Privacy Policy

Effective Date: October 14, 2026

Last Updated: October 16, 2026

This Privacy Policy explains how Monolith Vestige LLC (“Monolith Vestige,” “we,” “us,” or “our”) collects, uses, processes, discloses, retains, and protects information in connection with Rune (“Rune,” the “App,” or the “Service”).

Rune is a trading card intelligence and collection application designed to help collectors identify cards, organize collections, understand market information, and make more informed collecting decisions.

By using Rune, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

Rune is operated by:

Monolith Vestige LLC

Florida, United States

Email: support@getruneapp.com

For privacy questions or requests concerning your information, contact us at the email address above.

2. Scope of This Privacy Policy

This Privacy Policy applies to information processed through Rune and related services operated by Monolith Vestige LLC. It does not govern the independent privacy practices of third-party services, websites, marketplaces, or platforms that you may access separately.

3. Information We Collect

The information Rune processes depends on how you use the Service.

Account and Authentication Information

Rune may automatically establish an anonymous account identifier so that core account-based functionality can operate without requiring you to provide an email address immediately.

If you choose to create, link, or sign in to a persistent account using email, our authentication provider processes your email address and related authentication information.

Rune may process or maintain information associated with your account such as:

• an internal account identifier;

• account status;

• an internal support code;

• account creation and update timestamps;

• your selected Rune profile icon;

• subscription or entitlement status;

• account deletion status and related timestamps; and

• authentication and session information necessary to maintain access to your account.

Rune’s primary application database does not maintain a separate profile containing your name, biography, public profile, or similar social information.

Collection Information

When you use Rune’s collection features, we may store information you choose to associate with your collection, including:

• cards and sealed products in your collection;

• quantity;

• card condition;

• printing or product identity;

• acquisition date, when provided;

• collection changes and history;

• collection valuation observations;

• portfolio baselines; and

• related market information associated with collection events.

This information is associated with your Rune account so that we can provide collection functionality.

Scan Information

When you use Rune’s card scanning functionality, Rune uses your device camera to capture an image of the trading card you choose to scan.

On your device. Rune resizes the image on your device before sending it. The image Rune sends does not include the camera’s photo metadata, such as device or location information. Scan photographs are kept in a temporary area of your device that is not included in device backups, and Rune deletes them when they are no longer needed:

• In single-card scanning, a photograph is deleted when you retake it, cancel, or close the camera, including after a successful scan. The resized copy sent for identification is deleted as soon as that request finishes.

• In Rapid Scan, photographs of the most recent cards in an unfinished batch are kept so you can review the batch. Each is deleted when its card no longer needs it, or when the card is added to your collection, removed, or discarded. If a batch is not used for seven days, its photographs are deleted the next time Rune starts or Rapid Scan opens; the batch’s cards remain until you add, remove, or discard them.

• Signing out deletes every scan photograph and any unfinished Rapid Scan batch from the device.

• Photographs left behind if Rune closes unexpectedly are deleted the next time Rune starts.

Your device’s operating system may also remove these temporary files sooner.

On Rune’s servers. The resized image is sent from your device to Rune’s backend and then to OpenAI to identify the card, for example its name, number, set, language, and printing characteristics. Rune’s servers hold the image only while processing the request. Rune does not write scan photographs to its database, file storage, or logs, and does not keep a library of your scan photographs.

OpenAI. OpenAI processes scan images as a service provider to Rune. The request Rune sends to OpenAI does not include your Rune account identifier, email address, or device identifier. Under OpenAI’s published terms for its API:

• OpenAI may keep API inputs, which include the scan image, for up to 30 days to monitor for abuse, and longer where required by law;

• images flagged by OpenAI’s child-safety systems may be kept for review; and

• OpenAI does not use API data to train its models unless the customer opts in.

Rune does not use scan photographs to operate its own model-training system.

Rune may maintain operational information associated with scanning, such as:

• the number of scans used during a particular day;

• timestamps associated with scan allowance usage;

• technical information necessary to enforce scan limits;

• extracted card-identification information in operational logs; and

• technical abuse-prevention information described below.

Network and Abuse-Prevention Information

When Rune processes a scan, network request information may include an Internet Protocol (“IP”) address as part of normal internet communication.

For certain scan abuse-prevention and system-integrity purposes, Rune converts network address information into a keyed, pseudonymized cryptographic value before storing it. The stored value is designed to measure network-level activity without storing the original IP address in Rune’s scan-observation tables and is not stored with a Rune user ID.

