Privacy Policy

This policy describes what RF4 collects, why, who processes it, how long we keep it, and how to ask for deletion. RF4 is operated from Canada. Contact: support@rf4.app.

What we collect

• Identity (Clerk): account id, email, name you provide, authentication session.
• Profile: username, display name, avatar, bio, date of birth (used for the 18+ deposit gate), optional location/social handles.
• Marketplace: shops, listings, cart, orders, order messages, uploaded delivery files and listing images, reviews, disputes, payout address and coin (sellers), deposit invoices.
• Wallet ledger: Charm balances and double-entry posts. This is financial-operational data for escrow, fees, and bonus expiry — not a bank statement.
• Technical: IP address and user-agent as seen by our host (Netlify) and database (Supabase) in server logs; webhook payloads from NOWPayments (payment id, amounts, currency).

Why

To create your account, run the marketplace and wallet, verify age for deposits, prevent fraud, complete crypto invoices and seller payouts, moderate prohibited content, and respond to support requests. We do not sell your personal information.

Processors

• Clerk — authentication
• Supabase (PostgreSQL and file storage) — application data
• NOWPayments — crypto invoices and seller payouts
• Netlify — hosting, scheduled jobs, and HTTPS logs

Each processor has its own privacy terms. We only send them what that function needs.

Retention

• Account and profile: while the account is open, then as needed to close disputes or meet law.
• Ledger, deposits, orders, disputes: retained as financial records (typically at least 6 years in Canada, subject to counsel).
• Order files: while the order is active and a reasonable period after completion for disputes.
• Server logs: typically 30–90 days unless needed for security investigation.

Your requests

Email support@rf4.app to access, correct, or delete personal data we hold. We may keep ledger rows that are required to show where Charms moved (they identify accounts, not a cash balance). We cannot delete information a payment processor is required to keep. PIPEDA and applicable provincial privacy laws may give you additional rights.

Children

The marketplace and deposits are 18+. Accounts under 13 are not permitted.