Privacy Policy

The short version

• Advertising measurement in the mobile apps; none in the extension or portal. The Reliqra iOS and Android apps use AppsFlyer, a mobile measurement partner, to measure how well our ads work — which ad brought you to Reliqra (install attribution) and whether you completed key steps like signing up or subscribing. On iOS this only involves your device's advertising identifier if you allow tracking when asked. Our browser extension and Reliqra Cloud portal do not run advertising trackers, and we never use your inventory, photos, or buyer data for advertising. We don't sell your personal information for money. Our marketing website (reliqra.com) also uses Meta and Reddit advertising pixels and analytics, which you can switch off at any time — see Cookies & analytics below.
• Where your inventory lives depends on your platform. On iOS, your inventory is stored on your device and, by default, synced through your private iCloud container. On Android, the app is cloud-based: your inventory is stored in your Reliqra Cloud account, which requires sign-in.
• Reliqra Cloud powers the web portal and team access. On iOS it's an opt-in feature you choose to turn on; on Android a Reliqra Cloud account is required to use the app.
• Photos power identification and listings. Photos you capture are used to identify items and are hosted so your marketplace exports work. AI identification photos are sent to OpenAI to return catalog details.
• We use trusted service providers. A small, named list of sub-processors helps us run features like AI identification, pricing, payments, and email — each gets only the data it needs.
• You can export and delete your data. You can export your inventory to CSV, and delete your account and data from inside the app or by emailing us.

This Privacy Policy explains how Reliqra, LLC ("Reliqra," "we," "us") handles personal information across the Reliqra iOS app, Android app, browser extension, Reliqra Cloud web portal, reliqra.com, and status.reliqra.com. Reliqra is available only in the United States and Canada.

Information we collect

• Account & identity information. When you use Reliqra Cloud, we collect the email address and authentication identity tied to your sign-in. We support Sign in with Apple, Google sign-in, and email-and-password sign-in depending on the surface. If you use Apple's "Hide My Email," we receive only the Apple private-relay address, not your real email.
• Inventory & catalog data. The information you add to build your catalog — item details, photos, prices, cost basis, sale records, and the reports and profit & loss derived from them.
• Photos and images. Photos you capture or upload to identify and list items.
• Buyer/order information (if you connect a marketplace). If you connect eBay or Whatnot, we ingest order data, which can include a buyer's name and shipping address, so we can record sales and reconcile inventory. The browser extension reads order data from your own Whatnot seller dashboard — see The browser extension and buyer information below.
• Workspace & team data. Your workspace, membership, and role information, and the team members you authorize.
• Device & usage information. Basic technical data needed to operate the service, such as device push-notification tokens (for alerts you enable) and operational logs.
• Advertising & attribution data (mobile apps only). In the iOS and Android apps we use a mobile measurement partner (AppsFlyer) to attribute installs and measure advertising. For this we process your device advertising identifier — Apple's IDFA on iOS (only if you allow tracking through the App Tracking Transparency prompt) or Google's Advertising ID (GAID) on Android — together with certain in-app event and usage data (for example, that a sign-up, paywall view, purchase/subscription, or first item lookup occurred) and a Reliqra user identifier (your account ID) and email. This data is shared with AppsFlyer and, through server-side postbacks, informs the ad networks (such as Reddit and Meta) that brought you to Reliqra. See Cookies & analytics for how to opt out. The browser extension and Cloud portal do not collect advertising identifiers or run attribution.
• Payment information. When billing is enabled, purchases are handled by Apple (in-app purchases), Google (Android), or Stripe (web). We do not receive or store your full card number — payment processors hold that. We store only opaque references (for example, a Stripe customer/subscription ID or an Apple transaction ID) needed to recognize your subscription.

What we do not collect

We do not collect government identifiers (such as Social Security or driver's-license numbers), precise geolocation, biometric information, or health information.

