Legal

Privacy Policy

Last updated: 2026-06-13 · Effective: 2026-06-13

The short version

No ad tracking in the product. The Reliqra apps, browser extension, and Cloud portal don't run advertising trackers, and we don't sell your personal information for money. Our marketing website (reliqra.com) does use Meta and Reddit advertising pixels and analytics, which you can switch off at any time — see Cookies & analytics below.
Where your inventory lives depends on your platform. On iOS, your inventory is stored on your device and, by default, synced through your private iCloud container. On Android, the app is cloud-based: your inventory is stored in your Reliqra Cloud account, which requires sign-in.
Reliqra Cloud powers the web portal and team access. On iOS it's an opt-in feature you choose to turn on; on Android a Reliqra Cloud account is required to use the app.
Photos power identification and listings. Photos you capture are used to identify items and are hosted so your marketplace exports work. AI identification photos go to OpenAI through our own server-side proxy (our API key, not yours).
We use trusted service providers. A small, named list of sub-processors helps us run features like AI identification, pricing, payments, and email — each gets only the data it needs.
You can export and delete your data. You can export your inventory to CSV, and delete your account and data from inside the app or by emailing us.

This Privacy Policy explains how Reliqra, LLC ("Reliqra," "we," "us") handles personal information across the Reliqra iOS app, Android app, browser extension, Reliqra Cloud web portal, and reliqra.com. Reliqra is available only in the United States and Canada.

Information we collect

Account & identity information. When you use Reliqra Cloud, we collect the email address and authentication identity tied to your sign-in. We support Sign in with Apple, Google sign-in, and email-and-password sign-in depending on the surface. If you use Apple's "Hide My Email," we receive only the Apple private-relay address, not your real email.
Inventory & catalog data. The information you add to build your catalog — item details, photos, prices, cost basis, sale records, and the reports and profit & loss derived from them.
Photos and images. Photos you capture or upload to identify and list items.
Buyer/order information (if you connect a marketplace). If you connect eBay or Whatnot, we ingest order data, which can include a buyer's name and shipping address, so we can record sales and reconcile inventory. The browser extension reads order data from your own Whatnot seller dashboard — see The browser extension and buyer information below.
Workspace & team data. Your workspace, membership, and role information, and the team members you authorize.
Device & usage information. Basic technical data needed to operate the service, such as device push-notification tokens (for alerts you enable) and operational logs.
Payment information. When billing is enabled, purchases are handled by Apple (in-app purchases), Google (Android), or Stripe (web). We do not receive or store your full card number — payment processors hold that. We store only opaque references (for example, a Stripe customer/subscription ID or an Apple transaction ID) needed to recognize your subscription.

What we do not collect

We do not collect government identifiers (such as Social Security or driver's-license numbers), precise geolocation, biometric information, or health information.

How we use your information

To identify and price items, including running AI identification on the photos you capture.
To generate marketplace exports and listings, and to sync your inventory across the app, Cloud, and extension.
To produce your reports, valuations, and profit & loss.
To create and secure your account, authorize team members, and provide support.
To process subscriptions and purchases (when billing is enabled) and recognize your entitlements.
To send transactional messages (for example, sign-in confirmation emails and notifications you enable).
To operate, maintain, secure, and improve the service, and to comply with legal obligations.

We do not use your inventory or photos to serve advertising, we do not use them to train AI models, and we do not sell your inventory, photos, or buyer data. The only advertising-related data sharing we do is through the opt-outable pixels on our marketing website, described under Cookies & analytics and Your privacy rights.

Service providers (sub-processors)

We rely on a small set of trusted providers to deliver Reliqra. Each receives only the data needed for its function, under contracts that restrict it to providing its services to us.

Provider	Function	What it receives
Supabase (US region)	Authentication, database, and storage for Reliqra Cloud	Account/identity, inventory and workspace records, order data, and (when synced) photos
OpenAI	AI identification of items from photos (via our server-side proxy)	The photos and item context you submit for identification (Section AI processing of your photos)
Greysheet® (CDN Publishing, LLC)	Wholesale pricing/valuation data	Item descriptors only (for example, a coin's type and grade). Does not receive your personal information
Apple	Sign in with Apple, App Store distribution, iOS in-app purchases	Authentication identity and, for purchases, payment information Apple processes as merchant of record. We never see your card number
Google	Google sign-in, Google Play distribution/billing on Android	Authentication identity and, for Play purchases, payment information Google processes
Stripe	Payment processing for web/extension purchases (when billing is enabled)	Payment information you enter on Stripe's hosted checkout. We never see your card number
Amazon Web Services (AWS) (us-east-1)	S3 image hosting/archive, Lambda backend functions, Amazon SES transactional/auth email	Photos, operational data, and your email address for sending account email
UptimeRobot	External uptime monitoring of our public endpoints	Does not receive your personal information
eBay and Whatnot	Only if you connect them — publish listings and ingest your sales/orders	Data flows according to your connection and their terms

This list reflects the providers in use. We will update it as our providers change.

