Privacy Policy
What we collect and where it lives
| What | Where it's stored |
|---|---|
| Collection, photos, grades, listings, XP, settings | Your browser's local storage on this device. Clearing site data or (on iPhone Safari) not visiting for a while can erase it, so use Settings → Export to keep a backup. |
| Device-only accounts (display name, username, password) | Device-only accounts: your password is stored in this browser as a salted one-way hash (PBKDF2). Anyone with access to this browser could still use the account, so sign out on shared devices and use a password you don't use anywhere else. |
| Email accounts (when member accounts are turned on) | Our account provider, Supabase, stores your email, username, display name and approval status. Supabase stores passwords hashed, and we never see them. |
| Reports and SI Court cases (reason, details, photos and messages you attach, decisions and appeals) | On this device until member accounts are on; then in our Supabase database, visible only to you (your own reports and penalties) and the founder. The person you report never sees who reported them. |
Services that receive data
- Google: if you use Google sign-in, Google shares your name and email with us under its own privacy policy.
- Stripe and PayPal: they process payments. We never see your card number.
- Supabase: our account and database provider for member accounts and any features that sync.
- Content delivery: Slab Republic's pages, fonts and scripts are served from our own hosting providers.
Camera card scan
When you scan a card, Slab Republic uses your camera only after you allow it in your browser. The photo is read on your device to fill in card details and is saved only in your browser's storage with your collection, unless you choose to list or report it (then it's shared as described here). Turn off camera access anytime in your browser settings.
Chancellor chat
Chancellor answers run on built-in engines in your browser; members' Chancellor chats are not sent to any outside AI company. Messages you type stay on this device unless a feature says otherwise. The founder's own Founder AI tool sends the founder's messages to Slab Emporium's own server (hosted on DigitalOcean in the US); it is not used for member chats.
Chat counts, partner requests and plan status
Chancellor chat counts. To apply daily chat limits we store, for your account, how many Chancellor chats you used each day and your Boost Pack balance. We don't store the text of member chats on our servers. Partner requests. If you request partner access we keep your organization name, contact name, email, website and message to review it and reply. Ask us to delete it any time. Plan status. Stripe tells us whether your Pass is active, and we save that status with your account.
Waitlist and email
If you join a waitlist or turn on email alerts, we keep your email address to send those messages. Alerts are sent through our email provider (Resend). Every marketing email has an unsubscribe link, and you can also ask to be removed by emailing support@xoraos.app. We don't sell email lists.
Payments
Empire Pass and other Slab Republic payments are handled by Stripe; marketplace buyers pay sellers through PayPal. They receive your name, email, card or account details and billing address under their own privacy policies. We receive only what we need to run your account, such as your plan, payment status and the last digits or type of card, never your full card number.
How long we keep data
On-device data stays until you clear it. Account data is kept as long as needed to run your account and meet legal duties, including records we must keep for tax, payments, fraud prevention or legal reasons (such as order and payment records). Waitlist emails are kept until you unsubscribe or the waitlist ends.
Your state privacy rights
Depending on where you live (for example California, Texas, Virginia, Colorado, Connecticut and other states), you may have the right to know what personal data we have, get a copy, correct it, delete it, and opt out of its sale, sharing for targeted ads, or profiling. We don't sell personal data or share it for targeted advertising. To make a request, email support@xoraos.app with the subject "Privacy request". We'll verify it's you and answer within 45 days. If we say no, you can appeal by replying to our answer, and you can contact your state attorney general. We won't treat you differently for using these rights.
Cookies and local storage
Slab Republic doesn't use advertising or analytics cookies. It uses your browser's local storage and session storage to save your collection and keep you signed in. We don't use cookies that require a consent banner today; if we ever add analytics or advertising cookies, we'll ask first. You can clear this anytime in your browser settings or with Settings → Clear all data.
Children
Slab Republic is for adults 18 and older in the United States. We don't knowingly collect personal information from anyone under 18. If you think someone under 18 has an account, email us and we'll delete it.
How we use data
We use data only to run Slab Republic: show your collection, process listings and approvals, keep accounts secure, and answer you when you contact us. We don't sell or rent your personal data. We don't use your data, listings, photos or messages to train any outside AI or machine-learning models, and we don't let anyone else do so.
Your choices
- Export or delete your on-device data in Settings.
- Ask us to access, correct or delete your account data by emailing support@xoraos.app.
Security
We use HTTPS, server-checked founder access and database row-level security. No system is perfect, so please use a unique password.
Changes and contact
We'll update the date above when this policy changes. Slab Emporium LLC · [mailing address] · support@xoraos.app · [phone] · admin@xoraos.app. You can also send requests by mail to the address above.