How we use your information

• To identify and price items, including running AI identification on the photos you capture.
• To generate marketplace exports and listings, and to sync your inventory across the app, Cloud, and extension.
• To produce your reports, valuations, and profit & loss.
• To create and secure your account, authorize team members, and provide support.
• To process subscriptions and purchases (when billing is enabled) and recognize your entitlements.
• To send transactional messages (for example, sign-in confirmation emails and notifications you enable).
• To operate, maintain, secure, and improve the service, and to comply with legal obligations.

We do not use your inventory or photos to serve advertising, and we do not sell your inventory, photos, or buyer data. The advertising-related data sharing we do is limited to two things: the attribution and advertising-measurement data our mobile apps share with our mobile measurement partner (AppsFlyer) and the ad networks it reports to, and the opt-outable advertising pixels on our marketing website (reliqra.com). Both are described under Cookies & analytics and Your privacy rights.

Service providers (sub-processors)

We rely on a small set of trusted providers to deliver Reliqra. Each receives only the data needed for its function, under contracts that restrict it to providing its services to us.

Provider	Function	What it receives
Supabase (US region)	Authentication, database, and storage for Reliqra Cloud	Account/identity, inventory and workspace records, order data, and (when synced) photos
OpenAI	AI identification of items from photos (via our server-side proxy)	The photos and item context you submit for identification (Section AI processing of your photos)
Greysheet® (CDN Publishing, LLC)	Pricing & valuation data (retail price guide)	Item descriptors only (for example, a coin's type and grade). Does not receive your personal information
Apple	Sign in with Apple, App Store distribution, iOS in-app purchases	Authentication identity and, for purchases, payment information Apple processes as merchant of record. We never see your card number
Google	Google sign-in, Google Play distribution/billing on Android	Authentication identity and, for Play purchases, payment information Google processes
Stripe	Payment processing for web/extension purchases (when billing is enabled)	Payment information you enter on Stripe's hosted checkout. We never see your card number
Amazon Web Services (AWS) (us-east-1)	S3 image hosting/archive, Lambda backend functions, Amazon SES transactional/auth email	Photos, operational data, and your email address for sending account email
UptimeRobot	External uptime monitoring of our public endpoints	Does not receive your personal information
Shippo	Shipping-label purchase and fulfillment for storefront orders	Buyer name and ship-to address for orders being fulfilled
Cloudflare (Turnstile)	Bot/abuse protection on sign-in and sign-up	Browser/device signals of visitors completing the challenge; no account or inventory data
AppsFlyer	Mobile install attribution and advertising measurement in the iOS and Android apps	Device advertising identifier (IDFA/GAID, IDFA only if you allow tracking), in-app marketing events, your Reliqra user identifier, and email. Does not receive your inventory, photos, or buyer data
eBay and Whatnot	Only if you connect them — publish listings and ingest your sales/orders	Data flows according to your connection and their terms

This list reflects the providers in use. We will update it as our providers change.

AI processing of your photos

When you ask Reliqra to identify an item, the photo you capture is sent to our AI provider (OpenAI) to return catalog details such as type, grade, and attributes.

Under OpenAI's published API terms as of the date of this policy: content sent via the API is not used to train or improve OpenAI's models unless the customer opts in (we have not opted in), and OpenAI may retain API inputs and outputs for up to 30 days to provide the service and monitor for abuse, after which they are deleted unless OpenAI is legally required to retain them. We do not claim zero-retention status with OpenAI.

We also keep a copy of identification images in our own private, encrypted storage (AWS S3) to power your catalog and re-identification.

De-identified data we derive. From identification and specification, Reliqra creates and retains de-identified, aggregated data — a reference catalog of item facts and industry identifiers, and datasets used to train and evaluate our machine-learning models. This de-identified data does not identify you, your account, your holdings, your costs or values, or your photographs, and we do not attempt to re-identify it; we own it and may use it to improve the Service. Your own lookup history and item records stay tied to your account and are not shared with other customers. See the Improvement of the Service; de-identified data section of our Terms of Service.

