either, and never who said it), how often you added tracking to trades you shipped, and the month you joined.
• Your profile. Other members can see your handle, display name, showcase, the collection items above, reviews you have received and your reputation badges.
• Your wishlist sharing link. Anyone with the link can open your wishlist, including people who are not members. The link is built from your handle, so anyone who knows your handle can open it. It shows your wishlist's cards and their market values, never your maximum prices or price targets. Changes in your wishlist cards' values, and your price targets, show only to you. We do not submit wishlist pages to search engines, but a search engine could list one that is linked somewhere, so treat your wishlist as public.
• The feed and follows. Your followers and other members can see your feed activity and likes, and who you follow and who follows you.
• Trades. The member you trade with sees your offers, the items involved, your in-trade chat, the carrier and tracking number you add, your receipt confirmation and your review. Reviews also appear on profiles.
• Meetups. If you turn on meetups, other members who open your profile see that you meet up to trade, and your meetup record: how many meetups you've completed and any confirmed no-shows in the past 12 months. If they have turned on meetups too, they also see a rough distance band between your ZIP area and theirs, never your ZIP, and, on your profile and in lists such as "Collectors with this card", whether the two of you can meet up right now (a Meet up button). The member you plan a meetup with sees the plan, the meetup lines in your trade's chat, and when you tap I'm here. While you can't meet up, for example while your meetups are paused, other members who meet up see only that you can't meet up right now, not why, and members who haven't turned on meetups still see that you meet up to trade. If a member's safety or age report paused your meetups, the app tells that member your meetups are paused.
• Recent pulls. Each pack and box shows signed-in members a list of its recent play-credit pulls. The list covers every pull, not only the most valuable ones, made at or after 12:00 UTC on November 9, 2026. A row shows what was pulled (for a card, its name, set, number, printing and any grade; for a box piece, its title, brand, category and size), its tier, the pack style, its estimated value and roughly when it was pulled (to the minute). A row says "A member", or "You" on your own pulls. It never shows your handle, display name, profile picture or account ID, or whether you kept or sold the pull. Another member's pull appears no sooner than one minute after it was made, and only the 20 most recent pulls of each pack or box are listed. Pulls made before October 12, 2026, and pulls by staff and sample (demo) accounts, never appear. Your pulls are included unless you turn off Show my pulls in Recent pulls in Account › Settings. Turning it off removes all of your pulls from every list at once. Turning it back on shares only pulls made from then on. If your version of the app has no such switch, update the app, or email contact@velavia.io with the subject "Recent pulls off".
• Invites. Your invite page shows your display name, handle and invite code to anyone who has the link. The member who invited you sees only how many collectors joined with their link, never who joined.
• Your store sightings. If you use Seen in store, a sighting you post shows to signed-in members 18 and over who use Seen in store and whose distance takes in the store, for about 3 hours, longer when others say it's still there: the store, the product, about how many, roughly when, whether another member confirmed it, and a tier for the poster (A member, Confirmed reporter or Trusted). It never shows your handle, your name or your ZIP code, though with few members nearby, others may guess a sighting is yours. Your votes and the stores you suggest aren't shown with your handle either. RipNova staff can see who posted a sighting or suggested a store, to review reports and check stores.

Blocking. Blocking a member ends offers, messages and follows both ways, closes pending offers, and removes each of you from the other's feed, trade matches, "Collectors with this card" lists and member search. We do not tell the blocked member, though they may notice. A member you block can't open your profile in the App, but blocking does not stop them from opening your wishlist link directly. An accepted trade stays open, with its chat, so you can finish it or cancel it and arrange returns. Blocking also cancels any live meetups between you and hides the toys, non-sport cards and other items you each show from the other. Photo links last up to about 2 days, so a toy photo they already opened can stay viewable to them for up to 2 days unless you hide the toy or its photos.

Think before you share. Valuable collections can attract theft and scams. Keep personal details such as your real name, address, phone number and email out of your handle, display name, showcase and reviews. Item photos can reveal serial numbers, license plates or where you live, so check them before you add them, and check a toy's photos again before you turn on Show photos too. Share an address or contact details only in in-trade chat with the member you are trading with, and only once you have agreed the trade. Meet only in a busy public place, never at a home: you don't need to give your address to meet up. Other people may copy or screenshot what they see, and we cannot control what they do with it.

With service providers acting for us. We use companies that process personal information on our behalf, under contracts that limit them to providing services to us. They are:

• Hosting and storage: Railway, our cloud hosting provider, which runs our servers, stores the server's data and carries the App's traffic; and an S3-compatible storage service (such as Cloudflare R2, Backblaze B2 or Amazon S3) for off-site copies of our daily backups, which are encrypted before they leave our servers so the storage service can't read them.
• AI: OpenAI, for Ask Nova and the Grading check (below).
• Payments: Stripe and PayPal (including Venmo), for payments, refunds and chargebacks (Section 3(d)).
• Sign-in and phone verification: Supabase, for email-code and Google sign-in and for phone verification, with the text-message provider it uses; and hCaptcha, a bot check before an email code is sent (Section 2(a)).
• Push notifications: Expo's push service and Google's Firebase Cloud Messaging (Section 2(h)).
• Site and email: Google, for Site analytics (Sections 4 and 7); and our CRM, email-sending and email-hosting providers.
• Advisers: professional advisers such as lawyers, accountants and auditors, under duties of confidentiality.
• Shipping: carriers (USPS today) receive the recipient's name and address on the label, and sellers and retailers we buy from receive what they need to fill an order (Section 3(b)).

