Privacy Policy

Ragna.gg is operated by:

We collect information you provide directly, information generated through your use of the Service, and information from third-party providers used to operate the marketplace.

Account Information

• username / handle and display name
• email address
• password (stored hashed; we never see your raw password)
• profile information you choose to add (avatar, bio, profile decorations)
• data returned by Google when you sign in with Google OAuth (such as email, name, profile picture, Google user ID)

Authentication and Security Data

• session tokens and refresh tokens
• trusted-device tokens stored on your device to remember 2FA approvals
• one-time password (OTP) activity, including codes issued, verified, or failed
• IP address, user agent, and device/browser fingerprints
• Cloudflare Turnstile and other bot-protection signals collected at signup and sensitive actions
• login attempts, password reset attempts, and suspicious-activity events

Marketplace and Order Data

• listings you create, edit, or delete (titles, descriptions, prices, images, regions, platforms)
• orders, purchases, and sales history
• escrow status, delivery confirmation, and 3-day auto-release status
• refund, chargeback, and dispute records
• reviews and ratings you submit or receive
• wishlist items, price-drop notifications, and platform notifications

Chat and Communications

• buyer-seller chatroom messages, replies, and reactions
• chatroom status (open, closed, locked, disputed)
• media and attachments uploaded into chat
• support tickets, dispute messages, and seller delivery messages
• messages exchanged with our support team through Intercom

This information is used for order fulfillment, dispute resolution, fraud prevention, and customer support.

Seller Information

If you apply to become a seller or operate as one, we may collect:

• seller application responses and status
• identity verification information where required (such as government-issued ID, legal name, residential address, proof of address)
• business or tax information for company sellers where applicable
• uploaded seller documents (stored in a private storage bucket)
• seller payout details (such as Wise, Payoneer, or bank account information)
• seller performance data (sales, ratings, response time, dispute history)

This information is used strictly for identity verification, fraud prevention, payout processing, and regulatory or accounting compliance.

Payment Data

• payment status, payment intent IDs, and order IDs
• amount, currency, and refund/dispute metadata
• billing country and similar non-sensitive payment metadata returned by our payment processor

Ragna does not store full credit or debit card numbers. Full payment card details are collected and processed directly by Stripe.

Technical and Usage Data

• IP address, approximate location derived from IP, ISP
• browser type, operating system, device type, screen size, language, time zone
• pages viewed, referring URLs, access times, clicks and interactions
• logs, error reports, and performance telemetry

Advertising and Analytics Data

• Meta Pixel and Meta Conversions API (CAPI) events such as page views, product views, checkout starts, registrations, leads, and purchases
• hashed identifiers (such as a hashed email or user ID) sent to Meta where applicable
• Meta browser identifiers (fbp, fbc) and click identifiers (fbclid) when available
• Google Ads tag (gtag.js) page traffic, remarketing data, and Purchase conversion events tied to a confirmed payment intent ID, amount, and currency
• aggregate analytics about how the Service is used

We use personal information to:

• create and maintain your account, including sign-in with email or Google OAuth
• operate the marketplace, including listings, search, purchases, and order fulfillment
• enable buyer-seller chat and order communications
• operate the escrow flow, including delivery confirmation, disputes, refunds, and the 3-day auto-release timer
• verify seller identity where required and process seller payouts via Wise, Payoneer, or bank transfer
• detect and prevent fraud, abuse, account takeover, bot activity, and chargeback abuse
• provide customer support, including live chat through Intercom
• send transactional emails such as one-time passwords (OTPs), account notifications, order updates, and dispute updates through Resend
• send wishlist price-drop notifications and platform notifications you have not disabled
• measure marketing performance through Meta Pixel, the Meta Conversions API, and the Google Ads tag (including conversion measurement and remarketing)
• comply with legal, tax, accounting, payout, and chargeback obligations
• monitor performance, debug issues, and improve the Service

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the marketplace, process orders, deliver items, run escrow, and pay sellers
• Legitimate interests: to secure the Service, prevent fraud and abuse, operate analytics, measure marketing, and improve the Service
• Legal obligation: to comply with tax, accounting, anti-fraud, payout, and similar requirements
• Consent: where required for marketing cookies, ad measurement, or other optional processing

Where we rely on consent, you can withdraw it at any time without affecting prior processing.

Payments on Ragna.gg are processed by Stripe. Payment methods such as Apple Pay and Google Pay are surfaced through Stripe; Ragna does not operate them independently.

Ragna may store:

• payment intent IDs, order IDs, amounts, currency, and status
• refund, dispute, and chargeback metadata
• delivery, escrow, and auto-release status
• seller earning records and payout history

Funds for marketplace purchases may be held and released in line with our escrow rules, including buyer confirmation, open disputes, and the 3-day auto-release timer after delivery.

If you are a seller, your payout details (such as Wise, Payoneer, or bank account information) are used to send your earnings. We may pause or freeze payouts where required by a dispute, suspected fraud, chargeback, or legal request.

To protect the marketplace and its users, we use measures including:

• identity verification for sellers where required
• transaction and behavior monitoring
• automated risk detection and rate limiting
• manual review of suspicious activity
• Cloudflare Turnstile bot protection at signup and sensitive actions
• trusted-device tokens and OTP-based 2FA flows
• payment risk checks performed by Stripe

We do not sell your personal information in the everyday sense of the word. We share personal information with service providers and processors who help us operate, secure, analyze, and improve the Service, and only as needed for those purposes.