Pricing data

Pricing and valuation data comes from licensed and third-party sources depending on item type: Greysheet® (coins & currency), PriceCharting and SportsCardsPro (trading/sports cards and comics), and eBay sold-listing comparables. When you request pricing, we send item catalog identifiers only (for example, a coin's catalog number, date, and grade, or a card's set and number) — never your account identity, photos, costs, or other personal information — to these pricing sources. Greysheet (CDN Publishing, LLC) is our pricing-data licensor, not a service provider that processes personal information on our behalf; its API has no fields for end-user data, so no personal information flows to it.

Valuations are estimates for informational purposes and are not guaranteed or a substitute for a professional appraisal. Greysheet®, Bluesheet®, Greensheet®, and CPG® are registered trademarks of CDN Publishing, LLC.

The browser extension and buyer information

The Reliqra browser extension runs in your browser and reads order data from your own Whatnot seller dashboard while you are signed in to Whatnot. It does not collect your general browsing activity. Whatnot is not our partner, processor, or data source — the extension simply helps you capture what your own dashboard already shows you.

Captured orders can include personal information about your buyers (names and ship-to addresses). Buyers are not Reliqra users. For that buyer information:

• You (the seller) are the data controller. You decide to capture it, and you use it to fulfill orders you are responsible for.
• Reliqra is your processor / service provider. We store and process buyer information solely on your behalf — for your order management, label printing, and sales records — never for advertising, never for our own purposes, and we do not sell it.
• Buyers with questions about their information should contact the seller they purchased from. We will assist our sellers in honoring buyer privacy requests.

Use of data collected by the extension is limited to providing the user-facing features described in this section, consistent with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Where your data is stored

Where your inventory is stored depends on the platform you use:

• iOS. Your inventory is stored on your device (encrypted at rest) and, by default, synced through your private iCloud container, which follows you across your Apple devices without a separate login. Syncing to Reliqra Cloud for the web portal and team access is an additional opt-in feature.
• Android. The Android app is cloud-based: your inventory is stored in your Reliqra Cloud account and requires sign-in. For offline use, the app keeps an encrypted on-device cache of your inventory and queues any edits you make offline, then syncs them to Reliqra Cloud when you reconnect; Reliqra Cloud remains the system of record. There is no separate on-device-only mode you can use without an account.

When your data is in Reliqra Cloud (required on Android, optional on iOS), it syncs to a secure cloud account so it's available in the browser portal and to the team members you authorize. Our Reliqra Cloud infrastructure (Supabase and AWS, us-east-1) is hosted in the United States. Because Reliqra serves the United States and Canada, when a Canadian user's data is in Reliqra Cloud it is processed and stored in the United States and may be accessible to U.S. courts, law enforcement, and national-security authorities under applicable law.

How we protect your data

• In transit: we use HTTPS/TLS encryption for connections to our cloud and providers.
• At rest: our database uses managed encryption, and our private image-archive storage is encrypted (AES-256) and not publicly accessible.
• Access controls: cloud data is scoped to your workspace (tenant isolation), provider credentials are restricted, and staff access is role-gated. No card data is stored on our systems.

We do not currently hold third-party certifications such as SOC 2 or ISO 27001, and we do not claim them. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

Data retention

We keep your account and inventory data for as long as your account is active. When you delete your account, we delete your associated data as described under Deleting your account. We retain limited records (such as transaction references and breach records) where required to meet legal, tax, and accounting obligations, and we keep backups for a limited period before they are overwritten.