AI provider. Ask Nova uses OpenAI as our service provider to write answers. When you ask a question, we send OpenAI your question and the RipNova data needed to answer it. That means catalog facts and prices and, only if you turn on Use my collection, facts from your collection and wishlist (card names, printings, conditions, counts and estimated values). We don't add your name, handle, profile picture, bio, what you paid, your wishlist price limits, your chats or offers, or anything about other members, though anything you type into a question is sent as you wrote it. Ask Nova can't see your toys, non-sport cards or other items you add, or their photos, estimates or notes, so none of them is sent. Each request carries a coded identifier made from your account, not your name or handle, so abuse can be stopped for one account. OpenAI processes this data for us under its data processing terms and doesn't use it to train its models. We ask it not to store the conversation. It may keep the data for up to 30 days to check for abuse, then deletes it. The Grading check sends your card photos to OpenAI the same way (Section 2(d)).

Independent providers. Your browser contacts Google to load web fonts, and your device may contact third-party image hosts to load item images (Sections 2 and 4). Payment processors and carriers may also use some information as independent businesses where the law requires it, for example to meet anti-fraud or financial-crime rules. When RipNova is listed on Google Play, Google processes installs and account information as the operator of Google Play, under its own terms. If you check Best Buy stores near a ZIP code, Best Buy receives that ZIP to answer the check, under its own terms (Section 2(q)); otherwise Best Buy's API receives only product numbers, no member data. Card data and images come from public card databases and marketplaces (such as TCGdex, TCGplayer, Scryfall and YGOPRODeck); we send them no member data. If you use the "On eBay now" panel, eBay receives your device's IP address when the listings' photos load, and what you do on eBay after View on eBay is between you and eBay, under eBay's own terms and privacy notice (Section 2(r)).

Moderation and disputes. Our automated tools and authorized VelaVia staff may review in-trade chat, trade and order records, meetup plans and what happened at a meetup, reviews, profiles, showcases, toys, non-sport cards and other items you show on your profile, feed content and reports about them, to prevent fraud, counterfeits and abuse, enforce our rules and resolve disputes. For example:

• Our automated tools check the other member's messages in a trade chat for common scam patterns, such as asking for a code or a gift card, posing as RipNova staff or asking you to send your cards first, and show a note beside such a message to you alone, with a few lines about the other member, such as that they joined less than 30 days ago or have no finished trade yet. RipNova does this check itself: your messages are not sent to an AI provider for it, and the notes are not stored.
• A trade chat message that looks like a home address is kept but shown with a warning to meet only in public places.
• If three members whose accounts are at least 7 days old report a toy, non-sport card or other item you show, it is hidden from other members until we review it, and our staff can remove a reported toy's photos. Our staff's report tools show a toy's photos only if you showed them.
• A meetup report that says a member was threatening or unsafe, or seems under 18, on a meetup that had been confirmed, cancels that member's live meetups and pauses their meetups until our staff review it (unless that member had already blocked the reporter). This happens at once, before anyone at RipNova has looked at the report: it protects members while we look, and is not a finding that they did anything wrong.
• Two confirmed no-shows within 90 days pause a member's meetups for 30 days, and a fifth late cancel (under 2 hours before the start) within 30 days pauses them for 14 days.
• Our staff also see "not OK" answers to Everything OK? and meetups cancelled because a member didn't feel safe.

Staff actions and appeals. If an account breaks our rules, RipNova staff can hide what it posted, or suspend or ban it. If an account is banned, other members no longer see it, and a member with a trade in progress with it is told it can't trade on RipNova any more. We keep reports, staff notes and decisions about an account while it exists and for up to 24 months after it's deleted. You can appeal a decision once in the App, under Account › Account status, or by email to contact@velavia.io. An appeal you send in the App is kept with the restriction it's about and deleted when that ends or is lifted; staff's decision is kept with the staff records. Staff can also send you a warning notice in your RipNova inbox, which restricts nothing.

Signing an account out. If staff sign an account out on every phone, we keep a one-way hash of its old key and the time it ended for 180 days, with nothing that names the account, so a phone that still holds that key is told it was signed out. Then we delete it.

We may share relevant records with the other party to a dispute, and with payment processors or carriers to resolve a chargeback, claim or delivery problem.

Legal and safety. With courts, regulators, law enforcement or others when we believe in good faith that the law, a subpoena or a court order requires it, or that disclosure is needed to protect the rights, property or safety of members, the public or VelaVia.

