Privacy Policy

Last updated: March 22, 2026

Rummage is operated by City Pine Club LLC, a California limited liability company ("Rummage", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

Information We Collect

Information You Provide

Account information: Name, email address, and password when you create an account. If we later support third-party sign-in providers, we may also receive basic account details from those providers, such as your name, email address, and provider account identifier, depending on the permissions you grant.
Profile preferences: Style preferences, size selections, and browsing preferences you set during onboarding and in your profile.
Communications: Messages you send to us through the app or contact forms.

Information Collected Automatically

Usage data: Pages viewed, features used, search queries, clicks, redirects, feed interactions, and other interaction patterns.
Device information: Device type, operating system, unique device identifiers, and mobile network information.
Location data: General location based on IP address (we do not collect precise GPS location).
Push notification tokens: If you enable push notifications, we collect a device token to send you alerts. You can revoke this at any time in your device settings.
Cookies and similar technologies: We use cookies, pixels, and similar tracking technologies to operate the Service, analyze usage, and improve your experience. You can control cookie preferences through your browser settings, though some features may not function properly without them.
Inferences and preference data: We may infer your shopping preferences, size interests, and style interests from your activity in order to personalize your experience and generate recommendations.

Analytics

We may use third-party analytics and infrastructure providers to help us understand how users interact with the Service and to improve performance, reliability, and personalization. Depending on configuration, these providers may receive identifiers such as device identifiers and IP address, as well as usage events, session data, and diagnostic information. These providers process data on our behalf and are not permitted to use your information for their own purposes. We describe these providers by category rather than by name in this Privacy Policy. If we use data for cross-app, cross-site, or targeted advertising purposes, we will provide any notices and obtain any consents required by law and platform rules.

App Tracking Transparency

We do not currently use your data for cross-app or cross-site tracking for targeted advertising, and we do not access or use device identifiers for this purpose.

If this changes in the future, we will request your permission through Apple's App Tracking Transparency framework and comply with all applicable platform requirements.

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service.
Personalize your vintage shopping experience and generate AI-assisted product recommendations and rankings.
Send you updates, marketing communications, and other information you may find relevant. You can opt out at any time by following the unsubscribe instructions in our emails or adjusting your settings in the app.
Monitor and analyze usage trends to improve user experience.
Detect, investigate, and prevent fraudulent or unauthorized activity.
Comply with applicable laws and legal obligations.

Sharing Your Information

We do not sell or share your personal information for cross-context behavioral advertising, as defined under applicable law. We may share information with:

Service providers who assist in operating our platform, including hosting providers, analytics providers, and email delivery services. These providers are contractually obligated to protect your information.
Legal authorities when required by law, court order, or to protect our rights, property, or safety.
Business partners in connection with a merger, acquisition, or sale of assets. You will be notified of any such change and any new privacy practices.

AI-Assisted Recommendations

We use automated systems and AI-assisted models to help rank, organize, and recommend listings. We may use third-party AI service providers to process data on our behalf to generate recommendations. These recommendations may be inaccurate, incomplete, delayed, unavailable, or not suited to your preferences. They are provided for informational and convenience purposes only.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal or regulatory purposes.

International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States.

Account Deletion

You can delete your account directly within the app, or by contacting privacy@rummage.app from the email address associated with your account. We may take reasonable steps to verify your identity before processing your request. We may retain limited information as required by law, to resolve disputes, to enforce our agreements, or for legitimate security and fraud-prevention purposes.

Data Security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest and secure password storage using hashing; passwords are not readable by us. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your Rights

You have the right to:

Access, update, or delete your personal information.
Opt out of marketing communications at any time.
Request a copy of the data we hold about you.
Lodge a complaint with a data protection authority.

California Residents (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA):

Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
Delete: You may request deletion of your personal information, subject to certain exceptions.
Opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this changes, you will have the right to opt out.
Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at privacy@rummage.app. We will respond within 45 days.

Categories of personal information collected in the past 12 months: Identifiers (name, email, device ID), internet or electronic network activity (usage data, search queries), geolocation data (city/region level), and inferences drawn from this data to create a profile about your preferences.

Categories of third parties with whom we share personal information: Service providers (hosting, analytics, email delivery).

EU/EEA Residents (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

Legal basis for processing: We process your personal data on the basis of contract performance (to provide the Service), legitimate interests (analytics, fraud prevention), consent (marketing communications), and legal obligation.
Data portability: You may request your personal data in a structured, machine-readable format.
Restriction of processing: You may request that we restrict processing of your personal data in certain circumstances.
Object to processing: You may object to processing based on legitimate interests.
Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Lodge a complaint: You have the right to lodge a complaint with your local supervisory authority.

To exercise GDPR rights, contact us at privacy@rummage.app. We will respond within 30 days.

Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@rummage.app.

Third-Party Sites

The Service may link or redirect you to third-party websites, marketplaces, and services. Once you leave our Service, their privacy policies and terms apply. We are not responsible for the privacy or security practices of third parties.

Do Not Track

Some browsers offer a "Do Not Track" feature. Because there is no consistent industry standard for responding to these signals, we do not currently respond to them.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the app and on our website, and where required by law, by sending you a direct notification.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: privacy@rummage.app