Your privacy rights

You have rights over your personal information. Reliqra honors the following for all users, regardless of where you live in the United States or Canada — including where a specific statute may not yet technically apply to a business of our size:

• Access & portability — request a copy of the personal information we hold about you, and receive your inventory data in a portable format (CSV export is available in-app). To make a request, email support@reliqra.com, and we will respond within 30 days.
• Correction — correct inaccurate information. You can edit most profile and inventory data directly in the app; for anything else, contact us.
• Deletion — delete your account and associated data using the in-app Delete Account flow, or by emailing us.
• Opt out of "sale" / "sharing" / targeted advertising — see California residents below and Cookies & analytics.
• Non-discrimination — we will not deny you the service, charge different prices, or degrade quality because you exercised a privacy right.

How to exercise them. Email support@reliqra.com from the email associated with your account (or describe your relationship to Reliqra if you don't have an account — for example, if you bought from one of our sellers). We will verify your identity before acting (typically by confirming control of the account email), respond within 30 days, and explain if we decline a request — in which case you may appeal by replying to our response and we will take a second look. You may use an authorized agent if you give the agent written permission and we can verify your identity. For buyer information captured by a seller's browser extension, the seller is the controller; we will refer your request to the seller and assist them in honoring it.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it; to request access to and deletion of your personal information; to correct inaccurate personal information; to opt out of the "sale" and "sharing" of your personal information; and to not be discriminated against for exercising your rights.

We do not sell your personal information for money, and we do not sell or share your inventory, photos, or buyer data for advertising. However, some U.S. state privacy laws define "sale" and "sharing" broadly enough to cover two things: the advertising pixels on our marketing website (reliqra.com) and the attribution/advertising-measurement data our mobile apps share with our mobile measurement partner (AppsFlyer) and the ad networks it reports to. Making visitor or device data available to ad platforms in exchange for advertising and analytics services can qualify as a "sale," and disclosure for cross-context behavioral advertising qualifies as "sharing," even with no money changing hands. We treat both the marketing-site pixels and the in-app attribution accordingly and provide opt-outs (for the apps, decline the App Tracking Transparency prompt on iOS or reset/limit your advertising ID on Android — see Cookies & analytics). Apart from these, we make no disclosures that constitute selling or sharing under those laws. We do not use or disclose sensitive personal information for purposes that require an opt-out, and we do not knowingly sell or share the personal information of consumers under 16.

To exercise any of these rights, including authorized-agent and appeal rights, see How to exercise them above. We will verify your request and respond within 30 days.

Canadian residents (PIPEDA and Quebec Law 25)

If you are in Canada, we collect, use, and disclose your personal information with your consent and only as described in this policy. You have the right to access the personal information we hold about you and to request corrections, deletion, and portability. We will respond to access requests within 30 days. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice; withdrawing consent for processing essential to the service may require closing your account.

If we experience a breach of security safeguards posing a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA, and we keep records of breaches as required. All Canadian users may complain to the Office of the Privacy Commissioner of Canada.

Quebec (Law 25). For Quebec residents:

• Person in charge of protection of personal information. Unless and until delegated in writing, this is the highest-ranking officer of Reliqra, LLC, reachable at support@reliqra.com.
• Automated decisions. You may request information about, and contest, any decision we make about you based exclusively on automated processing of your personal information.
• Complaints. You may complain to Quebec's Commission d'accès à l'information (CAI).
• Minors under 14. Quebec law requires parental consent to collect personal information from a minor under 14; we do not knowingly collect it without that consent.

To make a request or raise a concern, contact us at support@reliqra.com.

Deleting your account

You can delete your Reliqra account and its associated data at any time using the Delete Account option in the app's account settings, or by emailing support@reliqra.com from your account email.

Deletion follows a two-step lifecycle:

• Soft delete. When you delete your account, it is first soft-deleted (deactivated and marked for purge). We send a warning email to workspace owners before permanent deletion, so you have notice before anything is permanently removed. Signing back in during this window cancels the deletion.
• Permanent purge. After the retention window ends, a scheduled purge permanently and irreversibly deletes the account and its inventory, photos, and records. The same purge lifecycle applies to long-inactive accounts, with an advance email warning before any deletion.
• Export first. If you want to keep your records, export your inventory to CSV before deleting.
• Residual copies. Some limited records may be retained where required by law (for example, tax records) or in encrypted backups and security logs for a limited period before they are overwritten. OpenAI's up-to-30-day API retention is described under AI processing of your photos; Apple, Google, and Stripe retain transaction records under their own policies.