Business transfers. With a buyer, successor or financing party and its advisers in a merger, acquisition, financing, reorganization or sale of all or part of VelaVia or RipNova. The recipient must honor this policy for information collected under it, and we will notify you before your information becomes subject to a materially different policy.

With your direction or consent. Any other sharing you ask for or agree to.

We do not sell or give member data to brands, grading companies, price sources, marketplaces or other collection apps. On request, we will give you a list of the specific third parties to which we have disclosed your personal information (Section 12).

7. Sale, sharing and Global Privacy Control

App data is not sold or shared. We do not sell personal information collected through the App, purchases, email sign-ups or messages you send us. We do not share it for cross-context behavioral advertising, as California law uses that term, or process it for targeted advertising, as other state laws use that term.

Ask Nova. We don't sell Ask Nova data or share it for advertising. OpenAI receives it only as our service provider.

Site analytics may count as a sale or sharing. As Section 4 explains, the RipNova pages send analytics data (the Google Analytics cookie ID, pages viewed and events, device and browser details, and approximate location) to a Google Analytics property shared with VelaVia pages that use advertising tags, and Google may use it for its own purposes. We receive no money for it, but we treat it as a possible "sale" or "sharing" under California law, and as possible targeted advertising under other state laws. You can opt out at any time:

• Global Privacy Control. We treat a GPC signal as a valid opt-out of sale, sharing and targeted advertising. If your browser sends one, the RipNova pages do not load Google Analytics. The opt-out applies to that browser.
• "Do Not Sell or Share My Personal Information." The footer of each RipNova page links to this section.
• Browser controls. Block or delete cookies, use Google's opt-out add-on or use a content blocker (Section 4).
• By email. Email contact@velavia.io to have an opt-out recorded against your email address or account. Because we do not link Site analytics to your account, GPC or browser controls are what stop analytics from your browser.

We do not knowingly sell or share the personal information of anyone under 16, and RipNova is not for anyone under 18.

Disclosures to service providers acting for us, information you choose to make visible to other members, and request data your device sends directly to Google Fonts or image hosts to display text and images are not sales or sharing.

Do Not Track. There is no common standard for browser Do Not Track signals, so we do not respond to them differently. We do not track you across other companies' websites or apps.

Changes to these practices. Before we begin any other sale, sharing or targeted advertising, we will update this policy and provide opt-out controls first. People who have opted out will stay opted out.

California "Shine the Light" and Nevada. We do not disclose personal information to third parties for their own direct-marketing purposes, and we do not sell covered information as Nevada law defines it.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in Section 5. The periods below are maximums. We apply them through regular deletion routines, so an item may remain for a short time (generally no more than 90 days) after its period ends. Account deletion requests follow the timing in Section 13.

