Privacy Policy

This policy explains what Rethos (“we,” a project of Racka) collects, why, and how we handle it. Rethos is a service that lets an operator invite a person to capture verified photos, and produces a tamper-evident record of those photos. We designed the service to collect only what is needed to prove a photo is authentic.

Who the parties are

An operator is a business or individual that uses Rethos to request photos (for example, a marketplace or a dealer). A contributor is a person who captures photos through a link an operator sends them. For photos captured through an operator’s link, the operator is the party that decides why the photos are collected; we process that data on their behalf.

What we collect

When an operator creates an account, we collect their email address and a password (stored only as a secure hash).

When a contributor captures a photo through a link, we collect and store, for each photo:

• the image itself;
• a cryptographic fingerprint (SHA-256 hash) of the image, computed at the moment of capture;
• a server-assigned timestamp;
• GPS coordinates and accuracy, if the contributor’s device permits location access;
• the device’s IP address, browser user-agent, screen size, and time zone.

The timestamp, location, and device details exist to establish that a photo was captured live at a known time and place. They are part of the evidentiary record. If a contributor denies location access, the photo is still captured — it is simply recorded without coordinates.

What we do not do

• We do not sell personal data.
• We do not use captured photos to train machine-learning models.
• We do not show advertising, and we do not share data with advertisers.
• We do not require a contributor to create an account.

How the data is used

Captured data is used to store the photos, verify their integrity, detect duplicate images across records, and make photos available to the operator that requested them and to anyone the operator shares a verification link with. Each photo has a public verification page reachable only by an unguessable link; that page displays the photo, its timestamp, its location if recorded, and whether its fingerprint still matches the original.

How the data is stored and protected

Data is stored with our infrastructure provider (Supabase) in the United States. Images are held in private storage and served only through expiring, signed links. Data is encrypted in transit and at rest. Access controls restrict each operator to their own records. Administrative keys are held server-side and are never exposed to browsers.

How long we keep it

We retain photos and their records for as long as the operator’s account is active or as needed to provide the service. An operator may request deletion of a record, and we will delete the associated photos and metadata. Because the value of the service is an unbroken record, deletion is permanent.

Your choices

Contributors can decline location access at the device level. Operators can delete records they created. To request access to, correction of, or deletion of data associated with you, contact us at the address below. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honor valid requests under applicable law.

Children

Rethos is a business tool and is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy. Material changes will be reflected in the “last updated” date above.

Contact

Questions or requests: admin@racka.io.

This document is provided for transparency and is not legal advice.