Rune retains these pseudonymized scan network observations for approximately 30 days, after which they are deleted automatically.

Infrastructure and service providers may separately process ordinary network information, including IP addresses, as part of providing their services.

Search and Recently Viewed Information

Card and set searches run on your device. Rune keeps your recent searches and recently viewed items on your device to make the App faster and more useful. These device-local stores are not synchronized to your Rune account.

When you search for sealed products, such as booster boxes, the text you type is sent to Rune’s servers and to our market-data provider, JustTCG, to find matching products. It is sent without your Rune account identifier or a device identifier, and Rune does not store it. JustTCG processes these requests under its own terms and may keep records of them. Infrastructure providers may also process request metadata associated with these requests.

Product analytics records when a search returns no results and which result you open (by its catalogue identifier), linked to your Rune account identifier. It does not record the text of your search.

Alerts and Notification Information

If you choose to use Rune’s alerts, Rune may process:

• the cards and products you choose to watch;

• alert rules;

• observed prices or market states;

• alert history;

• an Expo push token;

• device platform information; and

• notification-delivery status.

Notifications use Expo and Apple’s Push Notification service. You can control notification permission through your device settings.

Subscription and Purchase Information

Rune offers optional Premium subscriptions through Apple’s App Store. Apple processes payments for App Store purchases. Rune does not receive or store your complete payment card number, bank-account credentials, or Apple Account password.

Rune may receive and process information necessary to verify and maintain your entitlement, such as:

• subscription product information;

• signed transaction information supplied through Apple;

• subscription or entitlement status;

• transaction references;

• subscription dates; and

• information necessary to restore or validate a purchase.

Apple’s handling of payment and Apple Account information is governed by Apple’s own terms and privacy practices.

Crash and Diagnostic Information

If Rune crashes or encounters an error, the App sends a crash report to our crash-reporting provider, Sentry. A crash report may include:

• the error and where in the App it occurred;

• the Rune version and build;

• your device model and operating-system version;

• technical device state at the time, such as available memory; and

• technical identifiers generated by the crash-reporting software to group related reports.

We configure crash reporting to exclude your Rune account identifier, email address, screenshots, the content of your screens, and the content of your network requests. We have also configured our crash-reporting service not to store IP addresses. We use crash reports only to find and fix problems. They are kept by Sentry for no longer than 90 days.

We may also use automated analysis, provided by xAI, to review crash reports and help us diagnose defects.

Product Analytics Information

To understand how Rune is used and to improve it, the App sends product analytics events to our analytics provider, PostHog, which stores them in the United States. An event records an action in the App, for example opening the App, opening a card’s details, opening a search result, finishing a scan, adding an item to your collection or creating a watch. It also records the approximate count of items involved, whether you use Rune as a guest or with a registered account, and whether your account has Premium access. Events about cards, sets and sealed products identify the catalogue item, not your copy of it.

Each event is linked to your Rune account identifier. It also carries the Rune version and build, your device type, and an identifier for the App session.

Product analytics does not include:

• your email address;

• the text you type into search;

• prices or the value of your collection;

• which cards you own or watch;

• your scan photographs;

• your precise or approximate location.

We configure PostHog not to store IP addresses and not to derive a location from them.

Support Requests

When you use “Contact Support” or “Report a Bug” in the App, your request is sent directly to Rune. We store:

• the type of request and your message;

• for a bug report, what you expected to happen;

• the email address we reply to: your account’s email, or, if your account has none, the address you enter;

• your Rune account identifier; and

• technical information: the Rune version and build, device platform, operating-system version, and App environment.

This information is linked to your Rune account so that we can respond and resolve problems. We keep support requests for up to 24 months, after which they are deleted.

To handle support requests:

• an automated system classifies each request using OpenAI;

• our team is notified, and the reply address receives an acknowledgement, by email through Resend; and

• requests that need engineering work may be copied into a private engineering record (GitHub) and analysed with tools provided by Anthropic.

The engineering record contains your message, what you expected, and the technical information above. It does not contain your reply address, account identifier, or support code.

You can also email support@getruneapp.com directly. Your email provider and ours process and retain those messages according to their respective practices.

4. Camera Permission

Rune requests access to your camera only when camera functionality is needed, such as when you choose to scan a trading card.

Camera access is used to capture the card image that you intentionally submit for identification. Rune does not require access to your location to scan a card.

You can revoke camera permission through your device settings. Doing so will prevent camera-based scanning from functioning but does not prevent you from using Rune features that do not require the camera.