• Account and profile data: while your account exists.
• Session tokens: until you sign out, the token expires or your account is deleted. A token stops working after 180 days without use.
• Age confirmations, Terms acceptance records and arbitration opt-out notices: while your account exists, then only as long as needed to show what you agreed to, generally no more than 4 years after your account is deleted, or longer while a dispute is open. Your 18+ confirmation and Terms acceptance record stay with the trade records, reports and staff notes we keep after you delete your account, and are deleted when they are; if none are kept, they are deleted with your account. With what we keep after you delete your account, we keep a scrambled marker of your old handle, so we can still find those records if we learn the account belonged to someone under 18; it goes with them.
• Collection, binders, wishlist (with its price targets), price alerts, showcase, item photos and portfolio history: until you delete them or your account is deleted.
• Toys, non-sport cards and other items you add: each one, with its photos, notes, what you paid and its estimate history, until you remove it or delete your account. Removing a photo or an item deletes its photo files from our storage.
• Wishlist start values: until you remove the card from your wishlist or delete your account. We may also clear every start value at once, for example when a price source changes.
• Meetups: your ZIP code while meetups are on. When you turn meetups off, we stop using it for places and distances at once and delete it within 7 days: straight away, or, if you set it in the last 7 days, when those 7 days are up. Until then it is kept only so the 7-day limit on changing your ZIP still applies if you turn meetups back on. Your 18+ confirmation, the safety-tips version and any pause stay with your account. Meetup plans, their history, check-in times and answers are trade records (below).
• Scan photos: not kept after identification, unless you save a photo to an item. Records of which match you confirmed, without the photo, are kept for up to 12 months.
• Imported files: not kept. Only the resulting collection items are kept.
• Trade records (offers, counter-offers, receipt confirmations, in-trade chat, meetup plans with their history, check-in times and answers, reviews and logged trades that name another member): while both members' accounts exist. If either of you deletes your account, we keep them for up to 24 months after the trade closes, to handle disputes, fraud and safety reports, and then delete them. During that time the other member can still see the trade, and reviews about you may be kept as part of it. Contact details shared in chat are deleted with the chat.
• Tracking numbers you add to a trade: kept with that trade's records, and deleted when you delete your account, even if the rest of the trade's records are kept (above), or when the trade's records are deleted, if that comes first. If we find that an account belongs to someone under 18, its tracking numbers are deleted with the rest of its information (Section 10).
• Drops: the products you watch and your drop alert settings, until you stop watching or change them, or delete your account; the record of the drop alerts we sent, up to 30 days; Best Buy stock notes and their records, deleted within 72 hours; daily store-check counts, up to 3 days. A ZIP typed for a Best Buy store check is held only in memory, for up to 10 minutes.
• Seen in store: your sightings, votes and store suggestions are linked to your account for 30 days, then kept with nothing that links them to you. Reports about a sighting, and staff decisions about it, keep who posted it for as long as reports and staff notes are kept (below). The counts of your confirmed and false sightings stay while your account exists. Your ZIP code and distance stay until you remove them or delete your account, and are deleted within 7 days after Seen in store is turned off for your account. Seen nearby notes are notifications (below).
• Reports, staff notes and decisions about an account: while it exists and for up to 24 months after it's deleted (for an account that belongs to someone under 18, see Section 10).
• Appeals you send in the App: kept with the restriction they're about, and deleted when it ends or is lifted; staff's decision is kept with the staff records.
• Signed-out keys: 180 days after the sign-out, then deleted.
• Follows, likes, feed activity and blocks: until you remove them or your account is deleted. Badges and trade matches are recalculated as trades and collections change, and are deleted with your account.
• Notifications: up to 12 months.
• Nova Credits Shop financial records (orders, payments, Nova Credit pulls, sell-backs, ship-fee orders, parcels and their fulfilment, disputes, limits): kept as financial records for as long as we need them for tax, accounting, fraud-prevention, claims and dispute purposes and as the law requires. When you delete your account, they are unlinked from you: moved onto a random identifier that nothing links back to your account.
• A parcel's copy of its shipping address: in full until 90 days after the parcel is delivered, returned or cancelled (or until you delete your account, if sooner); then only the city, state and ZIP code; deleted 7 years after the shipping request.
• Sign-in and phone records: your sign-in emails and Google identifiers, and your confirmed phone number's hash, while your account exists; deleted with your account. For a banned account that is deleted, a scrambled form of its sign-in identifiers is kept for up to 24 months so it can't sign up again.
• Grading check photos: not stored. Only the number of checks per day is kept.
• Play-credit rip records: while your account exists. When your account is deleted, we delete everything that links them to you and keep the records themselves without anything that identifies you, as a record of how the packs and boxes performed (for example, to check that rips follow the published odds). For each rip, that is the pack or box, its style, the odds and values it was opened under, the tier, what was pulled and its estimated value, its price in play credits, and whether it was kept, sold back or left until its sell-back window closed; each time play credits were added or spent, the amount and the balance after; and each Daily or Welcome claim and ship request; all with the date and time. These records hold no handle, account ID, name, email address, IP address or device details, and nothing we keep links them back to you. We keep them with no set end date.
• Recent pulls: nothing is stored apart from the rip record. A pull leaves the list when 20 newer pulls of that pack or box are listed, when you turn sharing off, or when your account is deleted. A list another member already has open can still show it until they refresh.
• Invites: your invite code and its view count while your account exists; the record of who invited you while both accounts exist. Deleting either account deletes it.
• Ask Nova: questions and answers, and the data looked up for them, are kept for 30 days and then deleted. An answer you report, and a question or answer our safety checks send to staff for review (for example a question that says you are under 18), is kept until we finish reviewing it, and no longer than 90 days. Questions or answers our safety check flags are kept for 30 days even if you clear your history, and an answer you reported is kept until it is reviewed; clearing hides them from you at once. Daily question counts are kept for 40 days. Totals with no personal data, such as questions and cost per day, are kept longer.
• Saved shipping addresses: until you delete them or your account is deleted.
• Your collection tools (sales you record, grading submissions, sealed products, openings, custom cards and slab photos, and the figures calculated from them, such as pull luck, set completion and the trade scorecard): until you delete them or your account is deleted.
• Push tokens and notification settings: until you turn push off, the token stops working, or your account is deleted.
• App server logs and diagnostics: up to 90 days. Fraud and security records are kept as long as needed to investigate and prevent the misuse involved.
• Site and download server logs: up to 90 days.
• Google Analytics event data: up to 14 months. Aggregated reports that do not identify you may be kept longer.
• Email sign-up records: until you unsubscribe or ask us to delete them, and no later than October 3, 2028. If your CRM contact record exists only because of the sign-up, we delete the whole record; any other VelaVia relationship is handled under the VelaVia Privacy Policy. Email delivery and engagement data is deleted with the record.
• Do-not-email list: when you unsubscribe or ask for deletion, we keep only your email address (hashed where our provider supports it) so we never email you again, for as long as we send RipNova email.
• Messages you send us: up to 24 months after the matter is closed.
• Privacy-request records: 24 months after the request is closed, to show compliance.

After deletion, copies may remain in backups until they are deleted: our daily database backups (and their encrypted off-site copies) are kept for 14 days, and any other backup for no more than 90 days. We use backups only for disaster recovery. We may keep information longer only where the law requires it, or where it is needed to establish, exercise or defend legal claims, such as an open dispute or fraud investigation. Once that need ends, we delete it.

