Privacy Policy
Last updated 19 September 2026
Rarium stores one piece of personal information about your buyers: the email address it sent their reveal link to. It is used for that one message, erased automatically after 90 days, and never used for marketing. No names, no phone numbers, no shipping addresses, no payment details and no IP addresses. Pull records themselves are keyed to Shopify order identifiers only.
Rarium is a Shopify app that lets a store build mystery boxes from its own inventory. A buyer purchases a box, Rarium runs a server-side weighted draw, and the item that was pulled ships as a normal order line. This policy describes what data SAND RUSH AG holds in order to do that, and what it does not.
What Rarium Stores
About Your Store
- Your
myshopify.comdomain, the access token Shopify issues to the app, and the permissions you granted. - The products and variants you chose as boxes and as prizes: Shopify identifiers, titles, values, condition grades and rarity tiers.
- Your configuration. Box settings, gift rules, reveal appearance styles, blocked regions and the disclaimer text you set.
- Your subscription state, mirrored from Shopify so the app knows which plan is active and how many pulls it has metered.
About Each Pull
Every pull writes one append-only audit record. It holds the Shopify order and order line identifiers, the item that was pulled, its tier, condition grade and value, the seed the draw consumed together with its hash, and a snapshot of the prize pool at that moment.
That record exists so a pull can be verified independently, by you or by the buyer, without trusting the app. It contains no information about the person who bought the box.
Reveal page views are counted so you can see how many buyers opened their reveal. A view records the shop, the order identifier, where it was opened from, and the time. Nothing else.
About The Reveal Email
When a pull completes, Rarium emails the buyer the link to it. That message is how a buyer reliably receives what they paid for, so it is part of the product rather than marketing, and there is nothing to opt into or out of beyond switching the feature off in your settings.
To send it, the app reads the buyer’s email address from the order and records it once, alongside the order identifier and the number of links the message carried. That record has one job: it stops a repeated delivery of the same order from emailing the same buyer twice.
The address is erased automatically 90 days after the message was sent. The record itself stays, without the address, so the app still knows not to send that order’s email again. The address is also erased immediately if Shopify forwards a deletion request for that buyer, or if you uninstall the app.
Rarium keeps daily encrypted backups of its database for 30 days. An address erased from the live database can remain in those backups until they roll off, and is not restored from them into use.
This is the only buyer personal data Rarium holds, and it is the reason the app requests access to the email field. It requests no other protected customer field.
What Rarium Does Not Store
- Buyer names, phone numbers or shipping addresses. None of them reach the app or its database. The email address described above is the single exception to that rule.
- Payment details. Payments are handled entirely by Shopify Checkout. Rarium never sees a card number and has no access to one.
- IP addresses or device fingerprints. Storefront surfaces set no tracking cookies and run no third-party analytics.
- Staff identity. The app requests offline access tokens only, so the name and email fields the Shopify session library provides are never populated.
- Shipping destinations. If you block a region, the check runs inside Shopify’s own checkout infrastructure. The buyer’s country is read there and never reaches Rarium.
Where Data Is Processed
| Processor | Purpose | Data |
|---|---|---|
| Shopify | Source of every product, order and billing record the app reads | Your store data, under Shopify’s own privacy terms |
| DigitalOcean, Frankfurt, Germany | Runs the app server and its PostgreSQL database | Everything listed above |
| DigitalOcean Spaces, Frankfurt, Germany | Stores encrypted daily backups of the database, kept for 30 days | A copy of everything listed above |
| Resend | Delivers the reveal email to your buyers, and usage warning emails to you | The buyer email address each reveal message is sent to, and the merchant email address each alert is sent to |
Retention And Deletion
Buyer email addresses are erased 90 days after the message they were used for, without anyone having to ask.
When you uninstall Rarium, Shopify notifies the app roughly 48 hours later. At that point the app deletes everything it holds for your store: your boxes and prize pools, the pull audit log, refund records, fairness commitments, reveal appearance styles, reveal email and view records, order statistics, your settings, legal text and billing state, and your sessions.
You can request deletion of any remaining shop configuration at any time by writing to privacy@rariumboxes.com.
When Shopify forwards a customer deletion request, Rarium erases the email address held for each order named in it. When Shopify forwards a customer data request, Rarium reports the address it holds for those orders so that you can answer your customer. Both are recorded for your own audit trail.
Your Rights
If you are in the EU, the UK or Switzerland, you have the right to access, correct, export or delete the data described here, and to object to its processing. Write to privacy@rariumboxes.com and we will respond within 30 days.
Changes
Material changes to this policy will be announced in the app before they take effect. The date at the top of this page always reflects the current version.
Contact
SAND RUSH AG, privacy@rariumboxes.com