Privacy Policy
Last updated: October 28, 2026
This policy explains what AKDARRAH LLC ("we"), an Indiana limited liability company that operates RarityDB, collects when you use it, why, who else sees it, and the choices you have. There are no ads and no third-party analytics or tracking.
What we collect
| What | When | Why |
|---|---|---|
| Your email address | You sign in | To send sign-in links and run your account |
| Sign-in sessions: IP address and browser type | You sign in on the website | To keep you signed in and spot misuse |
| API keys | You create one | To authenticate requests. Stored only as a one-way hash; the key itself is shown to you once |
| Usage counts per day, per key or connected app | You call the API | To apply your plan's limits and, later, for billing |
| Apps you connect (such as ChatGPT or Claude) | You approve a connection | To let them use the API for you, until you disconnect them |
| Studio photos and their results | You upload in the Studio | To show you the result and keep your history |
| Corrections ("this is wrong"), feedback on a fake check, and whether you let us keep the photo | You give them | To test and improve accuracy. A photo is kept for that only if you tick "Let RarityDB keep this photo to improve accuracy" (at upload or with a correction) |
| Webhook URLs, price alerts and webhook deliveries | You set them up | To send your alerts and show you whether they arrived |
| Pullbook records: purchases, inventory, sales, events and notes, including buyer names and order numbers from your sales, and the sales export files you upload | You add or import them | To track your costs, inventory and profit for you |
| Server logs: IP address, time and the page or API call | Any request | To keep the service running and secure |
Photos sent through the API (identify, condition, fake check) are processed and then discarded. We don't keep them, and they aren't written to our logs.
Who else sees it
We use these providers to run the service. Each gets only what it needs:
- Anthropic (Claude): analyses card photos for identification, condition and fake checks. Photos are sent through Anthropic's commercial API.
- Cloudflare (R2 storage): stores Studio photos and uploaded sales exports in a private bucket. They're served only to you (Studio photos also to people with your share link).
- Resend: sends sign-in emails.
- DigitalOcean: hosts the servers and database.
When you look at a card or sealed product page, some product photos load directly from TCGplayer's image servers, and some card images may load from the card data sources' servers (such as TCGdex). Your browser contacts them, so they see your IP address, but not which page you were on.
If you pass your own key for a price provider (such as JustTCG or PokemonPriceTracker), your request and key go to that provider to fetch the prices. We don't store the key.
We don't sell personal information or share it for advertising. We'll disclose information if the law requires it.
What's public
- Studio results are private by default. If you share one, anyone with the link can see the photo and result, and it can appear on the Community page. Shared pages aren't indexed by search engines. Unsharing or deleting removes them.
- The card catalog and docs are public.
In your browser
- One cookie keeps you signed in. It's needed for the site to work, so there's no cookie banner.
- Your browser's local storage keeps your light or dark choice and, if you paste one into the API Explorer, your API key. Neither is sent anywhere except when you make a request.
How long we keep it
- Account information, keys, connected apps, alerts, Pullbook records and usage counts: while your account exists.
- Studio photos and results: until you delete them or your account. Photos you let us keep to improve accuracy are copied into our private test set; ask us to remove one at any time.
- Sign-in sessions: until you sign out.
- Server logs: up to 30 days.
Your choices and rights
- Delete any Studio result (and its photo) from the Studio, revoke API keys and disconnect apps from your account page, and delete alerts and webhooks through the API, CLI or MCP.
- To get a copy of your data, correct it, or delete your account and everything in it, email hello@akdarrah.com. We'll do it within 30 days.
- Depending on where you live (for example the EU, UK or California), you may have further rights, such as to object to processing or to complain to a data protection authority.
Security
Connections use HTTPS. API keys are stored hashed. Studio photos sit in a private bucket. Webhook signing secrets are derived when needed, never stored. No system is perfectly secure; if we learn of a breach affecting you, we'll tell you.
Children
The service isn't directed at children under 13, and they shouldn't create accounts. If you think a child has given us information, email hello@akdarrah.com and we'll delete it.
Changes
We'll post updates here with a new date, and email account holders about significant changes before they apply.
Contact
AKDARRAH LLC, Carmel, Indiana, hello@akdarrah.com.