Privacy Policy

What Rackears collects

Rackears collects the information needed to run the public catalog and user account system. This can include your name, email address, authentication identifiers, provider metadata, and standard technical information such as IP address, device/browser details, and request logs.

If you create an account with Google, Rackears receives the basic profile information Google shares for sign-in, including your email address, display name, and the provider identifier required to link your account.

How Rackears uses this data

Rackears uses account and technical data to:

• create and maintain your account
• authenticate logins with email/password or Google
• link your public account to the existing Rackears user record
• send transactional emails such as signup confirmation and sign-in related notices
• operate, secure, debug, and improve the Rackears product catalog

How Google user data is handled

If you choose Google sign-in, Rackears uses Google user data only to authenticate your account and maintain your login. Rackears does not sell Google user data and does not use it for advertising.

Google account data received through the OAuth flow is limited to the basic scopes used for identity and sign-in. Rackears uses that data only for the purposes described in this policy.

How data is stored and shared

Rackears stores account information with service providers that help run the application, including Supabase for authentication and database services, Vercel for hosting, Cloudflare for media delivery, Loops for transactional email delivery, and PostHog for product analytics.

Rackears shares data with those providers only to the extent needed to operate the service. Rackears may also disclose information when required by law, to enforce its policies, or to protect the security of the service and its users.

Product analytics

Rackears uses PostHog Inc. (United States) as a sub-processor for product analytics. PostHog is certified under the EU–U.S. Data Privacy Framework, which provides the legal basis for transfers of personal data from the European Economic Area, the United Kingdom, and Switzerland to the United States.

Rackears captures the following analytics events: page views, the referring website that brought you to the catalog, the product or manufacturer terms you type into search, the filters you click on product listings, the products you view, and the navigation links you follow from the Browse menu. For visitors who are not signed in, Rackears stores no identifying cookies and does not create a person profile in PostHog. For signed-in users, Rackears identifies you to PostHog by your account, including your email address and display name, and stores an identifier in your browser so your activity stays linked across reloads while you are signed in.

Rackears also captures limited, anonymized session replays — recordings of on-page interactions such as clicks, scrolling, and navigation — to diagnose usability problems. All form fields are masked: the contents of inputs are never recorded, and Rackears does not capture network request or response bodies. Session replay is not collected at all for visitors in the European Economic Area, the United Kingdom, or Switzerland; elsewhere replay is on by default and can be switched off at any time using the control below. Do Not Track is honored and disables all analytics, including replay.

The legal basis for this processing is legitimate interest under Article 6(1)(f) GDPR for anonymous events, and consent obtained through the Terms of Service for signed-in users. Session replay is not performed for visitors in the European Economic Area, the United Kingdom, or Switzerland; where it is performed it relies on the same legitimate-interest basis as anonymous events. You can change your preference at any time using the switch below or the Manage tracking link in the site footer; your choice is stored locally in your browser and persists until you change it or clear site data.

Affiliate and outbound links

Rackears links out to manufacturer sites, retailers, marketplaces, and code repositories. Some outbound links may include affiliate tracking parameters, and Rackears may earn a commission if you click them and make a purchase, at no additional cost to you.

As part of the product analytics described above, Rackears records outbound link clicks — including the full destination link you clicked, its host, and the related product. For signed-in users these clicks are linked to your account; for signed-out visitors they are not tied to a person profile. See the Affiliate Disclosure for more detail.

Catalog correction reports

If you submit a report about incorrect or missing catalog data, Rackears stores the report details you provide, the page and item the report relates to, and a snapshot of the public catalog data shown at the time of submission. Reports are reviewed before any public catalog data changes.

For signed-out reports, Rackears creates a one-way, secret-salted fingerprint from request information such as IP address and browser user agent. Rackears stores only the resulting fingerprint, not the raw IP address, and uses it to limit abuse of the public reporting form. This processing is separate from PostHog product analytics. Turning off analytics does not disable this anti-abuse check when you choose to submit a report.

Retention and security

Rackears keeps data for as long as reasonably necessary to operate the service, comply with legal obligations, resolve disputes, and enforce agreements. Reasonable technical and organizational safeguards are used to protect account and service data.

Your choices

You can choose whether to create an account, whether to use Google sign-in, and whether to continue using the service. If you want your account data removed or corrected, contact Rackears through the public site and include the email address associated with your account.

Changes to this policy

Rackears may update this Privacy Policy from time to time. When this page changes materially, the update date above will be revised and the new policy will apply from that date forward.