AI processing of your photos

When you ask Reliqra to identify an item, the photo you capture is sent to our AI provider (OpenAI) to return catalog details such as type, grade, and attributes. Photos are sent through our own server-side proxy, using our API key — not yours — and may incidentally include a slab label or other text in frame.

Under OpenAI's published API terms as of the date of this policy: content sent via the API is not used to train or improve OpenAI's models unless the customer opts in (we have not opted in), and OpenAI may retain API inputs and outputs for up to 30 days to provide the service and monitor for abuse, after which they are deleted unless OpenAI is legally required to retain them. We do not claim zero-retention status with OpenAI.

We also keep a copy of identification images in our own private, encrypted storage (AWS S3) to power your catalog and re-identification.

Pricing data

Pricing and valuation data is licensed from Greysheet®. When you request pricing, we send item catalog identifiers only (for example, a coin's catalog number, date, and grade) — never your account identity, photos, costs, or other personal information — to Greysheet's price-guide API. Greysheet (CDN Publishing, LLC) is our pricing-data licensor, not a service provider that processes personal information on our behalf; its API has no fields for end-user data, so no personal information flows to it.

Valuations are estimates for informational purposes and are not guaranteed or a substitute for a professional appraisal. Greysheet®, Bluesheet®, Greensheet®, and CPG® are registered trademarks of CDN Publishing, LLC.

The browser extension and buyer information

The Reliqra browser extension runs in your browser and reads order data from your own Whatnot seller dashboard while you are signed in to Whatnot. It does not collect your general browsing activity. Whatnot is not our partner, processor, or data source — the extension simply helps you capture what your own dashboard already shows you.

Captured orders can include personal information about your buyers (names and ship-to addresses). Buyers are not Reliqra users. For that buyer information:

You (the seller) are the data controller. You decide to capture it, and you use it to fulfill orders you are responsible for.
Reliqra is your processor / service provider. We store and process buyer information solely on your behalf — for your order management, label printing, and sales records — never for advertising, never for our own purposes, and we do not sell it.
Buyers with questions about their information should contact the seller they purchased from. We will assist our sellers in honoring buyer privacy requests.

Use of data collected by the extension is limited to providing the user-facing features described in this section, consistent with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Where your data is stored

Where your inventory is stored depends on the platform you use:

iOS. Your inventory is stored on your device (encrypted at rest) and, by default, synced through your private iCloud container, which follows you across your Apple devices without a separate login. Syncing to Reliqra Cloud for the web portal and team access is an additional opt-in feature.
Android. The Android app is cloud-based: your inventory is stored in your Reliqra Cloud account and requires sign-in. There is no separate on-device-only mode.

When your data is in Reliqra Cloud (required on Android, optional on iOS), it syncs to a secure cloud account so it's available in the browser portal and to the team members you authorize. Our Reliqra Cloud infrastructure (Supabase and AWS, us-east-1) is hosted in the United States. Because Reliqra serves the United States and Canada, when a Canadian user's data is in Reliqra Cloud it is processed and stored in the United States and may be accessible to U.S. courts, law enforcement, and national-security authorities under applicable law.

How we protect your data

In transit: we use HTTPS/TLS encryption for connections to our cloud and providers.
At rest: our database uses managed encryption, and our private image-archive storage is encrypted (AES-256) and not publicly accessible.
Access controls: cloud data is scoped to your workspace (tenant isolation), provider credentials are restricted, and staff access is role-gated. No card data is stored on our systems.

We do not currently hold third-party certifications such as SOC 2 or ISO 27001, and we do not claim them. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

Data retention

We keep your account and inventory data for as long as your account is active. When you delete your account, we delete your associated data as described under Deleting your account. We retain limited records (such as transaction references and breach records) where required to meet legal, tax, and accounting obligations, and we keep backups for a limited period before they are overwritten.

Your privacy rights

You have rights over your personal information. Reliqra honors the following for all users, regardless of where you live in the United States or Canada — including where a specific statute may not yet technically apply to a business of our size:

Access & portability — request a copy of the personal information we hold about you, and receive your inventory data in a portable format (CSV export is available in-app). To make a request, email support@reliqra.com, and we will respond within 30 days.
Correction — correct inaccurate information. You can edit most profile and inventory data directly in the app; for anything else, contact us.
Deletion — delete your account and associated data using the in-app Delete Account flow, or by emailing us.
Opt out of "sale" / "sharing" / targeted advertising — see California residents below and Cookies & analytics.
Non-discrimination — we will not deny you the service, charge different prices, or degrade quality because you exercised a privacy right.

How to exercise them. Email support@reliqra.com from the email associated with your account (or describe your relationship to Reliqra if you don't have an account — for example, if you bought from one of our sellers). We will verify your identity before acting (typically by confirming control of the account email), respond within 30 days, and explain if we decline a request — in which case you may appeal by replying to our response and we will take a second look. You may use an authorized agent if you give the agent written permission and we can verify your identity. For buyer information captured by a seller's browser extension, the seller is the controller; we will refer your request to the seller and assist them in honoring it.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it; to request access to and deletion of your personal information; to correct inaccurate personal information; to opt out of the "sale" and "sharing" of your personal information; and to not be discriminated against for exercising your rights.