5. Information We Do Not Use for Advertising or Tracking

Rune is not an advertising platform.

Rune does not currently use third-party advertising networks or behavioral advertising SDKs. Rune does not use Apple’s advertising identifier (“IDFA”) to track you across apps or websites owned by other companies.

Rune does not sell personal information for monetary consideration. Rune does not use cross-app behavioral tracking to serve targeted advertisements.

Product analytics is used only to understand and improve Rune. It is not used for advertising, is not combined with data from other companies’ apps or websites, and does not use Apple’s advertising identifier.

If these practices materially change, we will update this Privacy Policy and make any disclosures or obtain any permissions required by applicable law or platform rules.

6. How We Use Information

We may process information to:

• provide and operate Rune;

• establish and maintain accounts and sessions;

• authenticate users;

• identify scanned trading cards;

• maintain collections;

• calculate collection information and market observations;

• provide market and card intelligence;

• enforce Free and Premium usage allowances;

• provide Premium features;

• restore or verify subscriptions;

• provide alerts and notifications;

• respond to support requests and bug reports;

• diagnose technical problems, including through crash reports;

• maintain security and prevent abuse;

• protect Rune, our users, and our service providers;

• maintain operational records;

• comply with legal obligations;

• enforce our Terms & Conditions; and

• improve the reliability and functionality of the Service.

• understand how Rune’s features are used, so we can improve them (product analytics);

We do not use your collection information or scan photographs to provide third-party behavioral advertising.

7. Market and Trading Card Information

Rune processes trading card catalogue, artwork, pricing, historical, market, and related information obtained from our own systems and authorized third-party sources.

Requests for card artwork may cause your device to retrieve images directly from third-party content delivery infrastructure. Those services may receive ordinary technical request information such as your IP address, browser or application user-agent information, and the requested image.

Rune also requests market information from third-party providers. These server-to-server requests carry card, set, or product identifiers and, for sealed-product searches, the search text you enter. They never carry your Rune account identifier or a device identifier.

8. Service Providers and Third Parties

We use service providers to operate Rune. Depending on the features you use, these may include:

• Supabase — cloud database, authentication, storage, backend functions, and application infrastructure.

• OpenAI — automated processing of card scan images to assist with card identification, and classification of support requests.

• Resend — delivery of authentication emails, one-time sign-in codes, and support notifications and acknowledgements.

• JustTCG — trading card market and catalogue information, including sealed-product search.

• Sentry — crash and error reporting.

• xAI — automated analysis of crash reports.

• Anthropic — automated analysis of reported issues that need engineering work.

• GitHub — infrastructure used to run certain scheduled backend processes, and private engineering records of support issues.

• TCGdex and related content infrastructure — trading card catalogue and artwork delivery.

• Pokémon TCG API-related image infrastructure — legacy card artwork delivery where applicable.

• Apple — App Store distribution, in-app purchase processing, and Apple Push Notification service.

• Expo / EAS — application build and push-notification infrastructure.

• Email providers — transmission and storage of communications you choose to send to Rune support.

• PostHog — product analytics, hosted in the United States.

These providers may process information only as necessary to perform services for Rune or according to their applicable agreements and policies. We require service providers that process personal information on our behalf to handle that information consistently with applicable privacy and security requirements.

We may change service providers as Rune evolves. We will update this Privacy Policy when a change materially affects how personal information is processed.

9. Information Sharing and Disclosure

We may disclose information:

To Service Providers

We disclose information to service providers when necessary to operate Rune, as described above.

For Legal and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law, regulation, subpoena, court order, or lawful governmental request;

• investigate fraud, abuse, security incidents, or unlawful conduct;

• enforce our agreements;

• protect the rights, safety, and property of Monolith Vestige LLC, Rune users, service providers, or others; or

• establish, exercise, or defend legal claims.

Business Transfers

If Monolith Vestige LLC is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar business transaction, information associated with Rune may be transferred as part of that transaction, subject to applicable law.

10. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing Rune, maintaining security, resolving disputes, enforcing agreements, and satisfying legal obligations.

Retention varies by data type:

• Account and collection information is generally retained while your account remains active.

• Device-local search and recently viewed information remains on the device until cleared through Rune, sign-out where applicable, application deletion, or other applicable device lifecycle events.

• Scan photographs are not stored on Rune’s servers. On your device, they are deleted as described in Section 3. OpenAI may keep scan images for up to 30 days under its API terms.

• Pseudonymized scan network observations are retained for approximately 30 days.

• Support requests are retained for up to 24 months.