Service Providers and Processors

• Stripe — payment processing, payment risk, refunds, and dispute handling
• Supabase / Lovable Cloud — hosting, database, file storage, authentication, and backend infrastructure
• Resend — transactional emails such as OTPs, account notifications, and order updates
• Intercom — live chat, support messaging, and user attributes needed to run support
• Cloudflare Turnstile — bot protection and security challenges
• Meta (Facebook) — Pixel, Conversions API, and advertising measurement, including hashed identifiers where applicable
• Google — Google OAuth sign-in where you choose to use it, and the Google Ads tag (gtag.js) for advertising measurement, conversion tracking, and remarketing
• Wise, Payoneer, and banks — to pay out seller earnings where applicable

Other Users

Certain information is shared with the other party of a transaction or with the wider public marketplace, including your handle, avatar, profile decorations, listings, reviews, and seller performance information. Chat messages and delivery information are shared with the other party in the order.

Legal and Safety

We may disclose information when required by law, subpoena, court order, regulator request, or to protect the rights, property, or safety of Ragna, users, or others, including to prevent fraud or enforce our Terms.

Business Transfers

If Ragna is involved in a merger, acquisition, reorganization, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law.

Ragna uses cookies, local storage, and similar technologies. They fall into two broad groups:

Strictly Necessary

• authentication, session, and refresh tokens
• trusted-device tokens for 2FA
• Cloudflare Turnstile and security signals
• checkout, cart, and order flow state
• language, currency, and basic site preferences

These cannot be disabled without breaking core functionality.

Analytics and Marketing

• Meta Pixel and Conversions API events
• Meta browser identifiers (fbp, fbc) and click identifiers (fbclid) when present
• Google Ads tag (gtag.js) for traffic measurement, remarketing audiences, and Purchase conversion tracking
• aggregate analytics about how the Service is used

You can accept or reject marketing/analytics cookies at any time using the Cookie settings link in the footer. When you reject (or when your browser signals Global Privacy Control), neither the Meta Pixel, the Meta Conversions API, nor the Google Ads tag are loaded or fired, and the fbp/fbc identifiers are not sent. You can also limit ad-tracking through your browser settings, your operating system's ad preferences, your Meta ad preferences, and your Google ad settings. For privacy requests, contact business@ragna.gg.

We use the Meta Pixel (client-side) and Meta Conversions API (server-side) to measure ad performance and understand actions on the Service such as page views, product views, checkout starts, registrations, leads, and purchases.

To support better measurement, we may send Meta:

• hashed identifiers such as a hashed email address or hashed user ID
• browser identifiers such as fbp and fbc
• click identifiers such as fbclid when present
• non-sensitive event details such as event name, currency, value, and content IDs

We do not send full payment card numbers or full passwords to Meta. You can manage ad personalization through your Meta account settings and your browser controls.

Google Ads tag. We also use the Google Ads tag (gtag.js) for traffic measurement, remarketing audiences, and Purchase conversion tracking. The Google Ads tag is loaded only after you accept marketing cookies. On a successful purchase we send Google the server-confirmed payment intent ID, amount, and currency for conversion attribution. We do not send full payment card numbers, passwords, chat content, or seller credentials to Google.

We implement technical and organizational safeguards designed to protect personal information, including:

• hashed password storage and OAuth-based sign-in
• OTP, trusted-device, and session monitoring controls
• Cloudflare Turnstile and fraud checks
• row-level security on the database
• private storage buckets for chat media, seller documents, and other sensitive files, accessed through signed URLs or controlled access
• restricted internal access and audit logging on sensitive actions

No internet service is 100% secure. We cannot guarantee absolute security, but we work to address known risks promptly.

We keep personal information for as long as needed for the purposes described in this policy. In practice:

• account data is kept while your account is active
• transaction, order, payment, payout, refund, dispute, and chargeback records are kept as needed for legal, tax, accounting, fraud prevention, and marketplace integrity reasons
• chat messages tied to orders are kept for dispute and support purposes and may be auto-closed after a period of inactivity
• security and fraud logs are kept for as long as needed to detect and investigate abuse
• marketing and analytics data is kept for as long as needed for measurement and reporting

When you request deletion, we will remove or anonymize personal information that we are not required to keep for legal, financial, security, or operational reasons.

Depending on where you live, you may have rights under laws such as the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and similar laws. These can include the right to:

• access the personal information we hold about you
• correct inaccurate personal information
• request deletion of your account or personal information
• request a portable copy of certain information
• object to or restrict certain processing, where applicable
• opt out of marketing or advertising tracking, where applicable
• for California residents: know, access, delete, correct, and opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising, plus the right not to be discriminated against for exercising these rights

To make a request, email business@ragna.gg from the email address on your account. We may need to verify your identity before acting. We do not currently offer a fully automated privacy portal.

Some information may be retained where we are legally or operationally required to keep it (for example, financial records, fraud and security records, and dispute history).

Ragna and its service providers may process personal information in the United States and other countries, including countries whose data protection laws differ from those in your country. By using the Service, you understand that your information may be transferred to and processed in these countries. Where required, we work with providers that offer recognized safeguards for international transfers.

The Service is intended only for individuals 18 years of age or older.

We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will take steps to delete it where required. Users under 18 must not create accounts or use the Service.

If a security incident affects your personal information, we will investigate and respond, and will notify affected users and regulators where legally required.

We may update this Privacy Policy from time to time. Updated versions will be posted on this page with a revised "Last updated" date. Material changes may be highlighted in-product or by email. Continued use of the Service after the effective date means you accept the updated policy.

For questions regarding this Privacy Policy, please contact: