Privacy Policy
Version 1.0.0 · Effective August 15, 2026
1. Who we are
Rural Roots Trading Co. ("we", "us", "our") operates https://ruralrootstc.com, a Texas marketplace where neighbors buy, sell, and trade homegrown and handmade goods. We are the controller of the personal information described here. Mailing address: Rural Roots Trading Co., Texas, United States. Privacy contact: privacy@ruralrootstc.com.
2. Information we collect
Information you give us
- Account details: first and last name, email address, password (stored only as a salted hash by our authentication provider).
- Location details: the street address you enter and its approximate latitude/longitude, used for distance sorting and to show a city on listings.
- Storefront profile: storefront name, bio, city, accent color, website link, avatar and banner images.
- Listings and wanted posts: titles, descriptions, prices, quantities, categories, photos and pickup city.
- Trade activity: offers, trades, order quantities, completion status, and reviews you write or receive.
- Messages: the content of chat messages you send to other members through the platform.
- Support requests: the email, subject, category and message body of help tickets and reports you submit.
- Consent records: the version of the Terms of Service and Privacy Policy you accepted, the timestamp, and the IP address recorded at signup.
Information collected automatically
- IP address (captured at signup for consent proof, and by our hosting provider in transient security logs).
- Basic device and browser information sent with every web request, plus error diagnostics when a page fails.
- Strictly necessary cookies and browser storage used to keep you signed in and remember your active storefront.
We do not collect payment card numbers, bank details, government ID numbers, precise GPS location from your device, biometric data, or health data. Payment for goods happens directly between members, off-platform.
3. Why we collect it
- To create and secure your account and verify your email address.
- To show nearby listings and sort results by distance.
- To let buyers and sellers find each other, make offers, and communicate.
- To send transactional notifications (new messages, new offers, account emails).
- To keep the marketplace safe: moderation, blocking, reports, and fraud prevention.
- To meet legal obligations and to prove that you accepted our Terms and this policy.
4. How we use information
We use your information only to operate and improve the marketplace as described above. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not run advertising pixels or ad networks.
Some information is public by design: your storefront name, city, bio, website link, avatar/banner, listings, wanted posts, and reviews you leave are visible to anyone who visits the site. Your street address, email address, and private chat messages are not shown publicly.
5. Cookies and tracking technologies
We use a small number of first-party cookies and browser storage entries. See the Cookie Policy for the full list.
- Strictly necessary: authentication tokens (kept in your browser's local storage) and
tx_storefront_id, which remembers the storefront you are acting as. These cannot be turned off without breaking sign-in. - Functional (optional): preferences such as "remember me" and your cookie choices themselves.
- Analytics (optional): not currently enabled. If we ever enable analytics, it will only load after you opt in through the cookie banner.
We do not use advertising cookies, Meta Pixel, TikTok Pixel, Google Analytics, or similar trackers. We honor Global Privacy Control (GPC) signals where applicable.
6. Analytics providers
As of the effective date above, no third-party analytics or product-analytics provider (Google Analytics, PostHog, Mixpanel, Segment, Amplitude, Sentry, etc.) is installed on this site. Aggregate request counts may be available to our hosting provider. If we add an analytics provider, we will update this policy, add it to the list below, and gate it behind your cookie consent.
7. Third-party services we use
| Provider | What they receive | Why |
|---|---|---|
| Lovable (platform & hosting) | All application data processed on our behalf; request logs | Builds, hosts, and operates the application |
| Supabase (database, auth, storage) | Account credentials, profile, listings, messages, uploaded images | Stores our database, authenticates users, stores files |
| Cloudflare (edge network) | IP address, request metadata | Serves and protects the site at the network edge |
| Resend (transactional email) | Your email address and the content of notification emails | Delivers account, message, and offer notification emails |
| OpenStreetMap / Nominatim | The address text you type into address fields, your IP address | Address autocomplete and geocoding |
| ipify | Your IP address at the moment of signup | Records the IP attached to your Terms acceptance |
| Google Fonts | Your IP address and browser info when fonts load | Serves the site typefaces |
We do not currently use Stripe, Vercel, Postmark, OpenAI, Anthropic, Google Analytics, Google Maps, Sentry, PostHog, Firebase, AWS, DigitalOcean, Azure, Meta Pixel, or TikTok Pixel. If that changes, this table will be updated before the integration goes live.