Cookies & analytics

The Reliqra Cloud portal uses only the cookies and local storage necessary to operate (for example, to keep you signed in) — no advertising or cross-site tracking there. The browser extension does not run advertising or analytics tracking either.

The mobile apps (AppsFlyer)

The Reliqra iOS and Android apps include AppsFlyer, a mobile measurement partner, to attribute installs and measure how our advertising performs. AppsFlyer processes your device advertising identifier (Apple's IDFA on iOS, Google's Advertising ID / GAID on Android), certain in-app marketing events (such as sign-up, paywall view, purchase/subscription, and first lookup), and your Reliqra user identifier and email, and it reports back to the ad networks (such as Reddit and Meta) that brought you to Reliqra. It does not receive your inventory, photos, or buyer data.

Your choices for in-app attribution:

• iOS. We only use your IDFA if you allow it. When the app asks with the App Tracking Transparency prompt, choose "Ask App Not to Track" to decline. You can change your mind at any time in Settings → Privacy & Security → Tracking, and turning off "Allow Apps to Request to Track" blocks tracking for all apps. With tracking declined, AppsFlyer cannot use your IDFA.
• Android. In your device's Settings → Privacy → Ads (Google settings), you can delete or reset your advertising ID and turn on "Opt out of Ads Personalization", which limits advertising use of the identifier.

The Reliqra marketing website (reliqra.com) uses Google Tag Manager to load standard advertising and analytics tags — the Meta Pixel and the Reddit Pixel — to measure how our ads perform and to enable interest-based advertising. These tags collect device identifiers and browsing information from marketing-site visitors. These website pixel tags do not run in the apps, the browser extension, or the signed-in Cloud portal (in-app advertising measurement is handled separately by AppsFlyer, described just above), and your inventory data never feeds them.

Your choices for the marketing-site pixels:

• Your Privacy Choices. Use the "Your Privacy Choices" control on reliqra.com to disable advertising tags.
• Global Privacy Control (GPC). We honor GPC opt-out preference signals on reliqra.com where applicable law requires.
• Email. Send "Opt out" to support@reliqra.com and we will treat it as an opt-out of sale/sharing/targeted advertising.
• Browser/platform controls. Meta and Reddit offer their own ad-preference settings, and your browser can block third-party cookies.

Children's privacy

Reliqra is a business tool not directed to children. It is not intended for anyone under 16, and we do not knowingly collect personal information from anyone under 16. (Separately, our Terms of Service require users to be 18 or older.) In Quebec, the collection of personal information from a minor under 14 requires parental consent, as noted under Canadian residents (PIPEDA and Quebec Law 25). If you believe a child has provided us personal information, contact us and we will delete it.

Security incidents

If we become aware of a data breach that affects your personal information and poses a real risk of harm, we will notify you and the relevant authorities as required by applicable U.S. state and Canadian (PIPEDA) law, and take steps to mitigate the impact.

International / cross-border

Reliqra is operated from the United States and serves users in the United States and Canada. By using Reliqra, you understand that, when your data is in Reliqra Cloud, it will be processed and stored in the United States. We do not currently target or offer the service to users in the European Union.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you (for example, by email or an in-product notice). Material changes that reduce your rights will not apply retroactively to previously collected information without your consent where the law requires consent. Your continued use of Reliqra after a change takes effect means you accept the updated policy.

Contact us

Questions or requests? Email support@reliqra.com and a real person will get back to you. Reliqra is operated by Reliqra, LLC, PO Box 60037, Lafayette, LA 70596. Availability: United States & Canada.

Read our Terms of Service →