Privacy Policy

The short version

• You can play Free Play without an account. Packs you open as a guest are made in your browser and are never stored on our servers.
• An account needs your email address and the year you were born. We keep the email and your age range (13–17 or 18+), not the year.
• We never sell your personal information.
• Ads come from Google. Guests, and anyone who hasn’t confirmed they’re 13 or older, only get non-personalized ads. You can turn personalized ads off in Your ad choices.
• You can ask to see, correct or delete your information through our contact form.

What we collect

When you play as a guest

• Nothing about your packs. Free Play packs are generated in your browser. We don’t receive or store what you open.
• Settings on your device. Your sound on/off choice is saved in your browser’s local storage. While you sign in, the birth year you enter (and an under-13 answer, if you give one) is kept in session storage, which your browser clears when you close the tab.
• Standard request details. Like every website, our host receives your IP address, your browser’s user agent and the pages you ask for, so it can deliver the site and protect it from abuse.

When you have an account

• Email address. We use it to sign you in with one-time links (there are no passwords) and, if you ever win a prize, to tell you about it.
• Age range. Sign-in asks the year you were born. We work out your age range from it and save only “13–17” or “18+”, never the year.
• Your play. The binder packs you open (the set, the cards, their value and when), your binder and set completion, the cards you grade into RIPMINT slabs, your chase list, the card back you picked, your daily check-in streak and XP, and your pack allowance (including how many packs you earned from optional ads today).
• Sign-in sessions. When you sign in, we store the session together with the IP address and browser user agent it started from, to keep accounts secure.
• Today’s best pulls. Your best binder-pack pulls can appear on the public “Today’s best pulls” board, showing the card and its value only, never your name, email or account.

When you contact us

• The email address you give us (so we can reply), your topic and your message, and a link to your account if you’re signed in.
• To stop spam, we limit how many messages one connection can send. For that we keep a one-way code made from your IP address with a secret key, never the address itself.

Prize claims (only if prizes ever run)

Prizes are switched off today. If we ever run a promotion and you win:

• We’d ask for your legal name and mailing address to ship the prize. They are encrypted, field by field, before they’re stored.
• We keep your state in plain text (it decides eligibility and appears on the winners list) and a keyed fingerprint of your address so each household can win once.
• Winners appear publicly as “Jane D. (CA)” only if they choose to; otherwise as “A player in CA”.
• If one winner’s prizes reach $600 in a calendar year, US tax law requires us to collect a W-9 tax form from them.

The official rules of any promotion will explain the rest.

How we use it

• To run Free Rip Club: sign you in, save your binder and progress, refill your binder packs and give daily rewards.
• To keep it safe: limit requests, stop spam and abuse, and secure accounts.
• To answer the messages you send us.
• To show ads (see below).
• To run prizes, if they ever launch, including eligibility checks, shipping and tax duties.

We don’t send marketing email.

Cookies and device storage

• Sign-in cookie. One cookie of our own keeps you signed in. Scripts on the page can’t read it, and it expires about a week after your last visit.
• Device storage. Your sound setting, and the sign-in age answer for the current tab, as described above.
• No analytics trackers. We don’t run third-party analytics.
• Advertising cookies from Google when ads are shown (see Ads).
• Card images load straight from Scryfall (Magic) and TCGdex (Pokémon), so those services receive your IP address and browser details, as any image host does.

Who helps us run the site

We share personal information only with services that help run Free Rip Club, for that purpose:

• Vercel hosts the site and runs our servers.
• Neon hosts our database.
• Resend delivers our email, such as sign-in links.
• We use Sentry to find and fix errors. Error reports contain technical details about the problem and your browser, and we’ve set Sentry not to store IP addresses.
• Google AdSense shows ads and uses cookies (see Ads).
• TCGplayer: when you click a price or buy link, you go to TCGplayer’s site. TCGplayer and its affiliate network can tell the visit came from us, and their privacy policies apply there.

We may also disclose information when the law requires it, or to protect someone’s safety or our rights.

Ads

Free Rip Club is paid for by ads from Google AdSense. Optional rewarded ads, which give extra binder packs, come from Google Ad Manager. Google and its partners use cookies to show ads, measure them, limit repeats and fight fraud.

• Personalized ads use your visits to this and other websites to choose ads for you. Learn how Google uses information from sites that use its services.
• Guests, and anyone who hasn’t confirmed they’re 13 or older, only get non-personalized ads. Those aren’t based on your browsing history, though Google may still use cookies to limit how often you see an ad, report on ads and prevent fraud.
• You can change how Google personalizes ads in Google’s Ads Settings, and opt out of personalized ads from many other companies at aboutads.info.

Your ad choices

You can turn off personalized ads on Free Rip Club at any time.

We honor Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as your request to opt out of personalized ads and of any “sale” or “sharing” of your information for ads. You don’t need to do anything else.

We don’t sell your information

We don’t sell your personal information. Under California law, letting Google show you personalized ads can count as “sharing” your information for cross-context behavioral advertising. You can opt out of that at any time in Your ad choices or with Global Privacy Control.

Children

• Anyone can play Free Play as a guest without giving us any personal information.
• Accounts are for people 13 and older, and players under 18 need a parent’s or guardian’s permission (see our Terms of Use).
• Sign-in asks the year you were born before it asks for an email. If the answer means you could be under 13, the email form never appears, and your browser remembers that answer until the tab is closed.
• If an account turns out to belong to someone under 13 (for example, they enter their birth year after opening a sign-in link on another device), we delete the account and everything in it straight away.
• Guests, and anyone who hasn’t confirmed they’re 13 or older, only get non-personalized ads.
• If you think a child under 13 has given us personal information, tell us and we’ll delete it.

Your privacy rights

Wherever you live, including under California’s and other US states’ privacy laws, you can ask us to:

• Know what personal information we have about you, and get a copy of it.
• Delete your personal information, including your whole account.
• Correct information that’s wrong.
• Opt out of the “sharing” of your information for cross-context behavioral advertising, in Your ad choices or with Global Privacy Control.

To make a request, use our contact form and choose “Privacy request (access/delete/correct)”. We’ll confirm it’s you by writing to the email address on the account, and we’ll answer within 45 days. An authorized agent can ask for you; we may ask for proof that you gave them permission. We won’t treat you differently for using any of these rights.

How long we keep it

• Account information stays while you have an account. When you ask us to delete it, we delete the account and its binder, packs, slabs, chase list, streak, settings and sign-in sessions.
• Sign-in sessions expire about a week after your last visit; their records (with the IP address and browser each started from) are deleted with your account. Sign-in links stop working after 10 minutes and are then cleared automatically.
• Security rate-limit records that hold IP addresses are short-lived and cleared automatically.
• Contact messages are kept while we handle them and afterwards as a record. We keep records of privacy requests for 24 months, as California’s rules require.
• Prize entries, if prizes ever run, stay after an account is deleted but without any link to it, so a finished promotion’s entry list never changes. Winner details are kept as long as tax and prize laws require.

How we protect it

• The whole site uses HTTPS, and signing in uses single-use email links, so there are no passwords to steal.
• Prize winners’ names and addresses are encrypted before they’re stored.
• The contact form stores IP addresses only as keyed one-way codes.
• On the site, only a short list of verified administrator accounts can see contact messages or prize claims.

No system is perfectly secure, but we work hard to protect your information.

Where it’s processed

We and the services that help us process information in the United States and the other countries where those services operate.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change is significant, we’ll also post a notice on the site before it takes effect.

Contact us

Questions or requests? Use our contact form. For a privacy request, choose “Privacy request (access/delete/correct)”.