9. Security and getting the App safely

We use administrative, technical and physical safeguards designed to protect personal information, including:

• encryption in transit (HTTPS/TLS) for the Site, App downloads and every connection the App makes to our servers;
• sign-in keys and phone numbers stored only in hashed form, and sign-in emails stored with a scrambled lookup form; RipNova does not use passwords;
• payment details handled in our payment processors' secure systems, not on our servers;
• access to member, order and shipping data limited to VelaVia personnel and service providers who need it;
• server credentials kept on our servers, not in web pages or the App; and
• collecting no more data than we need.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you find a security flaw, please report it to contact@velavia.io. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Get RipNova only from velavia.io. The Android App is a direct download from the "Download for Android" button on https://velavia.io/ripnova/, installed outside Google Play.

• Install RipNova only from velavia.io. A copy from any other site, file-sharing service or message may have been modified to steal your data or payment details.
• Any App link we email you points to a page on https://velavia.io/ripnova/. We never send app files as email attachments.
• Where the Site shows a SHA-256 fingerprint for the download, check that your file matches it.
• Keep the App updated from velavia.io. Older copies may lack current security protections.
• Consider turning off your phone's permission to install unknown apps once RipNova is installed.

We are not responsible for copies of the App obtained anywhere else, or for copies modified to connect to servers we do not run.

Phishing. We will never ask you to send a password, full card number, bank details or ID image by email, text, phone, direct message or in-trade chat. Enter payment details only on the checkout page the App opens. Report suspicious messages or copies of the App to contact@velavia.io.

Your device. Anyone with your unlocked phone may be able to use your account and make purchases. Use a screen lock, and sign out or contact us if you lose your device or think someone else has used your account.

Trading safely. For trades members ship to each other, RipNova does not ship, inspect, insure or guarantee the items. Confirm receipt in the App only once items have actually arrived, and share addresses only as Section 6 describes.

10. Children and age requirements

RipNova is only for people who are 18 or older, or the age of majority where you live if that is higher. The Site and the App are designed for adult collectors and are not directed to children. Nova Credits can be bought only by adults 18 or older, only where permitted by law, and need a verified account (Section 2(a)).

• The Site tells visitors that RipNova is for people 18 and older before they download it.
• The App asks everyone to confirm they are 18 or older, and to accept the Terms, before it creates an account.
• We may ask for proof of age before a purchase, opening or high-value shipment.

We do not knowingly collect personal information from anyone under 18, including children under 13. If we learn that someone under 18 has created an account or given us information, we will close the account, cancel pending orders where we can, delete their information within 30 days of confirming it (except records the law requires us to keep), and not contact them further. Other members keep their trade records with the account, de-identified. Of the account itself we keep only a scrambled marker of its handle, where we still know it, so it can't be used to sign up again, and reports other members made about it, without anything the account wrote or showed. Its play-credit rip records are kept without anything that identifies anyone, as Section 8 describes. If the account was deleted before we confirmed it, we keep that marker only until we decide. If you believe a minor has given us information, email contact@velavia.io. You do not need to prove it.

If a question to Ask Nova says you are under 18, Ask Nova turns off for your account and our staff review the account. Your meetups are also paused, any live meetups are cancelled, and other features for adults only stay closed, until our staff turn Ask Nova back on for you. Meetups are only for members 18 and over, and a member can report a meetup partner who seems under 18 (Section 6).

When the App is listed in an app store, we will answer the store's content-rating questions accurately and restrict the App to adults where the store allows.

11. Emails, notifications and your choices

• Service messages. We send account, security, purchase, order, shipping and sell-back messages, and notices about changes to our documents, by email (where we have your address) and in the App. These are part of how RipNova works, so you cannot opt out of them while you have an account.
• RipNova news and offers. We send marketing email only to people who signed up for it or otherwise agreed. Every marketing email has an unsubscribe link and our postal address. We process unsubscribes within 10 business days, usually much faster. You can also unsubscribe by emailing contact@velavia.io from the address on our list.
• Email measurement. Our email provider may record whether an email was delivered or opened and which links were clicked, using a small image and tracked links. You can stop open tracking by turning off automatic image loading, or ask us to turn off tracking for your address.
• Push notifications. Sent only if you allow them. You can turn them off in the App's settings or your phone's settings.
• Recent pulls. Turn Show my pulls in Recent pulls on or off in Account › Settings. The choice is saved to your account.
• Toys, non-sport cards and other items. Each toy, non-sport card and other item you add has Show on my profile, and each toy, under it, Show photos too. They are off until you turn them on. Hide everything I added from my profile (Hide all my toys from my profile in older versions of the App) is in Account › Settings, and hides your toys, non-sport cards and other items at once. Count my estimates in my total (off until you turn it on) adds your own estimates to your total, labelled as yours; nobody else sees your total.
• Meetups. Turn meetups on or off in Account › Meetups. When you turn them off, we stop using your ZIP code for places and distances and delete it within 7 days (Section 8).
• Drops. Turn Drop alerts on or off in Drops, and stop watching a product at any time. Where Drops shows Best Buy stock, each product you watch has its own switch for stock notes.
• Ask Nova. Ask Nova is optional and stays off until you agree to its notice. In Ask Nova's settings (the ⋯ button) you can turn Use my collection on or off, clear your question history, or turn Ask Nova off. Turning it off stops all sending to OpenAI; your history is deleted after 30 days, or clear it first.
• Text messages. We do not send marketing texts. A text with a one-time code is sent only when you ask for it, to confirm your mobile number. Before we send any other texts, other than carrier delivery updates, we will ask for your separate, express consent. That consent will never be a condition of purchase, and every text will include STOP and HELP instructions.

