Privacy Policy
Last updated: July 9, 2026
1. Information We Collect
1.1 Account Information
When you create an account, we collect your email address, a display name, and your password (stored as a one-way hash — we never see your plain-text password). You may optionally provide a bio, location, and profile photo. If you sign in with Google OAuth, we receive your name and email address from Google.
1.2 Transaction Information
When you buy or sell an item, we collect shipping addresses, order details, and transaction records. Payment processing is handled entirely by Stripe — we do not receive, store, or have access to your full credit card number, CVC, or bank account details.
1.3 Usage Data
We use Umami, a privacy-first analytics service, to collect anonymous page views and basic interaction data. Umami does not use cookies, does not track users across sites, and does not collect personally identifiable information.
1.4 Communication Data
When you send questions through listing Q&A, direct messages, or the contact form, we store those messages and may review them for customer support and policy enforcement purposes.
2. How We Use Your Data
- To create and authenticate your account
- To process orders, calculate shipping rates, and generate shipping labels
- To send transactional notifications: order confirmations, shipping updates, delivery confirmations, and payout notices
- To send in-app notifications about sales, messages, and Q&A replies
- To display your public profile (name, bio, location, rating) to other users
- To prevent fraud, enforce our Terms of Service, and comply with legal obligations
- To improve the platform through anonymous usage analysis
3. Third-Party Services
We share the minimum necessary data with these service providers to operate the platform:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing & seller payouts | Name, email, order amount, seller bank details (collected by Stripe) |
| Shippo | Shipping rates & label generation | Ship-from/to addresses, parcel dimensions/weight |
| Resend | Email delivery | Email address, notification content |
| Vercel Blob | Listing photo storage | Uploaded images |
| Umami | Anonymous usage analytics | Page path, referrer, device type (no PII) |
| Neon (Postgres) | Database hosting | All account and transaction data |
We do not sell, rent, or trade your personal information to any other party. Each third-party provider is subject to their own privacy policy and data processing terms.
4. Cookies & Local Storage
We use a single session cookie for authentication (managed by Auth.js). We do not use tracking cookies, advertising cookies, or fingerprinting scripts. Our Progressive Web App (PWA) may store static assets (icons, stylesheets) in your browser’s Cache Storage via a Service Worker for faster loading. No personal data is stored in the Service Worker cache.
5. Email Notifications
You will receive transactional emails for purchases, sales, shipping updates, and delivery confirmations. You may disable promotional and non-critical email notifications in Settings → Notifications. Critical transactional emails (e.g. order confirmation, payout release) cannot be opted out of while your account is active. In-app notifications appear in the bell icon and cannot be disabled.
6. Data Retention
We retain your account data as long as your account is active. You may request deletion of your account and associated personal data by emailing support@rc-exchange.com. Transaction records are retained for a minimum of 7 years to comply with tax reporting, financial auditing, and anti-fraud obligations. Anonymized or aggregated data may be retained indefinitely.
7. Data Security
We encrypt data in transit (TLS) and at rest. Our database is hosted by Neon with access restricted by IP and credentials. Payment data is processed exclusively by Stripe through PCI-compliant infrastructure. We do not have access to your full payment card details.
8. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, or to object to or restrict its processing. To exercise any of these rights, contact support@rc-exchange.com. We will respond within 30 days.
9. Children’s Privacy
RC-Exchange is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that a child under 18 has created an account, we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email. Continued use after changes take effect constitutes acceptance.
11. Contact
For privacy-related inquiries or data requests, contact support@rc-exchange.com.