• Crash reports are retained by Sentry for no longer than 90 days.

• Authentication codes are temporary and expire.

• If an anonymous Rune account becomes abandoned and inaccessible, we may remove the account and associated information after an extended period of inactivity. Rune’s intended retention period for inactive orphaned anonymous accounts is approximately 180 days, subject to operational, security, and legal requirements.

• Following completed account deletion, Rune may retain a limited deletion-audit record for up to 24 months for security, fraud-prevention, dispute-resolution, compliance, and recordkeeping purposes. This limited record is not intended to preserve your collection or other ordinary Rune account content.

• Product analytics events are retained by PostHog for up to one year.

Information may temporarily remain in service-provider logs, backups, disaster-recovery systems, or other infrastructure according to those providers’ retention schedules even after it is removed from Rune’s active systems. Such residual copies are subject to access restrictions and ordinary backup lifecycle processes.

11. Account Deletion

Rune provides an in-app process for requesting deletion of your account.

When you request account deletion, Rune currently provides a seven-day period during which you can cancel the request. After that period, Rune’s deletion process removes the account and associated user-owned data from Rune’s active systems, subject to limited records we may retain for legitimate security, compliance, dispute-resolution, fraud-prevention, or legal purposes as described above.

When your account deletion completes, Rune also asks PostHog to delete the product analytics associated with your account identifier, and checks that the deletion has happened. This normally completes within about three weeks. PostHog removes the underlying records on its own processing schedule.

Deleting Rune from your device is not the same as requesting account deletion.

Deleting your Rune account also does not automatically cancel an Apple App Store subscription. If you have an active subscription, you should manage or cancel it through your Apple Account subscription settings.

For assistance with account deletion, contact: support@getruneapp.com

12. Your Choices and Controls

Depending on the information and feature involved, you may:

• choose whether to link an email address to Rune;

• manage camera permission through iOS Settings;

• manage notification permission through iOS Settings;

• clear supported device-local history through Rune;

• request deletion of your Rune account through the App;

• cancel a pending deletion request during the available cancellation period;

• manage an Apple subscription through Apple;

• contact us regarding your personal information; and

• stop using Rune.

If you contact us with a privacy request, we may need to verify that you are authorized to make the request before acting on it.

13. U.S. Privacy Rights

Rune is currently intended for availability in the United States.

Depending on where you live and applicable law, you may have rights concerning personal information, which may include rights to request access, correction, deletion, or information concerning how personal information is processed.

We will evaluate privacy requests in accordance with applicable law.

To submit a privacy request, contact: support@getruneapp.com

We will not discriminate against you for exercising a privacy right provided by applicable law.

Nothing in this section creates a right that does not otherwise apply under applicable law.

14. Children

Rune is intended for users who are at least 13 years old.

Rune is not directed to children under 13, and we do not knowingly seek to collect personal information from children under 13. If we learn that personal information has been collected from a child under 13 in circumstances requiring deletion or parental authorization under applicable law, we will take appropriate steps to address the information.

If you believe a child under 13 has provided personal information through Rune, contact: support@getruneapp.com

15. Security

We use administrative, technical, and organizational safeguards designed to protect information processed through Rune. Depending on the information and system involved, these safeguards may include authenticated requests, server-side authorization, row-level database access controls, encrypted network transport, device secure storage, restricted production credentials, and separation of user-owned data.

No method of electronic transmission, storage, or security is guaranteed to be completely secure. We therefore cannot guarantee absolute security.

16. International Use

Rune is currently intended for distribution in the United States. If we intentionally expand Rune into additional jurisdictions, we may update this Privacy Policy and our privacy practices to address applicable regional requirements.

17. Third-Party Intellectual Property and Services

Rune may display or reference trading card names, artwork, trademarks, market information, or other materials owned or provided by third parties. The inclusion of third-party material does not transfer ownership of that material to Monolith Vestige LLC or to Rune users.

Third-party services and resources may be governed by their own terms and privacy policies.

18. Changes to This Privacy Policy

We may update this Privacy Policy as Rune evolves, our service providers change, or legal or platform requirements change.

When we make changes, we will update the “Last Updated” date above. If a change materially affects how we process personal information, we may provide additional notice where appropriate or required.

Your continued use of Rune after an updated Privacy Policy becomes effective constitutes acknowledgment of the updated policy to the extent permitted by law.

19. Contact Us

For privacy questions, requests, complaints, or concerns regarding Rune:

Monolith Vestige LLC

Florida, United States

Email: support@getruneapp.com