12. Your privacy rights

Whether or not a privacy law applies to you, we honor these requests from anyone, free of charge:

• Know and access: what personal information we hold about you, where it came from, why we use it and who we share it with, and a copy in a portable format. On request, we will also list the specific third parties, not just categories, to which we have disclosed it.
• Correct: fix inaccurate information. You can edit most collection, wishlist, profile and address details directly in the App.
• Delete: delete items, toys, non-sport cards and other items you add and their photos, binders, wishlist entries, alerts, follows, likes, blocks and saved addresses in the App, turn off meetups to delete your ZIP code, or ask us to delete your account or other information (Section 13).
• Opt out: of marketing email at any time, and of sale, sharing and targeted advertising, including through Global Privacy Control (Section 7).
• Withdraw consent: where we rely on consent, such as camera, location or notification permissions or a biometric check, at any time. This does not affect what happened before, and some features need it to work.
• Appeal: ask us to reconsider if we decline your request.
• Non-discrimination: we will not deny you service, charge you a different price or give you a different level of quality because you used a privacy right.

How to make a request. Email contact@velavia.io with "Privacy request" in the subject line and tell us what you would like. For App data, include your RipNova handle. You can also write to VelaVia LLC, Attn: Privacy, 2108 N St Ste N, Sacramento, CA 95816, USA. RipNova operates online, so email is our main channel for requests.

Verification. We ask only for what we need to match your request to our records, and use it only for verification. We may confirm the request through the email address on your account or on our records, ask for details only the account holder is likely to know (such as items in your collection or a recent order), or ask you to confirm the request inside the App. We will not ask for a government ID just to handle a privacy request.

Authorized agents. You may use an authorized agent. We may ask the agent for your signed permission and ask you to confirm the request directly, unless the agent holds a valid power of attorney.

Timing. We acknowledge requests within 10 business days and respond within 45 calendar days. If we need more time, we may extend this once by up to 45 more days and will tell you why.

Appeals. If we deny a request in whole or in part, we will explain why. You can appeal by replying with "Privacy appeal" in the subject line within 60 days of our decision. We decide appeals within 45 days and explain the outcome. If you are not satisfied, you may contact your state Attorney General.

13. How to delete your account

You can delete your RipNova account at any time, and you do not need the App installed to do it.

• In the App: Account › Settings › Delete account shows what is deleted and what is kept. Type your @handle and tap Delete my account, and the account is deleted straight away.
• By email: email contact@velavia.io with "Delete my RipNova account" in the subject line and your RipNova handle. We verify the request as described in Section 12.

When the App can't delete it yet. The App refuses while a trade is in progress (finish or cancel it first), while a trade you confirmed is waiting for the other member to confirm receipt, and for 30 days after a trade was cancelled after cards arrived (cards may need sending back); in the last two cases you can email us to delete it now. If the App can't delete an account for another reason, it says so, and you can delete it by email.

Nova Credits and pulls. Before you delete, use your Nova Credits and ask us to ship any Nova Credit pulls you want. If your account still has purchased Nova Credits or unshipped Nova Credit pulls, email us first and we will help. Deleting your account ends your access to any credits and pulls left on it.

These instructions are always available at https://velavia.io/ripnova/privacy/#13-how-to-delete-your-account

By email, we delete your account within 30 days of verifying your request. If you have open orders or parcels on the way, we will contact you first about them under the Terms (/ripnova/terms/).

When your account is deleted, your profile, collection, wishlist and wishlist link stop being shown, and we delete your account data, except:

• trade records kept for up to 24 months for disputes and safety (Section 8);
• Nova Credits Shop financial records (orders, payments, Nova Credit pulls, ship-fee orders and parcels), kept as financial records and unlinked from your account; each parcel's address copy minimized to city, state and ZIP and deleted 7 years after the request (Section 8);
• reports, staff notes and decisions about your account, for up to 24 months (Section 8);
• play-credit rip records, kept without anything that identifies you (Section 8);
• age confirmations, Terms acceptance records and arbitration opt-out notices;
• fraud and security records;
• the do-not-email record that stops us emailing you again;
• for a banned account, a scrambled form of its sign-in identifiers, for up to 24 months; and
• copies in backups, for up to 90 days (Section 8).

