Privacy notice

Who is responsible

Rummit is operated by Godwin Laureto, Laureto's Hilltop House, Buda, Marilog District, Davao City, Davao del Sur, Philippines. Godwin Laureto is the initial privacy and support contact at support@rummit.app.

This notice covers the iOS app, marketplace and help site. The initial marketplace is for people aged 18 or older. Contact us if you believe a minor has supplied account information.

Your private finds stay on your device

Your private clothing captures and collection are stored on your device. We do not automatically upload your photo library or whole collection. Publishing or preparing an online listing uploads only the selected photos and listing details used by that flow. Signing out or deleting the marketplace account does not erase the separate local collection or copies you export.

Cutouts and label reading use Apple Vision on your device. Real-photo spins display the actual captured frames. AI garment generation is disabled; no garment photos are sent to an AI 3D provider for this release.

Information and who can see it

Account: Email, display name, password hash, account identifiers, sessions, email verification/recovery challenges and policy receipts. Passwords are not stored as readable passwords.
Listings and shops: Selected photos, measurements, descriptions, condition, flaws, prices, shop profile and review records. Published information is visible to other people and can be copied by them.
Orders and conversations: Bids, waitlists, reservations, orders, direct seller payment instructions, manual payment updates, delivery/contact details and participant messages. Order participants receive the information needed to carry out their order. In-app messaging lets a buyer contact a seller before ordering without publicly posting private contact information.
Seller review: When assisted seller onboarding is enabled, legal name, individual/business category, trading activity, business/contact address, mobile, confirmed account email, notice acceptance and review status. The operator can record the kind of identity or registration document presented, a case reference, decision, reason and review expiry. The app does not request or store government document numbers, scans or photographs. Do not attach these to support messages. A changed profile needs review again.
Safety and operation: Reports, blocks, support tickets/replies, operator decisions, request limits, operation/retry records, media metadata and encrypted recovery copies. Relevant operators can access private information needed for support, safety and seller review; it is not a public identity register.

Public browsing works without an account. Private conversation, order and support access is restricted to the relevant participants or authorized operator. A confirmed email or reviewed seller information is not a guarantee of authenticity, future conduct or payment.

Why information is used

We use account information to provide requested sign-in, recovery and account functions; listing and order information to provide the transactions you request; messages and support records to deliver your communications and resolve issues; and seller information to review trading eligibility and meet applicable marketplace obligations.

We use proportionate security, fraud, moderation and recovery records to protect the service and its users, subject to balancing those interests against your rights. We also process information when required by applicable law. Camera/photo access and publishing/export choices are separate choices; accepting terms does not authorize unrelated processing or remove your privacy rights.

Do not enter passwords, verification codes, full payment-card credentials, identity-document numbers or unrelated private details into listings, messages or support requests. Remove private information from publicly shared photos. Marketplace uploads are decoded and re-encoded with ancillary location metadata removed.

Service providers and international processing

Supabase hosts the database, private media and backend functions; the current project is in Singapore. Resend delivers account verification and recovery emails through the configured Tokyo sending region. A code is sent only to the account email; operational emails use fixed condition codes rather than customer message content.

GitHub hosts this static help site, runs private operational checks and stores encrypted recovery copies as private artifacts. The backup worker has no decryption key or database password. Namecheap forwards support email to the owner's Google Gmail inbox. Emailing support shares your sender details and message with those providers and the owner.

These providers and their subprocessors can process data outside the Philippines. We do not promise Philippine-only storage or that every provider log is held in one selected region. Provider security, retention and transfer arrangements also apply. We remain responsible for choosing and managing our service arrangements and handling your requests.

The current app has no advertising or third-party analytics SDK and does not track you across other companies' apps or sites. This static help site uses no application cookies, analytics, external fonts or scripts. Hosting, email and network providers can still keep operational access and delivery records.

Retention, disposal and recovery

We retain information for the purpose for which it is needed, including an active account, open order, unresolved support/safety case or an applicable legal obligation. The operator reviews retained records monthly; a record without a continuing purpose must be removed or redacted through a recorded disposal action. This is a manual review procedure, not an automatic age-based deletion promise.

Account and seller profile: While the account or seller relationship is active. Account closure removes or redacts direct account/profile information as described below. Seller approval evidence is not carried forward as approval after a disaster restore.
Orders, messages and safety cases: While needed to complete the transaction, resolve a dispute or safety concern, prevent a specific continuing abuse, or satisfy an applicable obligation. Each monthly review records the continuing purpose or disposal action. A documented legal/safety hold must identify its reason, owner and next review date; a hold is not permission for indefinite unrelated retention.
Support email: The same purpose review applies to forwarded correspondence and attachments in the owner's support inbox. Deleting an in-app ticket does not automatically delete an email copy.
Operational expiry: Sessions expire after 30 days. Email codes expire after 15 minutes; challenge records become eligible for bounded cleanup 24 hours after expiry. Retry receipts expire after 24 hours. Eligibility is not an exact physical deletion time.
Recovery copies: Application snapshot pruning protects the newest two verified snapshots and removes older copies in bounded batches. This is a count policy; cleanup failures can retain older copies longer. Independent GitHub encrypted artifacts specify seven days after upload. That does not control provider logs or separately downloaded operator copies, which are restricted and included in the operator's purpose review.

A recovery copy may predate a deletion. Restored databases remain inactive, credentials are invalidated, and post-snapshot deletion, moderation and order changes require reconciliation before exposure. Restored seller profiles require fresh review. If authoritative changes cannot be established, the recovery guard blocks activation; it cannot recreate unknown changes or promise no data loss.

Your rights and account deletion

From You, you can manage blocks and support requests, export account information, or request account deletion. The export is a bounded, paginated view of customer-facing sections; it is not every internal record or a frozen database snapshot. Report a specific listing, shop or message from its menu.

Deletion requires password confirmation and checks unresolved paid/shipped orders, reported transfers and active winning bid or seller-auction obligations. Successful deletion disables the account and revokes sessions, replaces public identity, redacts sent message bodies and support content, removes seller review profile data, and clears completed/cancelled buyer delivery contact details. Historical order, bid and safety/audit relationships are not all erased; opaque references are not necessarily anonymous. Uploaded media is queued for physical deletion with retries. Local captures, user exports and previously emailed copies are separate.

For access, correction, erasure/blocking, objection, portability where applicable, or a privacy complaint, email support@rummit.app. Identify the relevant account or record and the requested outcome. We may verify ownership without asking for a password or one-time code, protect other people's data, and explain an applicable reason if a request cannot be fully fulfilled. You may also raise concerns with the Philippine National Privacy Commission; contacting us does not waive that right.

Security and updates

We use hashed passwords, revocable credentials, device Keychain storage for sessions, private uploaded originals, access controls and encrypted recovery copies. These safeguards reduce risk; no system can promise absolute security or uninterrupted availability. Finite service limits can temporarily reject requests.

Godwin Laureto performs initial daily support and safety review. If coverage is unavailable or safety/capacity cannot be maintained, new trading can be paused while existing order-resolution access remains available. Material changes to processing will be explained before the affected new processing. Published policy versions and their acceptance receipts are kept separately; a later version does not silently overwrite a version you accepted.