Privacy policy

Last updated: September 29, 2026

Rummage is operated by City Pine Club LLC, a California limited liability company ("Rummage", "we", "our", or "us"). This Privacy Policy explains how we collect, use, share, and retain information when you use the Rummage app, Rumi shopping assistant, and website at shoprummage.com. Our Terms of service also apply to your use of these services.

Information we collect

Information you provide

Account information: Name, email address, and password when you create an account. If we later support third-party sign-in providers, we may also receive basic account details from those providers, such as your name, email address, and provider account identifier, depending on the permissions you grant.
Shopping preferences and saved items: Sizes, shopping departments, price limits, preferred styles, excluded items, feedback on recommendations, and other preferences you enter. We also store your saved collections ("bins"), their names and settings, and the listings you save to them.
Rumi conversations: Messages and questions you send to Rumi, its replies, and context you provide about yourself or someone you are shopping for. We store conversation history and may extract preferences and memories from it to personalize later conversations and recommendations.
Photos: Images you select or take and submit for image search or Rumi. Photos may contain faces, text, locations, or other personal information. We process the submitted image, not just the product within it. Rumi photo attachments are stored with the conversation. The app also keeps copies of recent image-search photos on your device so you can repeat a search.
Support and waitlist information: Your email address when you join the waitlist, and the messages and other information you send when contacting us.

Information collected when you use Rummage

Usage data: Search queries, listings shown or viewed, saved items, recommendation feedback, and clicks that open marketplace listings. We associate shopping activity with your account to provide item history and personalized recommendations.
Technical information: Our servers and infrastructure providers receive connection and request information, such as IP addresses, and may record device or browser information, errors, and diagnostic logs to operate and secure the Service. IP addresses can indicate a general location; the app does not request precise GPS location.
Local storage: The app stores sign-in credentials such as session tokens, settings, cached content, and recent searches on your device. Your account password is stored on our server as a hash, not as readable text.
Inferred preferences and memories: We infer shopping interests from your activity and conversations. We may store summaries, preferences, and personal context, such as items you own or interests you mention, and use them in later recommendations or Rumi replies. These inferences may be incorrect, and you can review and change them in the app.

Service operation and analytics

We use activity records and diagnostic information to understand how people use Rummage, maintain reliability, and improve recommendations. Providers that host our services or process background work may handle account identifiers, request data, and processing results for those purposes. We require providers processing personal data on our behalf to protect it and use it for the agreed service, subject to applicable law.

App Tracking Transparency

We do not currently use your data for cross-app or cross-site tracking for targeted advertising, and we do not access or use device identifiers for this purpose.

If this changes in the future, we will request your permission through Apple's App Tracking Transparency framework and comply with all applicable platform requirements.

How we use your information

We use the information we collect to:

Provide, maintain, and improve the Service.
Answer questions through Rumi, research products, identify items in photos, and search for matching listings.
Personalize recommendations, generate search suggestions, and maintain your preferences and Rumi memories. Some of this processing happens in the background after your activity or conversation.
Save your bins, conversation history, and shopping activity so you can return to them.
Send account and service messages, respond to support requests, and manage the waitlist. If we send marketing emails, you can opt out using their unsubscribe instructions or by contacting us.
Monitor and analyze usage trends to improve user experience.
Detect, investigate, and prevent fraudulent or unauthorized activity.
Comply with applicable laws and legal obligations.

Sharing your information

We do not sell or share your personal information for cross-context behavioral advertising, as defined under applicable law. We may share information with:

AI and search providers listed below, to answer questions, analyze submitted photos, and generate recommendations and search results.
Infrastructure providers that host our app services, store data, and process background tasks. For example, Inngest processes workflow data, which can include account and content identifiers and task inputs or results.
Email providers: When we send account verification emails through Resend, it receives the destination email address and the email content, including the verification code.
Legal authorities when required by law, court order, or to protect our rights, property, or safety.
Business partners in connection with a merger, acquisition, or sale of assets. You will be notified of any such change and any new privacy practices.

Rumi, AI, and photo processing

Rummage uses the following providers for these features:

OpenAI: We send request text, relevant conversation history, saved memories, shopping preferences, and information about your shopping activity to OpenAI to generate Rumi replies, infer preferences, and personalize recommendations. Requests involving Rumi photos can include the submitted images and text found in them. We also use OpenAI to generate summaries and representations of preferences that help match listings to your interests. Rumi can use OpenAI's web-search tools to research a question.
eBay: We send search queries and relevant shopping filters to eBay to find listings. Image search and Rumi photo identification send submitted images to eBay to find visual matches. Queries can include details drawn from your request or preferences.
Google Cloud Vision: When this image-research service is enabled, Rumi sends submitted photos to Google to read visible text and find matching images or pages on the web. We may include the returned text and matches in subsequent OpenAI requests to help identify the item.
Wikimedia Commons: Rumi may send a search query derived from your request to Wikimedia Commons to find reference images. This reference-image search sends a text query rather than your uploaded photo.