We do not sell your personal information for money, and we do not sell or share your inventory, photos, or buyer data for advertising. However, some U.S. state privacy laws define "sale" and "sharing" broadly enough to cover the advertising pixels on our marketing website (reliqra.com): making visitor data available to ad platforms in exchange for advertising and analytics services can qualify as a "sale," and disclosure for cross-context behavioral advertising qualifies as "sharing," even with no money changing hands. We treat the marketing-site pixels accordingly and provide opt-outs. Outside the marketing site, we make no disclosures that constitute selling or sharing under those laws. We do not use or disclose sensitive personal information for purposes that require an opt-out, and we do not knowingly sell or share the personal information of consumers under 16.

To exercise any of these rights, including authorized-agent and appeal rights, see How to exercise them above. We will verify your request and respond within 30 days.

Canadian residents (PIPEDA and Quebec Law 25)

If you are in Canada, we collect, use, and disclose your personal information with your consent and only as described in this policy. You have the right to access the personal information we hold about you and to request corrections, deletion, and portability. We will respond to access requests within 30 days. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice; withdrawing consent for processing essential to the service may require closing your account.

If we experience a breach of security safeguards posing a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA, and we keep records of breaches as required. All Canadian users may complain to the Office of the Privacy Commissioner of Canada.

Quebec (Law 25). For Quebec residents:

Person in charge of protection of personal information. Unless and until delegated in writing, this is the highest-ranking officer of Reliqra, LLC, reachable at support@reliqra.com.
Automated decisions. You may request information about, and contest, any decision we make about you based exclusively on automated processing of your personal information.
Complaints. You may complain to Quebec's Commission d'accès à l'information (CAI).
Minors under 14. Quebec law requires parental consent to collect personal information from a minor under 14; we do not knowingly collect it without that consent.

To make a request or raise a concern, contact us at support@reliqra.com.

Deleting your account

You can delete your Reliqra account and its associated data at any time using the Delete Account option in the app's account settings, or by emailing support@reliqra.com from your account email.

Deletion follows a two-step lifecycle:

Soft delete. When you delete your account, it is first soft-deleted (deactivated and marked for purge). We send a warning email to workspace owners before permanent deletion, so you have notice before anything is permanently removed. Signing back in during this window cancels the deletion.
Permanent purge. After the retention window ends, a scheduled purge permanently and irreversibly deletes the account and its inventory, photos, and records. The same purge lifecycle applies to long-inactive accounts, with an advance email warning before any deletion.
Export first. If you want to keep your records, export your inventory to CSV before deleting.
Residual copies. Some limited records may be retained where required by law (for example, tax records) or in encrypted backups and security logs for a limited period before they are overwritten. OpenAI's up-to-30-day API retention is described under AI processing of your photos; Apple, Google, and Stripe retain transaction records under their own policies.

Cookies & analytics

The Reliqra apps and Cloud portal use only the cookies and local storage necessary to operate (for example, to keep you signed in to the portal) — no advertising or cross-site tracking there.

The Reliqra marketing website (reliqra.com) uses Google Tag Manager to load standard advertising and analytics tags — the Meta Pixel and the Reddit Pixel — to measure how our ads perform and to enable interest-based advertising. These tags collect device identifiers and browsing information from marketing-site visitors. They do not run in the apps, the browser extension, or the signed-in Cloud portal, and your inventory data never feeds them.

Your choices for the marketing-site pixels:

Your Privacy Choices. Use the "Your Privacy Choices" control on reliqra.com to disable advertising tags.
Global Privacy Control (GPC). We honor GPC opt-out preference signals on reliqra.com where applicable law requires.
Email. Send "Opt out" to support@reliqra.com and we will treat it as an opt-out of sale/sharing/targeted advertising.
Browser/platform controls. Meta and Reddit offer their own ad-preference settings, and your browser can block third-party cookies.

Children's privacy

Reliqra is a business tool not directed to children. It is not intended for anyone under 16, and we do not knowingly collect personal information from anyone under 16. (Separately, our Terms of Service require users to be 18 or older.) In Quebec, the collection of personal information from a minor under 14 requires parental consent, as noted under Canadian residents (PIPEDA and Quebec Law 25). If you believe a child has provided us personal information, contact us and we will delete it.

Security incidents

If we become aware of a data breach that affects your personal information and poses a real risk of harm, we will notify you and the relevant authorities as required by applicable U.S. state and Canadian (PIPEDA) law, and take steps to mitigate the impact.

International / cross-border

Reliqra is operated from the United States and serves users in the United States and Canada. By using Reliqra, you understand that, when your data is in Reliqra Cloud, it will be processed and stored in the United States. We do not currently target or offer the service to users in the European Union.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you (for example, by email or an in-product notice). Material changes that reduce your rights will not apply retroactively to previously collected information without your consent where the law requires consent. Your continued use of Reliqra after a change takes effect means you accept the updated policy.

Contact us

Questions or requests? Email support@reliqra.com and a real person will get back to you. Reliqra is operated by Reliqra, LLC, PO Box 60037, Lafayette, LA 70596. Availability: United States & Canada.

Read our Terms of Service →