Privacy Policy

The Operator of RiftMarket.ca is YOUR_LEGAL_NAME. Privacy requests can be submitted via the contact form (/contact, sign-in required).

This policy applies to visitors and registered users of the Site.

We collect only what we need to operate the marketplace, communicate with you, and keep the Site secure.

• Account data: email address, password (stored securely by our auth provider), and optional display name.
• Profile data: exchange location preferences, seller/buyer ratings, and account settings.
• Marketplace activity: listings you create (including photos), cart contents, offers and order status, messages between buyers and sellers, reviews, reports, watchlist and wishlist entries.
• Notifications: in-app notification history; transactional emails to your account email for marketplace alerts; if you opt in, browser push subscription data (endpoint and keys) to send alerts.
• OAuth sign-in: if you use Discord or Google, we receive basic profile information those providers share with us (such as email and display name).
• Technical data: session cookies required for login, IP address and browser information in server logs, and similar data our hosting and database providers process.
• Future payment data: if we enable Stripe or similar services, we may collect payment identifiers, subscription status, and payout onboarding data as described at activation.

We use personal information for the following purposes:

• Creating and managing your account.
• Displaying listings, profiles, and messages to other users as part of the marketplace.
• Sending offers, order updates, wishlist alerts, and other in-app, email, or push notifications you expect from the service.
• Moderating content, investigating reports, and protecting users.
• Improving and securing the Site, including debugging and fraud prevention.
• Complying with legal obligations and enforcing our Terms of Service.
• Processing payments or subscriptions if and when those features are enabled.

By creating an account and checking the box agreeing to our Terms and this Privacy Policy, you consent to collection and use as described here.

For optional features (such as browser push notifications), we ask for separate permission through your device or browser.

You may withdraw consent for non-essential processing by contacting us or adjusting settings, subject to legal or contractual limits.

We do not sell your personal information. We share data with service providers who help us run the Site, under contracts that require them to protect it:

Some providers may process data in Canada, the United States, or other countries. We choose reputable vendors and limit sharing to what they need to perform their services.

We may disclose information if required by law, court order, or to protect rights, safety, and security of users or the Operator.

Other users can see information you choose to publish (display name, listings, public profile, messages in conversations you participate in, and reviews).

• Supabase (authentication, database, and file storage for listing images).
• Hosting and infrastructure providers that serve the Site (for example Vercel or similar).
• OAuth providers (Discord, Google) when you choose to sign in with them.
• Web push infrastructure when you subscribe to notifications.
• Resend (or similar) for transactional notification and order emails sent to your account address.
• Stripe or similar payment processors if platform payments or seller subscriptions are enabled.

We use industry-standard measures such as encrypted connections (HTTPS), access controls, and row-level security in our database where configured.

No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential.

We retain personal information while your account is active and as needed for legal, security, and dispute-resolution purposes.

You may request account deletion or correction by emailing us. We will respond within a reasonable time and delete or anonymize data unless we must keep it by law.

Backups and logs may persist for a limited period after deletion.

If you are in Canada, you may request access to, correction of, or deletion of personal information we hold about you, subject to legal exceptions.

You may challenge our compliance with PIPEDA by contacting us first. You may also file a complaint with the Office of the Privacy Commissioner of Canada (OPC).

Residents of Ontario and other provinces may have additional rights under local privacy laws.

If you enable push notifications, we store a push subscription tied to your account so we can alert you about messages, offers, and wishlist matches.

You can disable notifications in your browser or device settings and through your account notification preferences where available.

The Site is not directed to anyone under 18. We do not knowingly collect personal information from children. Contact us if you believe we have done so inadvertently.

We may update this Privacy Policy from time to time. The "Last updated" date shows when changes took effect. Continued use after updates means you accept the revised policy, to the extent permitted by law.

Privacy questions or requests: use the contact form (/contact, sign-in required).

Please include enough detail for us to identify your account and the nature of your request.