The information sent depends on the feature and request. Personal details you include in a message or photo can be sent to the providers used to answer it. Only submit content you have the right to share, and avoid including passwords, payment details, or personal information unrelated to your shopping request.

This policy describes our data handling; reading it or accepting our Terms does not provide any separate permission required for sharing personal data with AI or other providers. Permission to access your camera or selected photos also does not, by itself, authorize that sharing. You can withdraw permission in the app under Account details → AI data sharing. Rummage’s shopping features pause until you agree again. Withdrawal stops new requests with your information to these providers; requests already sent may finish processing. To ask about this processing or request help with withdrawal, contact privacy@rummage.app.

AI replies, photo identifications, and inferred preferences can be inaccurate or incomplete. Rumi does not authenticate items or guarantee a listing's age, condition, value, or suitability. You can correct or remove saved preferences and memories using the controls described below.

Your controls

Preferences and memories: In Profile → Your preferences, you can review and change saved preferences and Rumi memories. Removing an item from use in your feed and removing a conversational memory are separate controls. Removing a memory does not itself delete the original conversation.
Reset options: "Reset personalization" removes saved and learned preferences and past activity's influence while keeping shopping filters, memories, conversations, and bins. "Start fresh" also clears shopping filters, memories, and conversations. These controls do not delete your account or bins, and do not prevent new activity from being processed.
Recent searches: Clearing recent searches removes the recent-search list and its saved photo copies from your device. It does not delete separate conversation attachments or all account activity stored on our servers.
Temporary chats: Rummage does not extract new saved memories or lasting preferences from messages in a temporary chat. We still store its messages and attachments and send data to the providers needed to respond. Your existing shopping preferences may still inform the answer. Temporary mode does not make a conversation anonymous or prevent storage or external processing.
Conversation history: Removing a conversation from the history list archives it. Archiving hides it from that list but does not erase its stored messages, photos, or previously extracted memories. Use "Start fresh," delete your account, or contact us to request deletion of stored conversations.
Camera access: You can change camera access in your device settings. Changing that permission does not delete photos you previously submitted.

Data retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal or regulatory purposes.

Conversation messages and photo attachments, including archived and temporary conversations, remain subject to this retention policy. Preferences and memories are stored separately from conversation history, so use the relevant controls above to remove each type of information.

Clearing content in Rummage does not necessarily remove copies already retained by an external provider at the same time. Provider retention depends on the service, our applicable agreements and settings, and legal obligations. Contact privacy@rummage.app to ask about provider retention or request deletion of data shared through Rummage.

International data transfers

Your information may be transferred to and processed in countries other than your own, including the United States.

Account deletion

You can delete your account in Profile → Account details → Delete account, or by contacting privacy@rummage.app from the email address associated with your account. Account deletion removes your account and its associated profile, bins, conversations and attachments, memories, and shopping interactions from our active account database. The retention limits and exceptions above apply to other retained copies. We may take reasonable steps to verify your identity before processing a request.

Data security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest and secure password storage using hashing; passwords are not readable by us. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your rights

You have the right to:

Access, update, or delete your personal information.
Opt out of marketing communications at any time.
Request a copy of the data we hold about you.
Lodge a complaint with a data protection authority.

California residents (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA):

Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
Delete: You may request deletion of your personal information, subject to certain exceptions.
Opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this changes, you will have the right to opt out.
Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at privacy@rummage.app. We will respond within 45 days.

Categories of personal information collected in the past 12 months: Identifiers (name, email, account and device identifiers, IP address), internet or electronic network activity (searches and shopping interactions), general location data (city/region level), user content (messages, photos, and saved collection details), and inferences (shopping preferences and memories). Messages and photos may contain additional personal information you choose to provide.

Categories of third parties with whom we share personal information: AI and image-processing providers, marketplace and reference-image search providers, hosting and workflow providers, and email delivery providers, as described above.

EU/EEA residents (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

Legal basis for processing: We process your personal data on the basis of contract performance (to provide the Service), legitimate interests (analytics, fraud prevention), consent (marketing communications), and legal obligation.
Data portability: You may request your personal data in a structured, machine-readable format.
Restriction of processing: You may request that we restrict processing of your personal data in certain circumstances.
Object to processing: You may object to processing based on legitimate interests.
Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Lodge a complaint: You have the right to lodge a complaint with your local supervisory authority.

To exercise GDPR rights, contact us at privacy@rummage.app. We will respond within 30 days.

Children's privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@rummage.app.

Third-party sites

The Service may link or redirect you to third-party websites, marketplaces, and services. Once you leave our Service, their privacy policies and terms apply. We are not responsible for the privacy or security practices of third parties.

Do Not Track

Some browsers offer a "Do Not Track" feature. Because there is no consistent industry standard for responding to these signals, we do not currently respond to them.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the app and on our website, and where required by law, by sending you a direct notification.

Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: privacy@rummage.app

Website: shoprummage.com/contact