Scope and privacy approach
This Policy describes the information RareReg currently handles through its registry, marketplace, account, claim, verification, payment, contact, administration, and consent-gated dealer-listing analytics features.
RareReg documents vehicles, not owners. Its business practices do not include selling member personal information. Service providers still process information for hosting, authentication, storage, database, security, payment, and email delivery as described below.
Information collected
Accounts and communications
Supabase Auth processes email address, password/authentication data, confirmation state, session information, and account identifiers. Profiles may contain a display name, membership tier, and administrative status. Contact inquiries include name, email, selected category, message, and a request identifier.
Vehicles and marketplace activity
RareReg may store year, taxonomy, VIN, build number, mileage, colors, engine, transmission, modifications, owner-provided history, coarse public location, sale status, asking price, verification and publication states, ownership relationship, offers, and listing-source information.
Files and reviews
Uploaded vehicle photographs, specialty documents, claim evidence, filenames, captions, visibility choices, moderation decisions, and review records may be stored. Inventory systems may retain normalized and raw source data, match results, warnings, source URLs, seller/dealer attribution, pricing, mileage, location, availability, and sync logs.
VIN and owner privacy
The full VIN is stored as a private vehicle field. Public vehicle responses display only a status such as “VIN verified” or “VIN on file”; they do not return VIN characters.
Account email, owner identity, exact location, private documents, claim evidence, and private offers are not included in public vehicle payloads. Owners are instructed to provide only a coarse region as the public location.
Public and private content
Published registry information can include vehicle specifications, history, modifications, sale status, asking price, coarse location, verification state, approved photos, and verified documents the owner designated public.
Photos are publicly delivered only after approval. Vehicle documents require both public visibility and verification before public delivery. Claim evidence remains limited to the claimant and authorized administrators. External listing source name, seller attribution when supplied, original link, price, and status may be public.
How information is used
- Operate accounts, registry records, marketplace discovery, offers, payments, claims, verification, uploads, and moderation.
- Authenticate users, enforce access controls, prevent duplicates, investigate reports, and protect service integrity.
- Respond to inquiries and send requested or administrative emails.
- Maintain source attribution, listing status, data quality, and ingestion review records.
- When the analytics preference is accepted, provide authorized dealers with aggregate listing-performance reporting about qualifying public vehicle-detail views.
- When the analytics preference is accepted, use Google Analytics 4 to measure aggregate site traffic and usage.
- When the analytics preference is accepted, use RareReg's own first-party site analytics to measure aggregate visitors, sessions, and page views.
- Comply with legal obligations and protect users, RareReg, and third-party rights.
Service providers and disclosures
RareReg currently uses Supabase for authentication, PostgreSQL database services, and private file storage; Vercel for application hosting and delivery; Stripe for server-created payment checkout and payment-event processing; and Resend for contact, business, and transactional email delivery. RareReg does not store complete payment-card details in its application database. Source sites, authorized sellers, dealers, and configured data providers supply or receive listing-related information where applicable. When the analytics preference is accepted, RareReg also uses Google Analytics 4, a service provided by Google, to measure aggregate site traffic and usage.
Information may be disclosed to providers as needed to operate the service, to users according to selected public settings, to source or rights holders for corrections, or when reasonably necessary to comply with law, enforce policies, address fraud or security, or protect rights and safety. RareReg does not treat access to an API or feed as ownership of third-party images.
Cookies, technical data, and dealer-listing analytics
RareReg uses technically necessary Supabase authentication/session cookies, a first-party referral-attribution cookie where applicable, and a short-lived first-party password-recovery cookie. See the Cookie Policy for their purposes and durations.
RareReg uses first-party analytics/performance technology to measure qualifying public vehicle-detail views for authorized dealer listing-performance reporting. RareReg does not create the analytics visitor cookie or collect dealer-listing analytics unless the analytics preference is accepted.
