At a glance
RareFoil Society is a collectibles website/project—not a separately established business—that is intended to be owned and operated by the registered business VaultedCoven LLC. Registered website members can organize Pokémon cards, upload images, record values, take part in Twin Vault experiences and explore optional game features. This draft describes practices visible in the current platform code. It does not replace a verified operational privacy review.
Information we use
- Account: username, display name, a salted password hash, account role, session identifiers and security/recovery state.
- Collection: titles, conditions, notes, quantity, grades, uploaded card photos, collection grouping, purchase costs, estimated values, sales and transaction notes you choose to record.
- Membership: initiation and invitation status, approved permissions, Council records, appeals and relevant audit entries.
- Operations: timestamps, request/rate-limit information and error diagnostics necessary to operate and defend the service. Web hosting may receive ordinary connection metadata such as IP addresses and browser information.
Some optional experiences, such as Twin Coins and TwinVerse, may maintain separate account, progress or inventory records.
Why we use information
We use account details to sign you in, protect your session, enforce access limits and recover access. Collection information displays and organizes your own records. Photos support cropping, identification research, saved card images and optional backup. Transaction and investment details help show your recorded holdings and sales, not verified market outcomes. Limited diagnostics and audit history support security and troubleshooting.
Where photos and records are kept
Pokémon member records use Cloudflare D1, with private images stored in Cloudflare R2 and protected by authenticated owner-scoped requests. Browser processing may resize or re-encode images before uploading. An optional private Google Drive archival workflow may retain source photos and processed crops in the platform owner's Google account when enabled. Archive copies and retained historic images can differ from the current card photo.
Important: Removing a current photo or archiving a card is not proof that every previous backup or history copy has been permanently erased. AI/research-provider data flows and retention must be independently confirmed before the final version is issued.
Retention, archives and deletion
Account records and collection data remain until they are changed, removed through available tools, or handled through a verified administrative process. Some financial, audit, recovery, processing and backup records may persist after an item is archived or removed. The exact retention schedules, legal exceptions and backup deletion windows have not yet been verified. There is no working self-service full-account-erasure feature in the inspected code. The Founder-designated contact channel is vaultedcoven@gmail.com, but an independently verified account-ownership procedure, data inventory and retention schedule are still required before any sensitive disclosure or deletion is performed. No completion deadline is promised.
How we protect data
Safeguards implemented in the current member platform include HTTPS, password hashing, secure restricted session cookies, request validation, rate limits, ownership checks, and selected restrictive browser security headers. No security control can guarantee that an incident will never happen. Use a strong unique password and never share recovery codes or your secret initiation sequence.
Your choices and requests
You can edit supported collection and profile details, change your password, and archive or restore items using the controls available to your account. For additional access, correction, deletion or export requests, email vaultedcoven@gmail.com. This inbox accepts requests, but a sender’s email address or username does not prove account ownership. No private records should be disclosed or deleted before a separately approved secure identity check. There is no automatic deletion or export service, and processing times remain to be established. Applicable privacy rights may vary by location; this draft should be reviewed for relevant laws before launch.
Prepare a private inquiry. The report composer prepares an email draft on your device; it does not send anything itself. Email is delivered only if you press Send in your mail app. Do not email passwords, Recovery Scrolls or invitation secrets.
Children and eligibility
Age eligibility, parental consent procedures, and applicable children's privacy obligations need a Founder/legal decision before the final policy is published. Do not present the service as specifically intended for children until those decisions and protections are established.
Contact and policy updates
Intended owner and operator of the RareFoil Society website: VaultedCoven LLC, an existing registered limited liability company as confirmed by the Founder. RareFoil Society itself is not a separate business. State of formation: Wyoming, USA. The exact registered name and any legally required business mailing contact still need review. Founder-designated privacy and support email: vaultedcoven@gmail.com. Contact alone does not confirm receipt, a response time or successful data erasure. Before final approval this page still needs the legal operator, effective date, version and policy-change notification process.
Review required: VaultedCoven LLC's exact registered name and legally required business mailing contact (Wyoming, USA describes registration, not a street address); eligible ages; retention/deletion windows and identity verification; all AI/analytics/hosting processors; international transfers; state-specific rights; sales/sharing practice; final effective date.