Privacy Policy

We collect the following categories of personal data so the Service can function:

• Account data: email address, username/handle, password hash, authentication provider identifiers (e.g. Google and/or Apple sign-in), and account creation date. Used to create and secure your account.
• Profile data: display name, bio, avatar, location (if you provide one), account type, language preference, and social links. Used to power your public profile.
• Camera, photo & video access: if you elect to use features such as Coral Collect, photo uploads, photo captures, video uploads, or video captures, your browser or device will prompt you for permission to access your camera, photo library, or microphone. We only access this media when you actively use the feature, and you can revoke or disable that access at any time through your device or browser settings.
• Coral collection & photo data: when you use the Coral Collect feature, we receive the photos you capture or upload, image metadata, the coral you are claiming, AI verification results, optional purchase price, and timestamps. Photos are stored to display in your collection, on leaderboards, and on shared coral pages.
• Profile photos & uploaded images: images you upload to your profile, cover, or coral entries are stored in our backend and served publicly as part of your profile or collection. We process them only to display, moderate, and improve the Service.
• Activity data: comments, reviews, reports, follows, listings, quests, XP, badges, leaderboard standing, auction participation, bids, maximum bids, winning bids, auction timestamps, auction status, bidding history, and other interactions you create on the platform.
• Device & usage data: IP address, device type, browser, operating system, push notification tokens, session identifiers, and analytics events (page views, feature usage, errors). Used for security, debugging, and product improvement.
• Billing & marketplace payment data: if you subscribe or participate in a marketplace transaction or auction, our payment processors collect payment method and transaction details on our behalf. For marketplace and auction transactions, this may include order details, transaction amounts, shipping addresses and other shipping information, seller and buyer information, payment status, refunds, payment authorization records, saved payment method references, and related transaction records. Stripe may collect and process payment information, tax information, and connected-account information as necessary to process marketplace and auction payments and payouts, including authorized future charges using saved payment methods. We store only the information necessary to operate the Service and marketplace — never full card numbers.

• Provide authentication, collections, leaderboards, marketplace, and notifications.
• Verify coral submissions using AI to keep collections authentic.
• Moderate content, prevent fraud and abuse, and enforce our Terms.
• Process subscriptions and billing.
• Operate auctions and bidding features, determine auction winners, process authorized auction payments, use authorized saved payment methods for future auction charges, prevent bid manipulation and fraud, enforce auction rules, and resolve transaction disputes.
• Respond to support requests and security incidents.
• Improve the Service through analytics and product research.
• Send transactional emails and, where you've opted in, marketing or product updates.
• Use submitted coral images, including images that are accepted or rejected during verification, to develop, train, test, evaluate, and improve our AI, image recognition, verification, and related technologies.

We share data only with the third-party providers required for the Service to function. We do not sell your personal data. Current processors include:

• Cloud Storage: database, authentication, file storage.
• Google: optional Google sign-in.
• AI Gateway: AI-based coral photo verification and moderation.
• Stripe: subscription billing, marketplace and auction payment processing, payment authorization records, saved payment method references, authorized future payment charges, Stripe Connect seller onboarding and payouts, tax calculation, and related payment services.
• Push notification services: delivery of push notifications to your device.
• Email delivery providers: transactional and (if opted in) marketing emails.
• Hosting & CDN: serving the website, images, and APIs.

We may also disclose information if required by law, to protect our rights and users, or in connection with a business transfer (merger, acquisition, sale of assets).

Your username, avatar, bio, badges, XP, leaderboard position, public coral collection, photos, comments, reviews, marketplace listings, auction listings and auction activity, and certain marketplace and auction transaction information may be visible to other users and may be indexed by search engines. Do not upload anything you would not want to be public.

• Encryption in transit (HTTPS/TLS) for all client–server traffic.
• Encryption at rest for databases and file storage.
• Row-level security policies that restrict data access to the rightful owner.
• Hashed passwords and short-lived authentication tokens.
• AI-assisted moderation to detect abusive or unsafe content.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, or reporting requirements. Specifically:

• Account, profile, and collection data: kept until you delete your account.
• Billing and transaction records: retained for as long as reasonably necessary for business, accounting, tax, legal, dispute-resolution, fraud-prevention, and recordkeeping purposes. This may include marketplace and auction transaction history, sale history, bids, winning bids, payment status, payment authorization records, and related billing information. Certain records may be retained for longer periods when necessary to comply with legal or regulatory obligations or to establish, exercise, or defend legal claims.
• Moderation reports and security logs: kept up to 24 months.
• Analytics events: kept in aggregate, typically up to 24 months.

You can request deletion of your account at any time from Settings → Delete Account. Some personal data may be deleted, but past marketplace and auction transaction records are retained for tax, accounting, and legal compliance. Some residual data may remain in backups for a limited period before being overwritten.

We use cookies, localStorage, and similar technologies to keep you signed in, remember your preferences (e.g. language, theme), secure the Service, and measure usage. You can clear these from your browser at any time, but doing so may sign you out and reset your preferences.

We may send you product updates, announcements, and promotional emails. You can unsubscribe at any time using the link at the bottom of any marketing email, or by adjusting your notification preferences in Settings. Transactional emails (security alerts, billing receipts, password resets) cannot be opted out of while your account is active.

ReefRanks is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@reefranks.com and we will delete the information.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise most of these rights directly from Settings, or by emailing support@reefranks.com.

We reserve the right to change or replace this Privacy Policy at our discretion at any time. When we do, we will update the "Effective as of" date at the top of this page. Material changes may also be communicated by email or an in-app notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For any questions or comments regarding this Privacy Policy, email us at support@reefranks.com.