The system uses a random first-party visitor token with an absolute 90-day lifetime and no sliding renewal. The token is transformed server-side using HMAC-SHA-256 and a separate analytics secret. Analytics tables store only the resulting pseudonymous visitor key—not the raw token. They do not store an authenticated user UUID, raw IP address, full user agent, full referrer URL or query string, owner or dealer identity in raw view events, offer content, or payment information.
Source context is coarse and server-derived. The system counts at most one qualifying view per vehicle, pseudonymous visitor, and 30-minute period. Owner, administrator, bot, internal, unpublished-vehicle, and demonstration-record views are excluded. This design is not used for advertising profiling, cross-site tracking, third-party ad targeting, or selling personal information.
When the analytics preference is accepted, RareReg separately uses its own first-party site analytics to measure aggregate visitors, sessions, and page views across the site. Site analytics reuses the same pseudonymous visitor key described above and adds a short-lived, separately keyed session identifier with a 30-minute sliding inactivity window; the raw session token is never stored, only its derived key. Page paths are normalized before storage so that a specific vehicle, user, or other record identifier is never retained—only a general route pattern—and query strings and URL hashes are always removed before storage. A coarse device category (desktop, mobile, tablet, or other) is derived from technical request data and stored in place of the full device or browser identifier. Site analytics does not store an authenticated user UUID, raw IP address, full user agent, full referrer URL or query string, or page content, excludes Administrator browsing, and is not used for advertising profiling, cross-site tracking, third-party ad targeting, or selling personal information.
When the analytics preference is accepted, RareReg also loads Google Analytics 4, a service provided by Google, to measure aggregate site traffic and usage, including approximate page views, sessions, general traffic sources, and coarse device/browser information. Google Analytics 4 does not load, and Google does not receive this data, unless the analytics preference is accepted through the Cookie preferences control described in the Cookie Policy. RareReg has not configured Google Analytics 4 to receive account identity, VIN, private vehicle data, exact location, offer content, or payment information. Google processes any information it receives under its own privacy practices.
The contact endpoint uses a host-forwarded IP address temporarily in server memory to limit abuse. Vercel, Supabase, Stripe, and Resend may process IP address, browser/device, request, diagnostic, security, payment, and delivery data as part of operating their services.
Security and retention
RareReg uses measures including row-level database security, private storage buckets, server-side credential handling, authenticated ownership checks, admin authorization, media approval, and sanitized public queries. No system can guarantee absolute security.
Raw qualifying-view events are retained for no more than 90 days. Non-identifying daily vehicle-level aggregates may be retained longer for historical listing-performance reporting. Raw first-party site-analytics events are separately retained for no more than 90 days, with durable daily site-wide and page-level aggregates retained longer for historical reporting; a small durable record of each pseudonymous visitor's first- and last-seen dates is kept, without page-level detail, to support new-versus-returning reporting beyond that window. Other records are retained while needed to operate the registry and marketplace, preserve vehicle/source and payment history, administer accounts and reviews, resolve disputes, enforce policies, or meet legal obligations. RareReg does not currently offer an automated self-service deletion workflow.
Access, correction, and deletion requests
To request access, correction, or deletion relating to your account or submitted information, email info@rarereg.com or use the Contact form. RareReg may need to verify identity or authority and may retain information where necessary for registry integrity, source history, disputes, security, legal obligations, or records that cannot lawfully or technically be deleted on request.
Jurisdiction-specific consumer rights and response procedures require legal review as RareReg’s entity, operating jurisdiction, and user footprint are finalized.
Children, international use, and changes
RareReg is not designed for children. Because a formal minimum account age and principal jurisdiction have not yet been confirmed, those terms require legal completion before material scale or targeted international operation.
Information may be processed where RareReg’s providers operate. RareReg has not published jurisdiction-specific international transfer terms. This Policy may be updated prospectively; the date above will identify the current version.
Privacy questions: info@rarereg.com.