Privacy Policy

COPPA Compliant — Updated for 2025 Amendments

Last updated: March 27, 2026

1. Overview

Riivster ("we," "us," or "our") operates the website riivster.com and the Riivster collection tracker app (together, the "Service"). Riivster is a Pokemon card collection tracker designed for children ages 7 and older and their families.

We take the privacy of children very seriously. We comply with the Children's Online Privacy Protection Act (COPPA) as amended through the January 2025 Final Rule (effective April 22, 2026), which requires us to get verifiable parental consent before collecting personal information from children under 13.

This policy explains, in plain language, what information we collect, why we collect it, how we use it, and how you can control it. We have updated this policy to reflect the expanded scope of COPPA under the 2025 amendments, including new rules on biometric data, device identifiers, and third-party data sharing.

2. What We Collect from Children

When a child creates an account on Riivster, we collect only what is strictly necessary to provide the collection tracking service:

• Display name — A username the child chooses (does not need to be their real name)
• Email address — Used only for passwordless login (magic link authentication) and essential account notifications
• Birth year — Used only to determine if parental consent is required (under 13). We store only the year, not the full date of birth.
• Card collection data — Photos of Pokemon cards (not photos of the child), card names, conditions, and estimated values
• Friends list — A list of other Riivster users the child has connected with (requires parental approval for under-13 accounts)
• Trade proposals — Records of card trade proposals made between friends
• Achievement data — Badges and achievements earned through collecting activity

3. What We Collect from Parents

When a child under 13 creates an account, we ask for their parent's email address so we can send a COPPA-required approval request. From parents, we collect:

• Parent email address — Used for account approval, weekly activity summaries, and parental notifications
• Approval status — Whether you have approved, denied, or revoked your child's account
• Parental control preferences — Your settings for trading, friend requests, and notification frequency

We do not require parents to create a separate account. All parental controls are accessible via the parent dashboard or a secure link sent to your email.

4. How We Use Your Information

We use the information we collect to:

• Provide the collection tracker — Display your child's Pokemon card collection, estimated values, and achievements
• Enable friend features — Let your child compare collections with approved friends
• Enable trade matching — Help friends propose in-person card trades based on their collections
• Send transactional emails — Magic link logins, parent approval requests, weekly summaries, trade proposals, and value alerts
• Provide parental oversight — Give parents visibility into their child's activity through the parent dashboard and weekly email summaries
• Improve the Service — Fix bugs, improve performance, and add features based on aggregate usage (we do not analyze individual children's behavior)

5. What We Do NOT Do

We do not sell, rent, lease, or share children's personal information with any third party for marketing, advertising, or any commercial purpose. Period.

6. Biometric Data, Device IDs, and Location

Under the 2025 COPPA amendments, the definition of personal information has been expanded to include biometric identifiers, device identifiers, and precise geolocation data. Here is how Riivster handles each category:

Biometric Data

Riivster does not collect any biometric data from children. Specifically:

• We do not use face recognition or face-match technology
• We do not collect voiceprints, fingerprints, or iris scans
• Our card scanner uses the device camera to photograph Pokemon cards only — it uses text recognition (OCR) to read card names, not facial or biometric scanning
• OCR processing happens entirely on your device (client-side). Only the extracted card name text is sent to our servers.

Device Identifiers

Riivster does not collect persistent device identifiers from child users. Specifically:

• We do not use device fingerprinting
• We do not store device IDs, advertising IDs (IDFA/GAID), or hardware identifiers
• We do not run third-party analytics scripts (such as Google Analytics) on any page accessible to logged-in child users
• We use only a functional session cookie required for login — this is not a device identifier

Geolocation

Riivster does not collect geolocation data from child users. We do not access GPS, WiFi, Bluetooth, or cell-tower data. We do not request location permission from the browser or device.

Behavioral Profiling

Riivster does not engage in behavioral profiling of child users. We do not build behavioral models, create interest profiles, or track browsing patterns. Activity logs exist solely for parental oversight (weekly summary emails) and are accessible only to the linked parent.

7. Parental Consent Methods

Under the 2025 COPPA amendments, operators must use verifiable methods to obtain parental consent. Riivster uses the following FTC-approved consent method:

The 2025 amendments also recognize the following new consent methods, which we may implement in the future:

• Text-plus (SMS verification) — Sending a confirmation text message to a parent's verified phone number
• Face-match identity verification — Comparing a parent's photo ID against a live selfie for one-time verification (photo deleted after match)
• Knowledge-based authentication — Verifying parental identity through questions tied to public records

If we add any of these methods, we will update this policy and notify all parents on file.

8. Parental Rights

Under COPPA, parents have the following rights at any time:

• Review your child's information — Access your child's full collection data, friends list, trade history, and account details from the parent dashboard
• Delete your child's account — Request complete deletion of your child's account and all associated data. We will process this within 48 hours. You can also deactivate directly from the parent dashboard.
• Revoke consent — Withdraw your approval at any time, which deactivates your child's account immediately and logs them out of all devices
• Refuse further collection — Request that we stop collecting information from your child while keeping existing data
• Control friend connections — Approve or deny all friend requests for your child's account
• Disable features — Turn off trading, friend requests, or other social features individually from the parent dashboard
• Data portability — Request a copy of all data associated with your child's account in a machine-readable format

To exercise any of these rights, use the parent dashboard, email us at [email protected] from the parent email address on file, or use the parent dashboard link in any weekly summary email.

9. Data Sharing and Third Parties

Under the 2025 COPPA amendments, sharing children's personal information with any third party requires separate, explicit parental consent. Riivster does not share children's personal data with any third party for the third party's own use.

We use a small number of service providers to operate Riivster. These providers act as data processors on our behalf only:

• Cloudflare (Workers, Pages, D1) — Hosts our website, API, and database. Cloudflare processes requests to serve pages, run our application code, and store data encrypted at rest. Cloudflare does not use Riivster user data for its own purposes. See Cloudflare's privacy policy.
• MailChannels — Sends transactional emails only (magic links, parent approvals, weekly summaries). MailChannels receives email addresses for delivery purposes only and does not use email content for advertising. See MailChannels' privacy policy.
• GoHighLevel (LeadConnector) — Our customer relationship management (CRM) system. We only send parent email addresses and the child's display name to our CRM for the purpose of managing parent communications (approval confirmations, weekly summaries). We do not send children's email addresses, collection data, friend lists, or any other child data to our CRM. Parents can request removal from the CRM at any time.
• Pokemon TCG API — We query this public API to retrieve card images, pricing, and set information. Only card names are sent in search queries — no personal data of any kind is transmitted to this service.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking service on pages accessible to logged-in child users. We do not embed any third-party content (social media widgets, ads, or external scripts) in the collection tracker. Google Analytics is used only on our public marketing pages (homepage) which do not require login and do not process child data.

10. Cookies and Tracking

We use only essential cookies required to keep you logged in:

• Session cookie (riivster_session) — Stores your login session so you do not have to log in every time you visit. This cookie is HTTP-only, secure, and deleted when you log out or after 30 days of inactivity.
• Cloudflare security cookies — Cloudflare may set cookies to protect against bots and attacks. These are strictly functional and contain no personal information.

We do not use on child-facing pages:

• Analytics cookies or scripts (e.g., Google Analytics, Mixpanel)
• Advertising cookies or pixels (e.g., Facebook Pixel, Google Ads)
• Cross-site tracking cookies
• Tracking pixels in emails sent to children
• Device fingerprinting, canvas fingerprinting, or WebGL fingerprinting
• Session recording or heatmap tools (e.g., Hotjar, FullStory)

11. Data Retention

We retain your child's data for as long as their account is active. Specifically:

• Active accounts — Data is retained as long as the account remains active and a parent has not requested deletion
• Inactive accounts — If an account has no login activity for 12 consecutive months, we will email the parent before deleting the account and all associated data
• Deletion requests — When a parent requests account deletion, we permanently delete all personal data within 48 hours. Card collection data that has been anonymized for aggregate statistics may be retained.
• Unapproved accounts — If a parent does not approve their child's account within 14 days, we automatically delete the pending account and all data collected during signup
• Guest vault data — Guest vaults (used before account creation) are deleted after 30 days of inactivity. IP addresses used for rate limiting are not retained beyond the rate-limiting window.

12. Data Security

We protect your data using industry-standard measures:

• All data is transmitted over HTTPS (TLS 1.3)
• Database is encrypted at rest (Cloudflare D1)
• Authentication uses secure, time-limited magic links (no passwords are stored anywhere)
• Parent approval tokens are cryptographically signed (HMAC-SHA256) and expire after 7 days
• Session tokens are cryptographically signed and expire after 30 days
• Access to the database and server infrastructure is restricted to authorized personnel
• Cloudflare provides DDoS protection, bot management, and Web Application Firewall (WAF)

No system is 100% secure. If we become aware of a data breach affecting children's information, we will notify affected parents within 72 hours and take immediate steps to contain the breach, in compliance with applicable breach notification laws.

13. Enforcement and Penalties

We take COPPA compliance extremely seriously. Under the 2025 amendments:

• COPPA violations carry civil penalties of up to $53,088 per violation per day
• The FTC has expanded enforcement to cover operators that have "actual knowledge" or "constructive knowledge" that they are collecting children's data
• Third-party sharing of children's data now requires separate parental consent
• COPPA Safe Harbor programs must ensure participants comply with the updated rules

We regularly audit our data practices, review our code for compliance, and update this policy as regulations evolve. Our most recent data minimization audit was completed on March 27, 2026.

14. Changes to This Policy

If we make material changes to this privacy policy, we will:

• Email all parents on file at least 30 days before the changes take effect
• Post the updated policy on this page with a new "Last updated" date
• Require re-consent from parents if the changes involve new types of data collection from children
• Under the 2025 amendments, if we begin sharing children's data with a new third party, we will obtain fresh parental consent before doing so

15. Contact Us

If you have questions about this privacy policy, want to exercise your parental rights, or need to report a concern, contact us:

If you believe we have collected information from a child without proper parental consent, please contact us immediately at [email protected] and we will promptly investigate and delete any unauthorized data.

You may also file a complaint with the Federal Trade Commission (FTC) at reportfraud.ftc.gov.