Deleting your account also deletes your saved shipping addresses, your sign-in emails and Google sign-ins and your account at our sign-in provider, your confirmed phone number's hash, your push tokens, your collection tools (sales, grading submissions, sealed products, openings, custom cards and slab photos), your Ask Nova questions, answers, reports and settings, your toys, non-sport cards and other items with their photos, estimates and notes, the words of any appeal you sent in the App, your wishlist start values and price targets, the tracking numbers you added to your trades, your meetup settings and ZIP code, and the products you watch on Drops, your drop alert settings and the drop alerts we sent, and, if you used Seen in store, your sightings, votes and store suggestions still linked to your account, your sighting counts and your Seen in store ZIP code. Reports about your sightings are kept as Section 8 describes. Meetup plans on your trades are trade records, kept as Section 8 describes, and your 18+ confirmation and Terms acceptance record stay with whatever trade records, reports and staff notes are kept, then go with them; if none are kept, they are deleted with your account.

Copies in backups are deleted within 90 days. You can also ask us to delete specific information without closing your account, such as feed activity, messages, reviews or notifications that the App does not let you remove.

14. California notice at collection

We give this notice to California residents whether or not the California Consumer Privacy Act (as amended by the CPRA) applies to us. It covers what we collect through the Site, the App, purchases and email sign-ups, and what we collected in the 12 months before the effective date. Sources, purposes and recipients are described in Sections 2 to 6, and retention in Section 8. "Sold or shared" below uses the meanings in California law.

• Identifiers: handle, display name, account ID, email address (sign-in and email sign-ups), hashed sign-in keys and phone number, push tokens, IP address and Google Analytics cookie ID. Disclosed to hosting, email, CRM, sign-in, payment, shipping, verification, security and push providers as needed. Sold or shared: only the Google Analytics cookie ID and IP-derived data from Site visits, with Google (Section 7).
• Customer records: name, shipping address and optional phone number, email address, and payment references. Disclosed to payment processors, carriers and sellers filling an order. Not sold or shared.
• Commercial information: collection items and price paid; toys, non-sport cards and other items you add, what you paid for them and your own estimates; wishlists, their start values and alerts; the products you watch on Drops; trades; sales you record, grading submissions and sealed products you track; Nova Credits purchases, openings, items pulled, sell-backs, shipping requests, spend limits and breaks; play-credit rips; invite records (who invited you). Disclosed to hosting, payment and shipping providers. Play-credit rips are disclosed to other members, without your name, in Recent pulls. Invite records are visible to the inviter only as a count. Collection and wishlist facts go to OpenAI, as our service provider, only when you turn on Use my collection in Ask Nova. Not sold or shared.
• Financial information (limited): payment IDs, amounts and status, refunds and disputes, and a hashed card fingerprint or PayPal payer ID. We do not receive full card or bank account numbers. Disclosed to payment processors and our tax and accounting advisers. Not sold or shared.
• Internet or network activity: App logs and diagnostics, feature use, fraud and security signals, follows, likes, feed activity, notifications, Site pages viewed and events, and email engagement. Disclosed to hosting, diagnostics, security and email providers and to Google (Site analytics). Sold or shared: only Site pages and events, with Google (Section 7).
• Geolocation data: approximate location from your IP address; if you turn on meetups, the ZIP code you type, used only for nearby places and rough distance bands and never shown to other members; a ZIP code you type for a Best Buy store check, sent to Best Buy and held only in memory, for up to 10 minutes; if you use Seen in store, the ZIP code and distance you type, used only to find stores and sightings near you and for Seen nearby notes, and never shown to other members; no precise location. Disclosed to hosting and fraud-prevention providers (the meetup and Seen in store ZIP codes only to hosting providers; a store-check ZIP only to Best Buy), and approximate location to Google (Site analytics). Sold or shared: only approximate location from Site visits, with Google (Section 7).
• Audio, electronic, visual or similar information: scan photos, item photos (including photos of toys, non-sport cards and other items), graded-slab and custom-card photos, and Grading check photos (sent to OpenAI, not stored). No audio. Disclosed to hosting and backup-storage providers and OpenAI. Not sold or shared.
• Biometric information: not collected (Section 3(e)).
• Characteristics of protected classifications: age confirmation (that you are 18 or older, and when you confirmed it). We do not collect your date of birth. Disclosed to hosting providers. Not sold or shared.
• Inferences: trade matches, suggested offers, reputation badges, meetup distance bands, meetup records and pauses, Seen in store reporter tiers and pauses, and fraud-risk signals. Disclosed to hosting and fraud-prevention providers; matches and badges are shown to members as Section 6 describes. Not sold or shared.
• Communications and user content: in-trade chat, meetup plans and place notes, check-in times and answers, the names, details and notes of toys, non-sport cards and other items, appeals you send in the App, reviews, showcases, Seen in store sightings, votes and store suggestions, and messages you send us. Disclosed to hosting and email providers; sightings are shown to other members without your name (Section 6). Not sold or shared.
• Ask Nova questions and answers (user-generated content): collected from you, used to provide the service and for security, and disclosed to OpenAI as a service provider. Not sold or shared.