8. AI disclosure
No artificial intelligence or machine-learning system processes your personal information on this platform today. Search, browse ranking, matching, and moderation are performed by ordinary deterministic code (keyword and category filters, distance math, and human admin review). There is no AI chatbot, AI listing-description generator, AI image generator, or automated AI moderation in the product.
If we introduce an AI feature in the future, we will update this section before launch to state:
- exactly where AI is used in the product;
- what information is sent to the AI system (and what is excluded);
- the third-party AI providers involved and links to their policies;
- that AI outputs can be inaccurate or incomplete and that you should independently verify anything important — especially food safety, livestock health, pricing, or legal questions;
- how to avoid or opt out of the AI feature where feasible.
We do not permit our providers to use your content to train their general-purpose AI models. Your messages, listings, and photos are not sold or licensed for model training.
9. How information is shared
- With other members: your public storefront content, and — when you make or receive an offer — your storefront identity and messages with that member.
- With service providers: the processors listed in section 7, under contract and only to run the service.
- For safety and law: when we reasonably believe disclosure is required by law, subpoena, or to protect the rights, property, or safety of members or the public.
- Business transfer: if the business is sold or merged, account data may transfer to the successor, subject to this policy.
We never sell or rent personal information.
10. Security and your uploads
- All traffic is served over HTTPS.
- Passwords are hashed by our authentication provider; we never see them.
- Database tables enforce row-level security so members can only read and write their own private records.
- Image buckets are private — files are not publicly listable or browsable. Images are shown through time-limited signed links, and only the uploading account can upload, replace, or delete files in its own folder.
- You can delete or replace any photo, avatar, or banner you upload; deleting removes the underlying stored file, not just the reference.
No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by Texas and other applicable law.
11. Data retention
- Account and profile: kept while your account is open; deleted when you delete your account.
- Listings, wanted posts, uploads: kept until you delete them or delete your account.
- Messages: kept while the related trade exists so both sides retain their record; removed with the trade or your account.
- Consent records (Terms/Privacy version, timestamp, IP): retained for up to 7 years after account closure as proof of agreement.
- Moderation and audit logs: retained up to 2 years for safety, dispute resolution, and legal compliance.
- Email delivery logs: retained by our email provider for a short operational window (typically 30 days).
12. Your rights and choices
- Access / portability: download a machine-readable copy of your profile, storefront, listings, wanted posts, offers, trades, messages and upload links from Account settings → Download my data.
- Correction: edit your name, address, email, storefront and listings at any time in settings.
- Deletion: permanently delete your account (and its uploads) from Account settings.
- Opt out of marketing: we send only transactional email; you can stop it entirely by deleting your account or emailing us.
- Cookie choices: change your choices any time from the "Cookie settings" link in the footer.
- Appeal: if we deny a privacy request, you may appeal by replying to our decision email; we will respond within 45 days.
Email privacy@ruralrootstc.com for any request you cannot complete in the app. We respond within 45 days and never discriminate against you for exercising a privacy right.
13. State-specific privacy rights
Texas (Texas Data Privacy and Security Act)
Texas residents may confirm whether we process their personal data, access and correct it, obtain a portable copy, delete it, and opt out of targeted advertising, sale of personal data, or profiling with legal effects. We do not sell personal data, serve targeted advertising, or perform such profiling. Submit requests to privacy@ruralrootstc.com.
California (CCPA/CPRA)
California residents have the right to know, delete, correct, and to limit use of sensitive personal information, plus the right to opt out of sale/sharing. In the past 12 months we collected the categories: identifiers, customer records (name, address, email), commercial information (listings and trades), internet activity (request logs), approximate geolocation, and user-generated content. We disclosed these only to the service providers listed in section 7 for business purposes. We have not sold or shared personal information, and we do not knowingly collect data from anyone under 16.
Other states
Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Montana and other states with comprehensive privacy laws have substantially similar rights of access, correction, deletion, portability, and appeal. Use the same contact address and we will apply the strongest applicable protection.
Nevada
Nevada residents may submit a verified request not to sell covered information; we do not sell it in any case.
14. Children's privacy (COPPA)
The platform is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children under 13, and we do not direct the service to children. If you believe a child has provided us information, email privacy@ruralrootstc.com and we will delete the account and its data promptly.
15. Changes to this policy
We will post any updated policy here with a new version number and effective date. Material changes will be announced in-app or by email, and continued use after the effective date means you accept the update.
16. Contact us
Rural Roots Trading Co.
Rural Roots Trading Co., Texas, United States
Privacy: privacy@ruralrootstc.com
Support: support@ruralrootstc.com
Legal: legal@ruralrootstc.com