We do not collect professional, employment or education information.

Third parties to whom personal information may be sold or shared: Google, for Site analytics only (Section 7).

Sensitive personal information. We collect these kinds of sensitive personal information:

• account log-in credentials (hashed sign-in keys);
• a payment-card fingerprint or PayPal payer ID, kept only as a hash (Section 3(d)); and
• the contents of in-trade chat, where VelaVia is not the intended recipient.

We use and disclose sensitive personal information only for purposes California law permits, such as providing the Services you request, checking eligibility, preventing fraud, keeping RipNova secure and meeting legal obligations. We do not use it to infer characteristics about you, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" link.

Your rights and how to use them are in Section 12. How to opt out of sale and sharing is in Section 7.

15. Other U.S. state privacy rights

Residents of states with comprehensive consumer privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, may have the right to confirm whether we process their data; to access, correct, delete and port it; to get a list of the specific third parties we have disclosed it to; and to opt out of sale, targeted advertising and profiling that produces legal or similarly significant effects.

We do not sell App data or process it for targeted advertising. Site analytics from the RipNova pages may count as a sale or targeted advertising under some state laws, and we honor opt-outs for it, including GPC (Section 7). Where a state law treats data such as precise location, biometric data or government ID as sensitive, we process it only with the consent or notice that law requires. You can ask for a person to review an automated fraud, security or eligibility decision (Section 5). We honor these rights for everyone through the process in Section 12, including appeals. If we deny your appeal, you may contact your state Attorney General.

16. Visitors outside the United States

RipNova is offered only in the United States, and we do not market it in the European Economic Area, the United Kingdom or Switzerland. The Site does not show a cookie banner; if we begin offering RipNova outside the United States, we will first add any consent controls the law there requires. Wherever you are, you can prevent Site analytics using the controls in Section 4.

VelaVia is based in the United States and runs the Services from there. If you use the Services from elsewhere, your information is sent to and processed in the United States, which may not offer the same protection as your home country. Our service providers may also process information in other countries where they or their subprocessors operate. Where required, we rely on safeguards such as the EU-U.S. Data Privacy Framework, its UK Extension, the Swiss-U.S. Data Privacy Framework or standard contractual clauses.

If the GDPR, UK GDPR or Swiss data-protection law nonetheless applies:

• Legal bases. We rely on contract (to provide the Services and fulfill purchases), consent (marketing email, device permissions and biometric checks), legitimate interests (analytics, security, fraud prevention, moderation, badges and email measurement, balanced against your rights), legal obligation (tax, accounting and verification rules) and the establishment, exercise or defense of legal claims.
• Your rights. You can access, rectify, erase, restrict and port your data, object to processing based on legitimate interests, withdraw consent at any time, and not be subject to decisions based solely on automated processing that significantly affect you without the safeguards the law requires. Use the process in Section 12. We respond within one month, extendable by up to two further months for complex requests.
• Complaints. You may complain to your data-protection authority, such as the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.

17. Changes to this policy

We will update this policy when our practices change. The dates at the top show when the current version took effect, and it replaces all earlier versions of the RipNova Privacy Policy.

• Non-material changes, such as clarifications, formatting and contact corrections, take effect when posted.
• Material changes to how we handle information we already hold about you take effect no sooner than 30 days after we notify you by email (where we have your address), by in-app notice and on the Site, unless the law requires an earlier date or you opt in sooner in the App.
• New features may come with changes that apply only to that feature. They take effect for you when you accept them in the App or start using the feature, and they do not change how we handle information we already hold about you.
• Going forward only. Where the law requires it, we will not use information collected under an earlier version in a materially different way without your consent.
• If you disagree, you can stop using RipNova, unsubscribe, or ask us to delete your account or information (Sections 12 and 13).

18. Contact us

For questions about this policy or our privacy practices, or to make a request, contact VelaVia LLC (RipNova), 2108 N St Ste N, Sacramento, CA 95816, USA. Email: contact@velavia.io. Website: https://velavia.io/ripnova/

Official sources of the App. The Android App is available only as a direct download from https://velavia.io/ripnova/. A Google Play listing will follow, and an iPhone app is planned; we will list each official store here when it is available. contact@velavia.io is our mailbox for RipNova questions and privacy requests, and RipNova emails come from a velavia.io address. Be cautious of messages about RipNova from any other address, and of RipNova app files from any other source.

Trademarks. RipNova is not affiliated with, endorsed, sponsored or approved by Nintendo, The Pokémon Company, Creatures or GAME FREAK. Nor is it affiliated with Wizards of the Coast or Hasbro (Magic: The Gathering) or Konami (Yu-Gi-Oh!). Pokémon, Magic: The Gathering, Yu-Gi-Oh! and card names are trademarks of their respective owners. RipNova and VelaVia LLC are also not affiliated with, sponsored by or endorsed by any brand, manufacturer, grading company, marketplace or price source whose names or items appear on the Site or in the App. Those names are trademarks of their respective owners.